Worklet: Install BitLocker and store keys in device tag

Hello everyone,

This is just a script that will store bitlocker recovery keys in the device tags for whatever device the script is run on. Thought this would be an easier way to manage any bitlocker keys for those who will want to install it through automox rather than manually exporting keys or storing them via AD.

Only thing that needs changing is the API Key. Currently there is a placeholder of just “INSERT API KEY HERE” and you must add in your own for it to work.

Remediation Code:

$apiKey = "INSERT API KEY HERE"
$apiUrl = "https://console.automox.com/api/servers/"
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add("Authorization", "Bearer $apiKey")
#$headers.Add("Cookie", "ax_session=eyJpdiI6IlpqM3NxdU03Mk81dHg0RjBkOGZRQmc9PSIsInZhbHVlIjoiL0Z2QVljTVF3SkV2L0Jod0lKMUFHQ0dMalMxQVNNdkswNWRRb2hkN1NiTHBFcWk4S2pXempXU2hpQzhybHE4b3loREhXRUxKSHZPMDBmMHVHNERzVlU2enphQm1sTTA3U2FCSmNlU0lJSjdEKzdDRHRqZXBlNXFSUThWb01zNk5UdXZheXpUNlExeDJKRXdONlZBbFZsV0tYc1hVMkl1Sm1QMFBvcGxKSEZYMkJNS3FkOXpPSStVV1JwNGVEN3ZlYkl5dHhvZnNHNURzR1FjMEUvZCthVyt4S09ZQmt1R2xaQUFzOGJpTmozTVcrdWtMNVdNQUR1cUNwUi9lU0lDamJVVkoydm84UEdsR2NldEVENVQ2TTdweWVkeGJtdjJaeHp6MlVpSUZXUE92MXZqbU0vSjRFcG9CWDVjZkYzeGEycnN5RGZKbDJReFIvbzdKdXRoZ0VVRnEweXhGSHd1dWozWlhTSUhNMVNVMEVGV0Faakw3ZVVWUFI5NDRSSDJKR3BhdkZ5Yk9EeklkNGtPOEhLb1B0T3pJci9JMFpDMUk5dExXZmJINHZmSDk1c3c5QlcyTWwxZEs0V1orVlNmWjFYdVRUZTg1WVNFMVhsdG9STThYMmduWEc4T1A5VGpoU2d6WVRlWXY1N3ByVkFlRVlOcExqT1hxdnpIRHN1RzMiLCJtYWMiOiIzNzc3MzM2MWM0MmQxMTA4NjliZTk2MzEwOTg1NWQ5NWNmZTZhODBlZTQyZGQwMTM3YTI3YTJhMTgwYTg5NzcwIn0%3D")

$response = Invoke-RestMethod $apiUrl -Method 'GET' -Headers $headers -Body $body
$response | ConvertTo-Json


$currentMachineName = $env:COMPUTERNAME;

foreach($server in $response){
	$name = $server.name;	
	if($currentMachineName -eq $name){
		$id = $server.id
		$organization_id = $server.organization_id
		$server_group_id = $server.server_group_id
		#Bitlocker Start
		$keyPath = 'C:\temp'		
		$toEncrypt = Get-BitLockerVolume | Where-Object { $_.VolumeStatus -match 'Decrypted' }	
		
		# Loop through each Unencrypted Drives
		# Enable Bitlocker and Export their Recovery Keys
		foreach ( $drive in $toEncrypt ) 
		{
		    $driveLetter = $drive.MountPoint.Replace(':','')
		    try {
		        #Enable Bitlocker
		        Enable-BitLocker -MountPoint $driveLetter -EncryptionMethod Aes128 -RecoveryPasswordProtector -SkipHardwareTest | Out-Null
		        
				#Export Key and Key ID to a File
				$recID = (Get-BitLockerVolume -MountPoint $driveLetter).KeyProtector.KeyProtectorID
				$recKey = (Get-BitLockerVolume -MountPoint $driveLetter).KeyProtector.RecoveryPassword
				$keyAndID = "Recovery Key: $recKey | and Recovery ID: $recID"
				#Set-Content -Path "$keyPath\BitlockerRecoveryKey_$driveLetter.txt" -Force -Value "Recovery Key ID: $recID"
				#Add-Content -Path "$keyPath\BitlockerRecoveryKey_$driveLetter.txt" -Value "Recovery Key: $recKey"
				
				#Modify device through API
				## Now calling modify device API and set recID,recKey in tags
				$headers.Add("Content-Type", "application/json")
				$apiUrl = "https://console.automox.com/api/servers/$($id)?o=$($organization_id)"
				$body = "{
				    `"server_group_id`": $server_group_id,
				    `"tags`": [
				        `"RecoveryID: $recID`",
						`"RecoveryKey: $recKey`"
				    ]
				}"
				
				$body 
				$response = Invoke-RestMethod $apiUrl -Method 'PUT' -Headers $headers -Body $body
				$response | ConvertTo-Json
				#endregion here is modify device API code ends
				$KeyProperties = @()
				$KeyObj = @()
				$Computer = $env:Computername
				$Keys = Get-BitlockerVolume -MountPoint C:
				$selected = $Keys | Select-Object -ExpandProperty KeyProtector
				$Selected[1] | select-Object KeyprotectorID, RecoveryPassword
				Foreach ($S in $Selected) {
					$KeyProperties = [pscustomobject]@{
							Computer = $Computer
							KeyProtectorID = $S.KeyProtectorID
							RecoveryPassword = $S.RecoveryPassword
					}
					$KeyObj += $KeyProperties
					}
				$KeyObj[1] | Export-CSV "C:\$($Computer)_Keys.csv" -NoTypeInformation
				Write-host $keyAndID
		    } catch {
		        Write-Output "Unable to Encrypt $($drive.MountPoint)"
		    }
		}
		#end of bitlocker code
	
	}
}