Share via

Startup Script does not start encryption

JR Hartley 1 Reputation point
2020-12-15T10:45:55.6+00:00

I have the following powershell that works perfectly when run manually as my Domain Admin account.

All of the commands run correctly when launched manually as (nt authority\system),

The line that does not ever run is the important one - "enable-bitlocker -mountpoint c: ..."

Can anyone help shed any light on why this runs manually, but not as a Startup script.

I can confirm that the startup script does run as the log file is updated with the text that can only be added when the (if) conditions are evaluated as true

 #**********************************************************

'Encryption Script' | Out-File -FilePath c:\intel\Encrypt.log -Append

$EncStatus=(get-bitlockervolume -MountPoint c:).VolumeStatus
$KPExist=(get-bitlockervolume -MountPoint c:).KeyProtector
$now=Get-Date

    if ($EncStatus -eq "FullyDecrypted")
        {
        if (!($KPExist -eq 'RecoveryPassword'))
            {
            $now | Out-File -FilePath c:\intel\Encrypt.log -Append
            'Creating recovery key' | Out-File -FilePath c:\intel\Encrypt.log -Append
            add-BitlockerKeyProtector -mountpoint c: -RecoveryPasswordProtector | Out-File -FilePath c:\intel\Encrypt.log -Append
            start-sleep -seconds 20
            }
        $now | Out-File -FilePath c:\intel\Encrypt.log -Append
        'Turning on Bitlocker' | Out-File -FilePath c:\intel\Encrypt.log -Append
        Enable-BitLocker -MountPoint c: -UsedSpaceOnly -SkipHardwareTest -RecoveryPasswordProtector -EncryptionMethod AES256 | Out-File -FilePath c:\intel\Encrypt.log -Append
        }

#**********************************************************

Thanks in advance,

Windows for business | Windows Server | User experience | PowerShell

2 answers

Sort by: Most helpful
  1. Seppo Lohi 1 Reputation point
    2020-12-16T10:52:36.667+00:00

    Just wild guess: Should the parameter "-mountpoint" be written in with capitals "-MountPoint"?

    add-BitlockerKeyProtector -mountpoint c: ......
    add-BitlockerKeyProtector -MountPoint c: ......
    

    Was this answer helpful?

    0 comments No comments

  2. MTG 1,261 Reputation points
    2020-12-15T14:15:02.093+00:00

    Run the script as system account interactively like this:
    1 download psexec from Microsoft
    2 run: psexec -s -i powershell_ise
    3 on the ISE, load and run your script and see what errors show

    Was this answer helpful?

    0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.