facter_bitlocker_status.rb

Facter.add('bitlocker_status') do
  confine osfamily: 'Windows'
  confine kernelmajversion: '10.0'

  setcode do
    require 'json'

    bitlocker_status = {}
    powershell = 'C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe'
    cmd = '"Get-BitlockerVolume -MountPoint C: | ConvertTo-Json"'

    if File.exist?(powershell)

      raw = Facter::Util::Resolution.exec(powershell + ' -command ' + cmd)

      j = JSON.parse(raw)

      if j['VolumeStatus'] == 0
        bitlocker_status['conversion_status'] = 'decrypted'
      elsif j['VolumeStatus'] == 1
        bitlocker_status['conversion_status'] = 'encrypted'
      elsif j['VolumeStatus'] == 2
        bitlocker_status['conversion_status'] = 'encrypting'
      elsif j['VolumeStatus'] == 3
        bitlocker_status['conversion_status'] = 'decrypting'
      elsif j['VolumeStatus'] == 4
        bitlocker_status['conversion_status'] = 'encryption_paused'
      elsif j['VolumeStatus'] == 5
        bitlocker_status['conversion_status'] = 'decryption_paused'
      else
        bitlocker_status['conversion_status'] = 'unknown'
      end

      if j['ProtectionStatus'] == 0
        bitlocker_status['protection_status'] = 'unprotected'
      elsif j['ProtectionStatus'] == 1
        bitlocker_status['protection_status'] = 'protected'
      elsif j['ProtectionStatus'] == 2
        bitlocker_status['protection_status'] = 'unknown'
      end

      bitlocker_status['encryption_percentage'] = j['EncryptionPercentage']

      key_protectors = []

      j['KeyProtector'].each do |protector|
        key_protectors.push(protector['KeyProtectorType'])
      end

      bitlocker_status['key_protectors'] = key_protectors

      binary = 'C:\Windows\System32\manage-bde.exe'
      if File.exist?(binary)

        get_status = Facter::Util::Resolution.exec('manage-bde -status c:')

        lines = get_status.split("\n")

        lines.each do |line|
          next unless line.include?(':')
          items = line.split(':')

          if line.include? 'Protection Status'
            if items[1].lstrip.delete("\r").include? 'reboot'
              bitlocker_status['reboot_required'] = true
            else
              bitlocker_status['reboot_required'] = false
            end
          end
        end
      end
    end
    bitlocker_status
  end
end