BitLocker Protection Fix

A PowerShell script that finds drives that are encrypted but not protected, and fixes them without decrypting.

Send me the scriptView on GitHub

What it does

  • Detects a fully encrypted OS drive with Protection Off: FullyEncrypted + ProtectionStatus Off
  • Tells apart no protectors, no TPM protector and a stuck suspension
  • Adds a TPM protector (and a recovery password if missing) or runs Resume-BitLocker
  • Checks TPM readiness and refuses to fight a policy that requires a startup PIN
  • Respects a pending update reboot
  • Reports only by default ($WhatIf = $true)
  • Never writes the recovery password to the log
  • Logs to %LOCALAPPDATA%\Atliso\BitLockerProtectionFix.log

Configuration

You edit one block:

PowerShell
Preview snippet. The full, tested script lives in the vault.
#region CONFIG
$Mode                         = 'Detect'          # 'Detect' or 'Remediate'
$WhatIf                       = $true             # $false in the Intune remediation copy
$MountPoint                   = $env:SystemDrive
$AddRecoveryPasswordIfMissing = $true
$BackupToEntra                = $false            # Entra joined devices only
$SkipIfRebootPending          = $true
#endregion

Deploy in Intune

SettingValue
Detection scriptCopy with $Mode = 'Detect'
Remediation scriptCopy with $Mode = 'Remediate' and $WhatIf = $false (Intune cannot pass parameters)
Run this script using the logged-on credentialsNo (runs as SYSTEM)
Run script in 64-bit PowerShellYes
ScheduleDaily

Full walkthrough with screenshots: BitLocker Waiting for Activation: Fix Protection Off with PowerShell and Intune

Get BitLocker Protection Fix

We'll send the script plus the deployment checklist, and updates when Microsoft changes something. No spam.