Enable BitLocker on C:

# Enable BitLocker silently on C: with TPM + Recovery Password
# Designed for RMM (run as SYSTEM, 64-bit)

$drive = "C:"

try {
  # Quick status check
  $vol = Get-BitLockerVolume -MountPoint $drive -ErrorAction Stop

  if ($vol.ProtectionStatus -eq "On") {
    Write-Output "BitLocker already enabled on $drive"
    exit 0
  }

  # Make sure TPM is present and ready
  $tpm = Get-Tpm
  if (-not $tpm.TpmPresent) { throw "TPM not present. Cannot enable TPM-only BitLocker." }
  if (-not $tpm.TpmReady)   { throw "TPM not ready. Initialize/enable TPM in BIOS/UEFI or via provisioning." }

  # Add a Recovery Password protector (creates the 48-digit recovery key)
  Add-BitLockerKeyProtector -MountPoint $drive -RecoveryPasswordProtector | Out-Null

  # Enable BitLocker
  Enable-BitLocker -MountPoint $drive `
    -TpmProtector `
    -UsedSpaceOnly `
    -SkipHardwareTest `
    -EncryptionMethod XtsAes256 `
    -ErrorAction Stop

  # Output recovery info (for logs)
  $vol2 = Get-BitLockerVolume -MountPoint $drive
  $recovery = $vol2.KeyProtector | Where-Object { $_.KeyProtectorType -eq "RecoveryPassword" } | Select-Object -First 1
  if ($null -ne $recovery) {
    Write-Output ("RecoveryPasswordID: " + $recovery.KeyProtectorId)
  }

  Write-Output "BitLocker enable initiated on $drive"
  exit 0
}
catch {
  Write-Error $_.Exception.Message
  exit 1
}