The story goes:
Offline build from SCCM Offline Key - drive is encrypted but Bitlocker is not turned on.
My script is sort of doing the job but I am having trouble with the $? command.
It is accepting every last command as $True thus keep producing new Recovery Keys into AD.
Any help is appreciated (not sure if this question is for this PowerShell Forum or W10 Security)
# Initialise Log Path if (!(Test-Path -path $LogFilePath)){ New-Item -Type Directory -Path $LogFilePath } $encryption_check_all =@() $encryption_check_all = Get-BitLockerVolume -ErrorAction SilentlyContinue (($encryption_check_all.MountPoint -eq 'C:') -and ($encryption_check_all.protectionStatus -eq 'off')) if($? -ne $True){ echo "$timeStamper Bitlocker on C: drive - is turned OFF" | out-file -append $LogFileFullPath echo "$timeStamper Bitlocker on C: drive - is initialising" | out-file -append $LogFileFullPath Enable-BitLocker -MountPoint $env:SystemDrive -TpmProtector -UsedSpaceOnly -SkipHardwareTest -ErrorAction SilentlyContinue | out-file -append $LogFileFullPath Add-BitlockerKeyProtector -MountPoint $env:SystemDrive -RecoveryPasswordProtector -ErrorAction SilentlyContinue | out-file -append $LogFileFullPath manage-bde.exe -protectors -enable C: | out-file -append $LogFileFullPath } else { echo "$timeStamper Bitlocker on C: drive is ALREADY Turned ON" | out-file -append $LogFileFullPath } $encryption_check_all2 =@() $encryption_check_all2 = Get-BitLockerVolume -ErrorAction Stop (($encryption_check_all2.MountPoint -eq 'C:') -and ($encryption_check_all2.protectionStatus -eq 'on')) if($? -eq $True) {echo "$timeStamper Bitlocker on C: drive is CONFIRMED Turned ON" | out-file -append $LogFileFullPath }Thanks, M
Maelito