Param ( |
) |
|
$output = New-Object BinaryTree.ADM.Agent.PSHelpers.PSOutput |
|
|
$ScriptName = "BackupBitlockerKeyToADD.ps1" |
|
$BacktoAAD = @" |
|
Try{ |
`$ODMADService = Get-Service -Name ODMActiveDirectory |
} |
Catch{ |
Write-Output "Error Retrieving Service Status...Terminating with error: `$(`$Error)" |
Exit 1 |
} |
If(`$ODMADService){ |
Write-Output "ODM AD Agent Service Found...Finding ODM AD Agent Service Path" |
`$ODMADServicePath = (Get-ItemProperty -Path HKLM:SYSTEM\CurrentControlSet\Services\ODMActiveDirectory).ImagePath |
`$ODMAgentPath = Split-Path `$ODMADServicePath |
`$ODMAgentPath = `$ODMAgentPath.Trim("``"") |
Write-Output "ODM AD Service Path: `$(`$ODMAgentPath)" |
} |
Else{ |
Write-Output "No ODM Agent Service Found...Terminating" |
Exit 1 |
} |
|
`$TranscriptFile = "`$(`$ODMAgentPath)\Files\PowerShell-`$(Get-Date -f yyyyMMdd-HHMM)-BackupBitlockerKeyToAAD.log" |
Start-Transcript -Path `$TranscriptFile |
|
`$DriveLetter = `$env:SystemDrive |
|
#endregion declarations |
|
#region functions |
|
function Test-Bitlocker (`$BitlockerDrive) { |
#Tests the drive for existing Bitlocker keyprotectors |
try { |
Get-BitLockerVolume -MountPoint `$BitlockerDrive -ErrorAction Stop |
} catch { |
Write-Output "Bitlocker was not found protecting the `$BitlockerDrive drive. Terminating script!" |
exit 0 |
} |
} |
|
function Get-KeyProtectorId (`$BitlockerDrive) { |
#fetches the key protector ID of the drive |
`$BitLockerVolume = Get-BitLockerVolume -MountPoint `$BitlockerDrive |
`$KeyProtector = `$BitLockerVolume.KeyProtector | Where-Object { `$_.KeyProtectorType -eq 'RecoveryPassword' } |
return `$KeyProtector.KeyProtectorId |
} |
|
function Invoke-BitlockerEscrow (`$BitlockerDrive,`$BitlockerKey) { |
#Escrow the key into Azure AD |
try { |
BackupToAAD-BitLockerKeyProtector -MountPoint `$BitlockerDrive -KeyProtectorId `$BitlockerKey -ErrorAction SilentlyContinue |
Write-Output "Attempted to escrow key in Azure AD - Please verify manually!" |
exit 0 |
} catch { |
Write-Error "Error Occurred" |
exit 1 |
} |
} |
|
#endregion functions |
|
#region execute |
|
Test-Bitlocker -BitlockerDrive `$DriveLetter |
`$KeyProtectorId = Get-KeyProtectorId -BitlockerDrive `$DriveLetter |
Invoke-BitlockerEscrow -BitlockerDrive `$DriveLetter -BitlockerKey `$KeyProtectorId |
|
#endregion execute |
|
|
Remove-Item -path "`$ODMAgentPath\$($ScriptName)" -Force |
|
Unregister-ScheduledTask -TaskName "$($TaskName)" -Confirm:`$false |
|
Stop-Transcript |
|
"@ |
|
#$output = New-Object BinaryTree.ADM.Agent.PSHelpers.PSOutput |
|
### Get ODMAD Agent Information to determine path |
Try{ |
$ODMADService = Get-Service -Name ODMActiveDirectory -ErrorAction SilentlyContinue |
} |
Catch{ |
Write-Output "Error Retrieving Service Status...Terminating with error: $($Error)" |
Exit 1 |
} |
If($ODMADService){ |
Write-Output "ODM AD Agent Service Found...Finding ODM AD Agent Service Path" |
$ODMADServicePath = (Get-ItemProperty -Path HKLM:SYSTEM\CurrentControlSet\Services\ODMActiveDirectory).ImagePath |
$ODMAgentPath = Split-Path $ODMADServicePath |
$ODMAgentPath = $ODMAgentPath.Trim("`"") |
Write-Output "ODM AD Service Path: $($ODMAgentPath)" |
} |
Else{ |
Write-Output "No ODM Agent Service Found...Terminating" |
Exit 1 |
} |
|
$AgentPath = "$ODMAgentPath\" |
$ScriptFullName = $AgentPath+$ScriptName |
If(!(Test-Path $ScriptFullName)) { |
New-item -path $ODMAgentPath -Name $ScriptName -Type "File" -Value $BacktoAAD |
} |
|
# Create Scheduled Task |
$TaskName = "Backup Bitlocker Key" |
$Argument = "-ExecutionPolicy Bypass -File `"$($ODMAgentPath)\$($ScriptName)`"" |
$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument $Argument |
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries |
$Principal = New-ScheduledTaskPrincipal -UserId "LOCALSERVICE" -LogonType ServiceAccount |
$Trigger = New-ScheduledTaskTrigger -Atlogon |
$Trigger.Delay = "PT20M" |
$ScheduledTask = New-ScheduledTask -Action $Action -Trigger $Trigger -Settings $Settings |
# Register Scheduled Task |
Register-ScheduledTask -TaskName $TaskName -InputObject $ScheduledTask -User "NT AUTHORITY\SYSTEM" -Force |
|
return ($output) |