BitLocker Protection Fix

A PowerShell script that finds drives that are encrypted but not protected, and fixes them without decrypting.

Send me the scriptView on GitHub

What it does

  • Detects a fully encrypted OS drive with Protection Off: FullyEncrypted + ProtectionStatus Off
  • Tells apart no protectors, no TPM protector and a stuck suspension
  • Adds a TPM protector (and a recovery password if missing) or runs Resume-BitLocker
  • Checks TPM readiness and refuses to fight a policy that requires a startup PIN
  • Respects a pending update reboot
  • Reports only by default ($WhatIf = $true)
  • Never writes the recovery password to the log
  • Logs to %LOCALAPPDATA%\Atliso\BitLockerProtectionFix.log

Configuration

You edit one block:

PowerShell
Preview snippet. The full, tested script lives in the vault.
#region CONFIG
$Mode                         = 'Detect'          # 'Detect' or 'Remediate'
$WhatIf                       = $true             # $false in the Intune remediation copy
$MountPoint                   = $env:SystemDrive
$AddRecoveryPasswordIfMissing = $true
$BackupToEntra                = $false            # Entra joined devices only
$SkipIfRebootPending          = $true
#endregion

Deploy in Intune

SettingValue
Detection scriptCopy with $Mode = 'Detect'
Remediation scriptCopy with $Mode = 'Remediate' and $WhatIf = $false (Intune cannot pass parameters)
Run this script using the logged-on credentialsNo (runs as SYSTEM)
Run script in 64-bit PowerShellYes
ScheduleDaily

Full walkthrough with screenshots: BitLocker Waiting for Activation: Fix Protection Off with PowerShell and Intune

Version history

Scripts are checked against each month's Windows and Intune changes and patched when something breaks. Every version stays available: if a newer one misbehaves in your environment, use the one before it and reply to any Atliso email to tell me.

  1. v1.0.0Latest

    Initial public release. MIT licensed. Download the zip below or clone the repo. See README for usage and the linked Atliso guide.

    Download v1.0.0 from GitHub

Get BitLocker Protection Fix

We'll send the script plus the deployment checklist, and updates when Microsoft changes something. No spam.