Check Device BitLocker State

# BitLocker Audit Tool
$logFile = "C:\temp\bitlocker.txt"

# Initialize variables
[string]$varDriveList = "Bitlocker not enabled on Drives: "
[string]$varHardwareEnc = "Hardware encryption: "

# Create or clear the log file
if (Test-Path $logFile) {
    Clear-Content -Path $logFile
} else {
    New-Item -Path $logFile -ItemType File | Out-Null
}

# Start logging
"BitLocker Audit Tool" | Out-File -FilePath $logFile -Append
"==============================" | Out-File -FilePath $logFile -Append
"Enumerating fixed drives..." | Out-File -FilePath $logFile -Append
"" | Out-File -FilePath $logFile -Append

# Check drives
foreach ($iteration in Get-WMIObject -query "SELECT * FROM Win32_LogicalDisk WHERE DriveType = '3'" | Select DeviceID) {
    $varEncStatus = Get-WmiObject -namespace "Root\cimv2\security\MicrosoftVolumeEncryption" -Class "Win32_EncryptableVolume" -Filter "DriveLetter='$($iteration.DeviceID)'"
    if ($varEncStatus.ProtectionStatus -eq 1) {
        "$($iteration.DeviceID) is encrypted with BitLocker." | Out-File -FilePath $logFile -Append
        if ($varEncStatus.EncryptionMethod -eq 5) {
            ": $($iteration.DeviceID) is using Hardware encryption." | Out-File -FilePath $logFile -Append
            [string]$varHardwareEnc = $varHardwareEnc + $iteration.DeviceID + ", "
            $varInsecureDrive = $true
        }
    } else {
        "- $($iteration.DeviceID) is not encrypted." | Out-File -FilePath $logFile -Append
        $varInsecureDrive = $true
        [string]$varDriveList = $varDriveList + $iteration.DeviceID + ", "
    }
}

"" | Out-File -FilePath $logFile -Append

# Log hardware encryption advisory if applicable
if ($varHardwareEnc.Length -gt 21) {
    "=========================================" | Out-File -FilePath $logFile -Append
    "Advisory: Drives were discovered using Hardware-based BitLocker encryption." | Out-File -FilePath $logFile -Append
    "If the disk is an SSD, this may pose a security threat." | Out-File -FilePath $logFile -Append
    "More information: https://www.theregister.co.uk/2018/11/05/busted_ssd_encryption/" | Out-File -FilePath $logFile -Append
    "=========================================" | Out-File -FilePath $logFile -Append
    [string]$varDriveList = $varDriveList + ". " + $varHardwareEnc
}

# Output results to the log file
if ($varInsecureDrive) {
    "Alert: $varDriveList" | Out-File -FilePath $logFile -Append
    "" | Out-File -FilePath $logFile -Append
}

# Final log message
if ($varInsecureDrive) {
    "Value written to User-defined Field $env:usrUDF`." | Out-File -FilePath $logFile -Append
} else {
    "All fixed drives are encrypted." | Out-File -FilePath $logFile -Append
}