Atliso-BitLockerEscrow

1.0.1

BitLocker can report as encrypted while its recovery password never made it to
Entra ID (Azure AD), leaving the device unrecoverable. This script confirms whether
a successful escrow was logged recently, and if not, forces the backup for every
RecoveryPassword protector on the target volumes.

Detection signal: event ID 845 in the
Microsoft-Windows-BitLocker-API/Management channel is written when a key is
successfully backed up to Entra ID. If one exists inside -MaxAgeDays, the volume
is treated as escrowed and nothing is re-sent.

Runs audit-only by default (-WhatIf $true). Set -WhatIf $false to actually call
BackupToAAD-BitLockerKeyProtector.

Intune usage: deploy as a Remediation. Use the detection half (exit 1 when nothing
is confirmed) as the detection script, and this script with -WhatIf $false as the
remediation script. Run as SYSTEM, 64-bit.

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Script -Name Atliso-BitLockerEscrow

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More