Bitlocker- Prompt User to Change Pin via PS Script

Question

Hi,

I have already set up bitlocker via Task Sequence setting up default PIN. My requirement is to prompt user to change the PIN via PS Script ( preferably want to use Intune).
Also I have script as below which is prompting for the PIN Change.

$Drive = "C:"

$EncryptableVolume = Get-WmiObject -Namespace "Root\CIMV2\Security\MicrosoftVolumeEncryption" -class Win32_EncryptableVolume -Filter "ProtectionStatus=1 AND DriveLetter='$Drive'"
if ($EncryptableVolume)
{

$OS = Get-WmiObject -Class Win32_OperatingSystem | Select-Object OSArchitecture

$cmd = @("$ENV:windir\system32\bitlockerwizardelev.exe",'$($EncryptableVolume.DeviceID)',"U") -join " "
Invoke-Expression -Command $cmd
}

But, In case User cancels that prompt than what? how can I check if user have changed password or not?

Regards,
Kanika

Answer 1

Never tried it but you can deploy a compliance setting to query the encryption wmi class to check for default pin and then prompt the user to set the pin using the script you posted.

Although, in my honest opinion, setting pin is an overkill and pointless.

Answer 2

@Kanika Asht I have done tests in my environment but it seems Intune doesn’t have the ability to check if user has changed PIN or not. From Intune side, we can only see if the script has been deployed successfully, or if the devices has Bitlocker enabled. See the following two screenshots.

Answer 3

PIN code for Bitlocker was valuable for Windows 7 and Bios legacy format. With Windows 10 and UEFI you don't really need it, it doesn't bring big additional value, because the boot loader is already protected with UEFI.