BitLocker et LAPS via GPO¶

# Retrieve BitLocker encryption status across the entire domain fleet
param(
    [string]$OU = "",          # Optional: limit to a specific OU (DistinguishedName)
    [string]$OutputCsv = ""    # Optional: export results to CSV
)

$filter = if ($OU) {
    { OperatingSystem -like "*Windows*" }
} else {
    { OperatingSystem -like "*Windows*" }
}

$searchBase = if ($OU) { @{ SearchBase = $OU } } else { @{} }

$computers = Get-ADComputer -Filter $filter @searchBase |
    Select-Object -ExpandProperty Name

$results = foreach ($computer in $computers) {
    try {
        $status = Invoke-Command -ComputerName $computer -ScriptBlock {
            $vol = Get-BitLockerVolume -MountPoint "C:" -ErrorAction Stop
            [PSCustomObject]@{
                Computer          = $env:COMPUTERNAME
                EncryptionStatus  = $vol.VolumeStatus          # FullyEncrypted, FullyDecrypted, EncryptionInProgress
                ProtectionStatus  = $vol.ProtectionStatus      # On, Off
                EncryptionMethod  = $vol.EncryptionMethod
                KeyProtectors     = ($vol.KeyProtector.KeyProtectorType) -join ", "
                PercentEncrypted  = $vol.EncryptionPercentage
            }
        } -ErrorAction Stop
        $status
    } catch {
        [PSCustomObject]@{
            Computer          = $computer
            EncryptionStatus  = "ERROR: $_"
            ProtectionStatus  = "Unknown"
            EncryptionMethod  = "Unknown"
            KeyProtectors     = "Unknown"
            PercentEncrypted  = -1
        }
    }
}

$results | Format-Table -AutoSize

if ($OutputCsv) {
    $results | Export-Csv -Path $OutputCsv -NoTypeInformation -Encoding UTF8
    Write-Host "Exported to $OutputCsv"
}

# BitLocker remediation startup script — encrypts C: if not already encrypted
# Deploy via GPO: Computer Configuration > Windows Settings > Scripts > Startup

$logPath = "C:\Windows\Logs\BitLocker-Remediation.log"
$vol     = Get-BitLockerVolume -MountPoint "C:" -ErrorAction Stop

function Write-Log {
    param([string]$Message)
    $entry = "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] $Message"
    Add-Content -Path $logPath -Value $entry -Encoding UTF8
}

# Skip if already fully encrypted
if ($vol.VolumeStatus -eq "FullyEncrypted" -and $vol.ProtectionStatus -eq "On") {
    Write-Log "BitLocker already active — no action required."
    exit 0
}

# Check TPM availability
$tpm = Get-Tpm -ErrorAction SilentlyContinue
if (-not $tpm -or -not $tpm.TpmReady) {
    Write-Log "ERROR: TPM not ready — cannot enable BitLocker. TPMPresent=$($tpm.TpmPresent) TpmReady=$($tpm.TpmReady)"
    exit 1
}

Write-Log "Starting BitLocker encryption on C: — TPM ready."

try {
    # Add TPM key protector
    Add-BitLockerKeyProtector -MountPoint "C:" -TpmProtector -ErrorAction Stop |
        Out-Null

    # Add recovery password protector (will be escrowed to AD by GPO policy)
    $keyResult = Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector -ErrorAction Stop
    $recoveryKeyId = $keyResult.KeyProtector |
        Where-Object { $_.KeyProtectorType -eq "RecoveryPassword" } |
        Select-Object -ExpandProperty KeyProtectorId

    Write-Log "Key protectors added. Recovery Key ID: $recoveryKeyId"

    # Back up recovery key to AD before starting encryption
    Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $recoveryKeyId -ErrorAction Stop
    Write-Log "Recovery key escrowed to Active Directory successfully."

    # Start encryption (SkipHardwareTest allows encryption without reboot cycle)
    Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -SkipHardwareTest -ErrorAction Stop |
        Out-Null

    Write-Log "Encryption started. Status: $(( Get-BitLockerVolume -MountPoint 'C:' ).VolumeStatus)"
} catch {
    Write-Log "ERROR during BitLocker activation: $_"
    exit 1
}

# Verify that each computer has a BitLocker recovery key stored in Active Directory
param(
    [string]$SearchBase = (Get-ADDomain).DistinguishedName
)

$computers = Get-ADComputer -Filter { OperatingSystem -like "*Windows*" } `
    -SearchBase $SearchBase | Select-Object -ExpandProperty DistinguishedName

foreach ($dn in $computers) {
    $cn = ($dn -split ',')[0] -replace '^CN='

    # BitLocker recovery objects are stored as child objects of the computer object
    $recoveryObjects = Get-ADObject -Filter { objectClass -eq "msFVE-RecoveryInformation" } `
        -SearchBase $dn -Properties msFVE-RecoveryPassword, Created -ErrorAction SilentlyContinue

    [PSCustomObject]@{
        Computer      = $cn
        KeysInAD      = ($recoveryObjects | Measure-Object).Count
        LatestBackup  = ($recoveryObjects | Sort-Object Created -Descending | Select-Object -First 1).Created
    }
}

# Extend Active Directory schema for LAPS v1 (AdmPwd)
# Must be run as Schema Admin on the Schema Master DC

Import-Module AdmPwd.PS

# Update the AD schema — this operation is irreversible
Update-AdmPwdADSchema

# Grant read permission on ms-Mcs-AdmPwd attribute to a specific group
# Run once per OU that contains LAPS-managed computers

param(
    [Parameter(Mandatory)]
    [string]$OUDistinguishedName,   # e.g. "OU=Workstations,DC=contoso,DC=local"

    [Parameter(Mandatory)]
    [string]$AllowedGroup           # e.g. "CONTOSO\ServiceDesk-L1"
)

Import-Module AdmPwd.PS

Set-AdmPwdReadPasswordPermission -OrgUnit $OUDistinguishedName -AllowedPrincipals $AllowedGroup

# Retrieve LAPS v1 password for a specific computer from Active Directory
param(
    [Parameter(Mandatory)]
    [string]$ComputerName
)

Import-Module AdmPwd.PS

Get-AdmPwdPassword -ComputerName $ComputerName | Select-Object ComputerName, Password, ExpirationTimestamp

# Extend Active Directory schema for Windows LAPS (v2)
# Requires AD PowerShell module and Schema Admin rights

Import-Module ActiveDirectory

# Update schema — adds msLAPS-* attributes to the Computer class
Update-LapsADSchema -Verbose

# Grant read permission on Windows LAPS encrypted password attribute to a group
param(
    [Parameter(Mandatory)]
    [string]$OUDistinguishedName,

    [Parameter(Mandatory)]
    [string]$AllowedGroup
)

# Set-LapsADReadPasswordPermission is part of the LAPS PowerShell module (Windows LAPS)
Set-LapsADReadPasswordPermission -Identity $OUDistinguishedName -AllowedPrincipals $AllowedGroup

# Retrieve Windows LAPS (v2) password for a specific computer
param(
    [Parameter(Mandatory)]
    [string]$ComputerName
)

# Get-LapsADPassword requires the LAPS module (included with Windows LAPS feature)
Get-LapsADPassword -Identity $ComputerName -AsPlainText | Select-Object ComputerName, Password, ExpirationTimestamp

# Detect which LAPS version (v1, v2, or both) is active on a set of computers
param(
    [string[]]$ComputerNames = @($env:COMPUTERNAME)
)

foreach ($computer in $ComputerNames) {
    $result = Invoke-Command -ComputerName $computer -ScriptBlock {
        # Check for Windows LAPS (v2) — present as a Windows capability
        $lapsV2Present = (Get-WindowsCapability -Online -Name "LAPS*" -ErrorAction SilentlyContinue |
            Where-Object { $_.State -eq "Installed" }).Count -gt 0

        # Check for LAPS v1 CSE DLL
        $lapsV1Present = Test-Path "C:\Program Files\LAPS\CSE\AdmPwd.dll"

        # Check which policy is actually active via registry
        $v2PolicyActive = Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS"
        $v1PolicyActive = Test-Path "HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd"

        [PSCustomObject]@{
            Computer      = $env:COMPUTERNAME
            LAPSv1_CSE    = $lapsV1Present
            LAPSv2_CSE    = $lapsV2Present
            LAPSv1_Policy = $v1PolicyActive
            LAPSv2_Policy = $v2PolicyActive
            ActiveVersion = if ($lapsV2Present -and $v2PolicyActive) { "v2 (Windows LAPS)" }
                            elseif ($lapsV1Present -and $v1PolicyActive) { "v1 (AdmPwd)" }
                            elseif ($lapsV1Present -and $v2PolicyActive) { "v2 overrides v1" }
                            else { "None" }
        }
    } -ErrorAction SilentlyContinue

    $result
}

# Audit which security principals have read permissions on LAPS password attributes
param(
    [Parameter(Mandatory)]
    [string]$OUDistinguishedName
)

# Load the AD module
Import-Module ActiveDirectory

$ou = Get-ADOrganizationalUnit -Identity $OUDistinguishedName
$acl = Get-Acl -Path "AD:\$($ou.DistinguishedName)"

# Resolve schema GUIDs dynamically from the current forest
$schemaNC   = (Get-ADRootDSE).schemaNamingContext
$lapsV1Attr = Get-ADObject -SearchBase $schemaNC -LDAPFilter "(lDAPDisplayName=ms-Mcs-AdmPwd)" -Properties schemaIDGUID
$lapsV2Attr = Get-ADObject -SearchBase $schemaNC -LDAPFilter "(lDAPDisplayName=msLAPS-EncryptedPassword)" -Properties schemaIDGUID
$lapsV1Guid = [guid]::new($lapsV1Attr.schemaIDGUID)
$lapsV2Guid = [guid]::new($lapsV2Attr.schemaIDGUID)

$lapsAcls = $acl.Access | Where-Object {
    $_.ActiveDirectoryRights -match "ReadProperty" -and
    ($_.ObjectType -eq $lapsV1Guid -or $_.ObjectType -eq $lapsV2Guid -or
     $_.ObjectType -eq [guid]::Empty)   # empty GUID = all properties
}

if ($lapsAcls) {
    Write-Host "Principals with LAPS read access on OU '$OUDistinguishedName':" -ForegroundColor Green
    $lapsAcls | Select-Object IdentityReference, ActiveDirectoryRights, ObjectType |
        Format-Table -AutoSize
} else {
    Write-Host "WARNING: No explicit LAPS read permissions found on OU '$OUDistinguishedName'" -ForegroundColor Red
    Write-Host "The helpdesk will NOT be able to read LAPS passwords for computers in this OU."
}

# Grant LAPS v1 read permissions to helpdesk group on all workstation OUs
param(
    [Parameter(Mandatory)]
    [string[]]$OUList,

    [Parameter(Mandatory)]
    [string]$HelpdeskGroup    # e.g. "CONTOSO\Helpdesk-LAPS-Readers"
)

Import-Module AdmPwd.PS

foreach ($ou in $OUList) {
    Write-Host "Setting LAPS v1 read permission on: $ou"
    Set-AdmPwdReadPasswordPermission -OrgUnit $ou -AllowedPrincipals $HelpdeskGroup
    Write-Host "  Done." -ForegroundColor Green
}

# Grant Windows LAPS (v2) read permissions to helpdesk group on all workstation OUs
param(
    [Parameter(Mandatory)]
    [string[]]$OUList,

    [Parameter(Mandatory)]
    [string]$HelpdeskGroup
)

foreach ($ou in $OUList) {
    Write-Host "Setting LAPS v2 read permission on: $ou"
    Set-LapsADReadPasswordPermission -Identity $ou -AllowedPrincipals $HelpdeskGroup
    Write-Host "  Done." -ForegroundColor Green
}

# End-to-end verification: attempt to read LAPS password as a helpdesk user
# Run this script as a member of the helpdesk group (not as Domain Admin)
param(
    [Parameter(Mandatory)]
    [string]$TestComputerName
)

Write-Host "Testing LAPS access for computer: $TestComputerName" -ForegroundColor Cyan
Write-Host "Running as: $([System.Security.Principal.WindowsIdentity]::GetCurrent().Name)"
Write-Host ""

# Test LAPS v1
try {
    Import-Module AdmPwd.PS -ErrorAction Stop
    $v1 = Get-AdmPwdPassword -ComputerName $TestComputerName -ErrorAction Stop
    Write-Host "LAPS v1 read: OK — Password expires $($v1.ExpirationTimestamp)" -ForegroundColor Green
} catch {
    Write-Host "LAPS v1 read: FAILED — $_" -ForegroundColor Red
}

# Test LAPS v2
try {
    $v2 = Get-LapsADPassword -Identity $TestComputerName -AsPlainText -ErrorAction Stop
    Write-Host "LAPS v2 read: OK — Password expires $($v2.ExpirationTimestamp)" -ForegroundColor Green
} catch {
    Write-Host "LAPS v2 read: FAILED — $_" -ForegroundColor Red
}

# Comprehensive post-deployment check: BitLocker status + LAPS password presence
param(
    [string[]]$SampleComputers    # Provide a representative sample
)

foreach ($computer in $SampleComputers) {
    $result = Invoke-Command -ComputerName $computer -ScriptBlock {
        # BitLocker status
        $bl = Get-BitLockerVolume -MountPoint "C:" -ErrorAction SilentlyContinue
        $blStatus = if ($bl) { "$($bl.VolumeStatus) / Protection: $($bl.ProtectionStatus)" } else { "WMI error" }

        # LAPS v2 policy registry key
        $lapsV2Active = Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\LAPS"

        # LAPS v1 policy registry key
        $lapsV1Active = Test-Path "HKLM:\SOFTWARE\Policies\Microsoft Services\AdmPwd"

        [PSCustomObject]@{
            Computer      = $env:COMPUTERNAME
            BitLocker     = $blStatus
            LAPSv1_Active = $lapsV1Active
            LAPSv2_Active = $lapsV2Active
            LastGPOApply  = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" `
                                -Name "SyncForegroundPolicy" -ErrorAction SilentlyContinue) |
                            Select-Object -ExpandProperty SyncForegroundPolicy
        }
    } -ErrorAction SilentlyContinue

    $result
}