{"id":48553,"date":"2023-09-12T12:46:07","date_gmt":"2023-09-12T11:46:07","guid":{"rendered":"https:\/\/www.n-able.com\/?p=48553"},"modified":"2023-09-14T12:52:36","modified_gmt":"2023-09-14T11:52:36","slug":"are-you-sure-your-devices-are-fully-encrypted-with-bitlocker","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/es\/blog\/are-you-sure-your-devices-are-fully-encrypted-with-bitlocker","title":{"rendered":"Are You Sure Your Devices Are Fully Encrypted with BitLocker?"},"content":{"rendered":"

BitLocker has long been the standard when it comes to disk encryption for your devices running Microsoft Windows operating systems\u2014particularly on workstations and laptops. It’s designed to protect data by encrypting the entire disk drive on which the OS and user data are stored. This encryption ensures that even if someone physically steals or accesses your computer, they won’t be able to get to the data on the encrypted drive without the appropriate decryption key.<\/span><\/p>\n

It is commonplace these days for MSPs and IT Admins to monitor BitLocker status on devices. While you may be sitting there confident your devices are fully encrypted, did you know most BitLocker status monitoring is done by using the Get-BitLockerVolume PowerShell command?<\/span><\/p>\n

What\u2019s wrong with the Get-BitLockerVolume PowerShell command?<\/span><\/h2>\n

The issue here is that this command can sometimes return a false positive when a drive is not fully encrypted. With newer devices, Microsoft starts the encryption process as part of the system setup on first boot. If you sign in with a Microsoft account, it will kick off a wizard to guide you through the process, and of course it will want you to store the keys in that account. If you don\u2019t do this, BitLocker pauses and waits for the Microsoft account to move forward. Because of this, the Get-BitLockerVolume PowerShell cmd is going to show the device as encrypted, even though the process was not fully completed.<\/span><\/p>\n

How can you be sure the BitLocker disk encryption process has completed successfully? <\/span><\/h2>\n

One way to verify that the device has been encrypted is if there is a recovery key present. <\/span><\/p>\n

To ensure you can confidently answer yes to the question \u201cAre Your Devices Fully Encrypted with BitLocker?\u201d,<\/span> <\/span>I\u2019ve taken the Bitlocker Status AMP\u2014widely used by our N‑able partners\u2014and updated it. Now, not only does it tell you if BitLocker is turned on, but it also automatically checks what the system drive is. On top of this, it will retrieve the system drive recovery key so that you can confidently say the device is fully encrypted.<\/span><\/p>\n

With the new BitLocker Status v2 monitoring, it will show as failed if any of the following scenarios are true:<\/span><\/p>\n