A powershell script and wrapper for initializing BitLocker and storing keys via GPO

bitlocker-activator-wrapper.bat

@ECHO OFF

REM Original thread detailing solution and requirement for this wrapper can be found below:
REM https://social.technet.microsoft.com/Forums/en-US/9e56a51c-42fa-4f17-afe2-78b8c5e90fcf/error-0x80070522?forum=mdopmbam

SET DomainName=netlabwork.us

\\%DomainName%\SYSVOL\%DomainName%\bin\psexec.exe -accepteula -s cmd /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy ByPass \\%DomainName%\SYSVOL\%DomainName%\scripts\bitlocker-activator.ps1 > "%TEMP%\BitLockerEnablerWrapper.log" 2>&1

bitlocker-activator.ps1

# Check BitLocker prerequisites

# This script can not be executed under normal circumstances via NT AUTHORITY\SYSTEM
# A psexec service wrapper is required to run TPM commands in a non interactive context 
# See the wrapper for more details

# Original script and guide here: 
# https://purple.telstra.com.au/blog/zero-touch-bitlocker-with-powershell

# Modified by:
# Geofferey@github.com

$TPMNotEnabled = Get-WmiObject win32_tpm -Namespace root\cimv2\security\microsofttpm | where {$_.IsEnabled_InitialValue -eq $false} -ErrorAction SilentlyContinue
$TPMEnabled = Get-WmiObject win32_tpm -Namespace root\cimv2\security\microsofttpm | where {$_.IsEnabled_InitialValue -eq $true} -ErrorAction SilentlyContinue
$WindowsVer = Get-WmiObject -Query 'select * from Win32_OperatingSystem where (Version like "6.2%" or Version like "6.3%" or Version like "10.0%") and ProductType = "1"' -ErrorAction SilentlyContinue
$BitLockerReadyDrive = Get-BitLockerVolume -MountPoint $env:SystemDrive -ErrorAction SilentlyContinue
$BitLockerDecrypted = Get-BitLockerVolume -MountPoint $env:SystemDrive | where {$_.VolumeStatus -eq "FullyDecrypted"} -ErrorAction SilentlyContinue
$BitLockerEncrypted = Get-BitLockerVolume -MountPoint $env:SystemDrive | where {$_.VolumeStatus -eq "FullyEncrypted"} -ErrorAction SilentlyContinue
$BitLockerEncrypting =  Get-BitLockerVolume -MountPoint $env:SystemDrive | where {$_.VolumeStatus -eq "EncryptionInProgress"} -ErrorAction SilentlyContinue
$BLVS = Get-BitLockerVolume | Where-Object {$_.KeyProtector | Where-Object {$_.KeyProtectorType -eq 'RecoveryPassword'}} -ErrorAction SilentlyContinue
$DeviceName = (Get-CimInstance -ClassName Win32_ComputerSystem).Name
$DomainName = (Get-CimInstance -ClassName Win32_ComputerSystem).Domain
$LogEncrypted = Select-String -Path \\$DomainName\sysvol\$DomainName\BitLockerEnablerLogs\BitLockerEnabler_$DeviceName.log -Pattern "VolumeStatus         : FullyEncrypted" -ErrorAction SilentlyContinue


if ($BitLockerEncrypted -and $LogEncrypted -ne $null) {

  exit 0

}

$ErrorActionPreference="SilentlyContinue"
Stop-Transcript | out-null
$ErrorActionPreference = "Continue"
Start-Transcript -path \\$DomainName\sysvol\$DomainName\BitLockerEnablerLogs\BitLockerEnabler_$DeviceName.log -append

#Step 1 - Check if TPM is enabled and initialise if required
if ($WindowsVer -and !$TPMNotEnabled) {

  Initialize-Tpm -AllowClear -AllowPhysicalPresence -ErrorAction SilentlyContinue 

}

#Step 2 - Check if BitLocker volume is provisioned and partition system drive for BitLocker if required
if ($WindowsVer -and $TPMEnabled -and !$BitLockerReadyDrive) {

  Get-Service -Name defragsvc -ErrorAction SilentlyContinue | Set-Service -Status Running -ErrorAction SilentlyContinue
  BdeHdCfg -target $env:SystemDrive shrink -quiet

}

#Step 3 - Check BitLocker AD Key backup Registry values exist and if not, create them.

$BitLockerRegLoc = 'HKLM:\SOFTWARE\Policies\Microsoft'

if (Test-Path "$BitLockerRegLoc\FVE") {

  Write-Verbose '$BitLockerRegLoc\FVE Key already exists' -Verbose

}

else

{
  New-Item -Path "$BitLockerRegLoc" -Name 'FVE'
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'ActiveDirectoryBackup' -Value '00000001' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'RequireActiveDirectoryBackup' -Value '00000001' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'ActiveDirectoryInfoToStore' -Value '00000001' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'EncryptionMethodNoDiffuser' -Value '00000003' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'EncryptionMethodWithXtsOs' -Value '00000006' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'EncryptionMethodWithXtsFdv' -Value '00000006' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'EncryptionMethodWithXtsRdv' -Value '00000003' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'EncryptionMethod' -Value '00000003' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'OSRecovery' -Value '00000001' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'OSManageDRA' -Value '00000000' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'OSRecoveryPassword' -Value '00000002' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'OSRecoveryKey' -Value '00000002' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'OSHideRecoveryPage' -Value '00000001' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'OSActiveDirectoryBackup' -Value '00000001' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'OSActiveDirectoryInfoToStore' -Value '00000001' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'OSRequireActiveDirectoryBackup' -Value '00000001' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'OSAllowSecureBootForIntegrity' -Value '00000001' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'OSEncryptionType' -Value '00000001' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'FDVRecovery' -Value '00000001' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'FDVManageDRA' -Value '00000000' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'FDVRecoveryPassword' -Value '00000002' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'FDVRecoveryKey' -Value '00000002' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'FDVHideRecoveryPage' -Value '00000001' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'FDVActiveDirectoryBackup' -Value '00000001' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'FDVActiveDirectoryInfoToStore' -Value '00000001' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'FDVRequireActiveDirectoryBackup' -Value '00000001' -PropertyType DWORD
  New-ItemProperty -Path "$BitLockerRegLoc\FVE" -Name 'FDVEncryptionType' -Value '00000001' -PropertyType DWORD
}

#Step 4 - If all prerequisites are met, then enable BitLocker
if ($WindowsVer -and $TPMEnabled -and $BitLockerReadyDrive -and $BitLockerDecrypted) {
  
  Add-BitLockerKeyProtector -MountPoint $env:SystemDrive -TpmProtector
  Enable-BitLocker -MountPoint $env:SystemDrive -RecoveryPasswordProtector -ErrorAction SilentlyContinue

}

#Step 5 - Backup BitLocker recovery passwords to AD
if ($BLVS) {
  
  ForEach ($BLV in $BLVS) {
    
    $Key = $BLV | Select-Object -ExpandProperty KeyProtector | Where-Object {$_.KeyProtectorType -eq 'RecoveryPassword'}
      
    ForEach ($obj in $key) { 
        
      Backup-BitLockerKeyProtector -MountPoint $BLV.MountPoint -KeyProtectorID $obj.KeyProtectorId

    }
    
  }
  
}

Stop-Transcript

Any info as to why this wrapper is required? The referenced Microsoft forums link is dead