Report if Bitlocker startup pin is set on workstations

Question

I am looking for a way to report which workstations do/don't have a bitlocker startup pin set. i would like to be able to pull this information either with configruation manager or intune.

Answer 1

I ended up using Intune Remedition (formerly proactive remediation) for this. it's actually pretty nice, and lets you filter based on status, and export the report.

I only created a detection script (no remediation script).

Here is the detection script i used.

Credit to this website for the script, (although i didn't end up doing everything on that page).

https://endpointcave.com/enforce-bitlocker-startup-pin-on-windows-with-intune/

$pin = (Get-BitLockerVolume -MountPoint $env:SystemDrive).KeyProtector  | Where { $_.KeyProtectorType -eq 'TpmPin' }

if (((Get-BitLockerVolume -MountPoint $env:SystemDrive).VolumeStatus) -ne "FullyDecrypted")
    {
    Write-Output "Encryption enabled"
    if ($pin -ne $null)
        {
            Write-Output "TPM Pin set"
            Exit 0
        }
    else
        {
            Write-Output "TPM Pin is not set"
            Exit 1
        }

    }
else
    {
        Write-Output "Encryption not yet started"
        Exit 0
    }