BitLocker Status (one-line for RMM)

<#
.SYNOPSIS
    Reports BitLocker protection status for the OS drive (and optionally all fixed
    drives) as a single-line summary, suitable for any RMM monitor/condition.

.DESCRIPTION
    - Checks BitLocker status via Get-BitLockerVolume, falling back to manage-bde.
    - Writes a one-line summary to STDOUT so any RMM (or scheduled task) can capture it
      for a monitor/condition.
    - Optionally exits non-zero when the target drive is not protected.

.NOTES
    RMM-agnostic: capture STDOUT in your RMM. If you want the result stored in an RMM
    custom field, assign $summary using your platform's own method.
#>

[CmdletBinding()]
param(
  # Drive to evaluate for the "primary" status (defaults to OS drive)
  [string]$TargetDrive = $env:SystemDrive,

  # If set, also include all fixed volumes in the output summary
  [switch]$IncludeAllFixedVolumes,

  # Optional: if set, exits 1 when BitLocker is not protecting the target drive
  # (Be careful: non-zero exit codes can mark the script as failed in some RMM platforms)
  [switch]$FailIfNotProtected
)

function Get-BitLockerInfo {
  param([string]$Drive)

  if (Get-Command Get-BitLockerVolume -ErrorAction SilentlyContinue) {
    $vol = Get-BitLockerVolume -MountPoint $Drive -ErrorAction Stop
    return [pscustomobject]@{
      MountPoint        = $vol.MountPoint
      ProtectionStatus  = [string]$vol.ProtectionStatus
      VolumeStatus      = [string]$vol.VolumeStatus
      EncryptionPercent = if ($null -ne $vol.EncryptionPercentage) { [int]$vol.EncryptionPercentage } else { $null }
      KeyProtectors     = ($vol.KeyProtector | ForEach-Object { $_.KeyProtectorType }) -join ','
    }
  }

  # Fallback if BitLocker module/cmdlets aren't present
  $out = & manage-bde -status $Drive 2>$null
  if (-not $out) { throw "Unable to query BitLocker status (Get-BitLockerVolume missing, manage-bde failed)." }

  $prot = if ($out -match "Protection Status:\s+Protection On") { "On" } elseif ($out -match "Protection Status:\s+Protection Off") { "Off" } else { "Unknown" }
  $conv = if ($out -match "Conversion Status:\s+(.+)") { $Matches[1].Trim() } else { "Unknown" }
  $pct  = if ($out -match "Percentage Encrypted:\s+(\d+)%") { [int]$Matches[1] } else { $null }

  return [pscustomobject]@{
    MountPoint        = $Drive
    ProtectionStatus  = $prot
    VolumeStatus      = $conv
    EncryptionPercent = $pct
    KeyProtectors     = $null
  }
}

try {
  $target = Get-BitLockerInfo -Drive $TargetDrive
  $isProtected = ($target.ProtectionStatus -eq 'On')

  $all = @()
  if ($IncludeAllFixedVolumes) {
    if (Get-Command Get-BitLockerVolume -ErrorAction SilentlyContinue) {
      $fixed = Get-BitLockerVolume | Where-Object { $_.VolumeType -eq 'Fixed' -and $_.MountPoint }
      foreach ($v in $fixed) {
        $all += [pscustomobject]@{
          MountPoint        = $v.MountPoint
          ProtectionStatus  = [string]$v.ProtectionStatus
          VolumeStatus      = [string]$v.VolumeStatus
          EncryptionPercent = if ($null -ne $v.EncryptionPercentage) { [int]$v.EncryptionPercentage } else { $null }
        }
      }
    } else {
      # Minimal fallback: just report the target drive
      $all += $target
    }
  }

  # One-line output for RMM conditions/monitors (captured from STDOUT)
  $summaryParts = @(
    "Target=$($target.MountPoint)",
    "Protection=$($target.ProtectionStatus)",
    "VolumeStatus=$($target.VolumeStatus)",
    ("EncryptedPct=" + ($(if ($null -ne $target.EncryptionPercent) { $target.EncryptionPercent } else { "NA" })))
  )

  if ($IncludeAllFixedVolumes -and $all.Count -gt 0) {
    $detail = $all | ForEach-Object {
      $pct = if ($null -ne $_.EncryptionPercent) { $_.EncryptionPercent } else { "NA" }
      "$($_.MountPoint):$($_.ProtectionStatus):$($_.VolumeStatus):$pct"
    }
    $summaryParts += ("AllFixed=[" + ($detail -join ';') + "]")
  }

  $summary = $summaryParts -join " | "
  Write-Host $summary

  if ($FailIfNotProtected -and -not $isProtected) { exit 1 }
  exit 0
}
catch {
  Write-Host ("ERROR: " + $_.Exception.Message)
  exit 2
}