[PS] Importation de la clé de déchiffrement Bitlocker sur l’AD

par Zefi · 16 mars 2017

Nous utilisons dans la société ou je me trouve la technologie Bitlocker afin de chiffrer les disques durs des portables du parc.
Depuis quelques nous avons constaté que certains portables n’avaient pas remontés leur clé de déchiffrement Bitlocker au niveau de l’ActiveDirectory.

Après quelques recherches je suis tombé sur ce script => http://mickitblog.blogspot.fr/2017/02/bitlocker-recovery-password-utility.html?m=0
Celui-ci est très complet et permets de récuperer la clé de déchiffrement Bitlocker afin de la stocker sur l’AD mais aussi sur SCCM ou un partage réseau.
De mon point de vue ce script est très bien mais il nécessite d’avoir les outils RSAT (Outils d’administrations) Microsoft installés sur les postes utilisateurs ce que bien sûr nous ne souhaitons pas 🙂

Je suis donc parti du script cité plus haut puis je l’ai modifié afin de l’intégrer à une GPO qui s’éxecute sur le laptop.
Si la clé est déjà présente alors il ne se passe rien, dans le cas contraire celle-ci est automatiquement remontée au niveau de l’AD (si la connexion réseau est disponible).

Voici le script :

<#  
      .SYNOPSIS  
           Bitlocker Recovery Key  
        
      .DESCRIPTION  
           This script gives the ability to backup the bitlocker recovery key to active directory. If AD is selected, it will query active directory for the latest bitlocker recovery key. Next, it will retrieve the bitlocker recovery key from the local system and then compare the keys to make sure it is backed up to active directory.  
        
      .PARAMETER ActiveDirectory  
           Select this to specify the backing up the recovery password to active directory   
        
      .EXAMPLE  
           Backup recovery password to active directory  
                powershell.exe -file BitlockerRecoveryKey.ps1 -ActiveDirectory  
 #>  
 [CmdletBinding()]  
 param  
 (  
      [switch]$ActiveDirectory
 )    
   
 Function Get-BitLockerRecoveryKeyId {      
      [cmdletBinding()]  
      Param (  
                [Parameter(Mandatory = $false, ValueFromPipeLine = $false)][ValidateSet("Alltypes", "TPM", "ExternalKey", "NumericPassword", "TPMAndPin", "TPMAndStartUpdKey", "TPMAndPinAndStartUpKey", "PublicKey", "PassPhrase", "TpmCertificate", "SID")]$KeyProtectorType  
      )  
        
      $BitLocker = Get-WmiObject -Namespace "Root\cimv2\Security\MicrosoftVolumeEncryption" -Class "Win32_EncryptableVolume"  
      switch ($KeyProtectorType) {  
           ("Alltypes") { $Value = "0" }  
           ("TPM") { $Value = "1" }  
           ("ExternalKey") { $Value = "2" }  
           ("NumericPassword") { $Value = "3" }  
           ("TPMAndPin") { $Value = "4" }  
           ("TPMAndStartUpdKey") { $Value = "5" }  
           ("TPMAndPinAndStartUpKey") { $Value = "6" }  
           ("PublicKey") { $Value = "7" }  
           ("PassPhrase") { $Value = "8" }  
           ("TpmCertificate") { $Value = "9" }  
           ("SID") { $Value = "10" }  
           default { $Value = "0" }  
      }  
      $Ids = $BitLocker.GetKeyProtectors($Value).volumekeyprotectorID  
      return $ids  
 }  

 function Get-BitlockerPassword {  
      [CmdletBinding()][OutputType([string])]  
      param  
      (  
           [ValidateNotNullOrEmpty()][string]$ProtectorID  
      )  
        
      $Password = manage-bde -protectors -get ($env:ProgramFiles).split("\")[0] -id $ProtectorID | Where-Object { $_.trim() -ne "" }  
      $Password = $Password[$Password.Length - 1].Trim()  
      Return $Password  
 }  

 function Publish-RecoveryPasswordToActiveDirectory {  
      [CmdletBinding()]  
      param  
      (  
           [ValidateNotNullOrEmpty()][string]$BitlockerID  
      )  
      $ManageBDE = $env:windir + "\System32\manage-bde.exe"  
      $Switches = "-protectors -adbackup" + [char]32 + ($env:ProgramFiles).split("\")[0] + [char]32 + "-id" + [char]32 + $BitlockerID  
      Invoke-EXE -DisplayName "Backup Recovery Key to AD" -Executable $ManageBDE -Switches $Switches  
 }  

  function Invoke-EXE {  
      [CmdletBinding()]  
      param  
      (  
           [String]$DisplayName,  
           [String]$Executable,  
           [String]$Switches  
      )  
        
      Write-Host "Uploading"$DisplayName"....." -NoNewline  
      If ((Test-Path $Executable) -eq $true) {  
           $ErrCode = (Start-Process -FilePath $Executable -ArgumentList $Switches -Wait -Passthru).ExitCode  
      } else {  
           $ErrCode = 1  
      }  
      If (($ErrCode -eq 0) -or ($ErrCode -eq 3010)) {  
           Write-Host "Success" -ForegroundColor Yellow  
      } else {  
           Write-Host "Failed with error code "$ErrCode -ForegroundColor Red  
      }  
 }  

Clear-Host  
#Retrieve numerical password ID  
[string]$BitlockerID = Get-BitLockerRecoveryKeyId -KeyProtectorType NumericPassword  
#Retrieve Bitlocker recovery password from the local system  
[string]$BitlockerPassword = Get-BitlockerPassword -ProtectorID $BitlockerID  
Publish-RecoveryPasswordToActiveDirectory -BitlockerID $BitlockerID

.SYNOPSIS

Bitlocker Recovery Key

.DESCRIPTION

This script gives the ability to backup the bitlocker recovery key to active directory. If AD is selected, it will query active directory for the latest bitlocker recovery key. Next, it will retrieve the bitlocker recovery key from the local system and then compare the keys to make sure it is backed up to active directory.

.PARAMETER ActiveDirectory

Select this to specify the backing up the recovery password to active directory

.EXAMPLE

Backup recovery password to active directory

powershell.exe -file BitlockerRecoveryKey.ps1 -ActiveDirectory

[CmdletBinding()]

param

(

[switch]$ActiveDirectory

)

Function Get-BitLockerRecoveryKeyId {

[cmdletBinding()]

Param (

[Parameter(Mandatory = $false, ValueFromPipeLine = $false)][ValidateSet("Alltypes", "TPM", "ExternalKey", "NumericPassword", "TPMAndPin", "TPMAndStartUpdKey", "TPMAndPinAndStartUpKey", "PublicKey", "PassPhrase", "TpmCertificate", "SID")]$KeyProtectorType

)

$BitLocker = Get-WmiObject -Namespace "Root\cimv2\Security\MicrosoftVolumeEncryption" -Class "Win32_EncryptableVolume"

switch ($KeyProtectorType) {

("Alltypes") { $Value = "0" }

("TPM") { $Value = "1" }

("ExternalKey") { $Value = "2" }

("NumericPassword") { $Value = "3" }

("TPMAndPin") { $Value = "4" }

("TPMAndStartUpdKey") { $Value = "5" }

("TPMAndPinAndStartUpKey") { $Value = "6" }

("PublicKey") { $Value = "7" }

("PassPhrase") { $Value = "8" }

("TpmCertificate") { $Value = "9" }

("SID") { $Value = "10" }

default { $Value = "0" }

}

$Ids = $BitLocker.GetKeyProtectors($Value).volumekeyprotectorID

return $ids

}

function Get-BitlockerPassword {

[CmdletBinding()][OutputType([string])]

param

(

[ValidateNotNullOrEmpty()][string]$ProtectorID

)

$Password = manage-bde -protectors -get ($env:ProgramFiles).split("\")[0] -id $ProtectorID | Where-Object { $_.trim() -ne "" }

$Password = $Password[$Password.Length - 1].Trim()

Return $Password

}

function Publish-RecoveryPasswordToActiveDirectory {

[CmdletBinding()]

param

(

[ValidateNotNullOrEmpty()][string]$BitlockerID

)

$ManageBDE = $env:windir + "\System32\manage-bde.exe"

$Switches = "-protectors -adbackup" + [char]32 + ($env:ProgramFiles).split("\")[0] + [char]32 + "-id" + [char]32 + $BitlockerID

Invoke-EXE -DisplayName "Backup Recovery Key to AD" -Executable $ManageBDE -Switches $Switches

}

function Invoke-EXE {

[CmdletBinding()]

param

(

[String]$DisplayName,

[String]$Executable,

[String]$Switches

)

Write-Host "Uploading"$DisplayName"....." -NoNewline

If ((Test-Path $Executable) -eq $true) {

$ErrCode = (Start-Process -FilePath $Executable -ArgumentList $Switches -Wait -Passthru).ExitCode

} else {

$ErrCode = 1

}

If (($ErrCode -eq 0) -or ($ErrCode -eq 3010)) {

Write-Host "Success" -ForegroundColor Yellow

} else {

Write-Host "Failed with error code "$ErrCode -ForegroundColor Red

}

Clear-Host

#Retrieve numerical password ID

[string]$BitlockerID = Get-BitLockerRecoveryKeyId -KeyProtectorType NumericPassword

#Retrieve Bitlocker recovery password from the local system

[string]$BitlockerPassword = Get-BitlockerPassword -ProtectorID $BitlockerID

Publish-RecoveryPasswordToActiveDirectory -BitlockerID $BitlockerID

Il n’est surement pas parfait mais au moins il fait son boulot 🙂

[PS] Importation de la clé de déchiffrement Bitlocker sur l’AD

Vous aimerez aussi...

Laisser un commentaire Annuler la réponse.

Catégories

Articles Phares

Statistiques

[PS] Importation de la clé de déchiffrement Bitlocker sur l’AD

Partager :

Vous aimerez aussi...

[PS] Vérifier l’attribut Outlook Mobile Access (msExchOmaAdminWirelessEnable) en Powershell

[PS] Utiliser des credentials en Powershell

[PS] Utiliser l’API Free Mobile en Powershell

Laisser un commentaire Annuler la réponse.

Catégories

Articles Phares

Statistiques