Detect a plugged-in Bitlocker USB encryption key and notify admins.

Question

Hi Guys!

Is it possible to detect a plugged-in Bitlocker USB encryption key and notify administrators? Now, to boot to Windows 10 our users are required to plug in a Bitlocker key. After booting they should remove that USB key but sometimes users forgot to unplug the USB key.

Do you know maybe some kind of a tool or powershell script?

We can use Azure, Intune (Microsoft Endpoint Manger) and Powershell.

Answer 1

manage-bde-status is not right here as it only lists bitlocked drives but not drives with .bek files (B itlocker E ncryption K ey).

What you could do: deploy a scheduled task that runs 5 minutes after logon and looks for .bek files in the root of all drives. Can you script that? If you need help, just say.
What you should do: get rid of USB startup keys. Those don't belong into the hands of ordinary users, since they allow those users to manipulate the drives, decrypt them, make themselves admin and so on. Use TPM instead. All boards 2015 and newer have onboard TPMs or at least TPM headers or fTPMS.

Edit: here's a script

$sticks=Get-WmiObject Win32_Volume -Filter "DriveType='2'"
$beks=foreach ($stick in $sticks) {gci $stick.caption*.bek -Attributes r+s+h}
if (!$beks){exit}
else {msg * /time:0 Unplug that Bitlocker stick!}