Windows 7: Automate BitLocker deployment for notebooks

BitLocker provides full disk encryption in the Ultimate and Enterprise editions of Windows 7. During a Windows 7 migration project, I used it to replace the third-party disk encryption application Safeboot. Enabling BitLocker on one system was straightforward; the challenges for the enterprise deployment were:

• Prepare the Active Directory schema for BitLocker and TPM attributes.
• Configure the required Computer Configuration settings in Group Policy Objects.
• Activate and/or enable the TPM security chip during Windows 7 installation.
• Automate recovery-key backup and system-drive encryption during Windows 7 post-installation configuration.

The first two points required planning and carrying out changes to the Active Directory forest and linking the Group Policy Objects. I addressed TPM activation by changing the system BIOS during the first boot, before installing Windows 7.

The most challenging part was creating a script to enable BitLocker after Windows 7 was installed. We used the same thick image for notebooks and desktops. During my research, I found a sample script that automates BitLocker deployment through the BitLocker WMI interfaces.

The EnableBitLocker.vbs script gave me a starting point, but I still needed several additional steps to complete the encryption process.

Enable BitLocker during deployment

Before creating the script, I set these objectives:

• The script should only run on notebook models
• The script should write log files for troubleshooting and analysis
• The script should work with all installed MUI languages on the thick image
• The script should integrate with a Sysprep answer file.

The thick image included several MUI packs. During the pilot, EnableBitLocker.vbs failed when the de-DE German MUI language was used. I worked around this by setting the local Administrator account's preferred language to English.

Enable-notebook-bitlocker.vbs

Create a text file named Enable-notebook-bitlocker.vbs in C:\Deployment, and copy EnableBitLocker.vbs to the same folder.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

Dim Manufacturer, ModelType, ChassisType,LogFile, q1, reg
'on error resume next
Set colNamedArgs = WScript.Arguments.Named
argLog = LCase(colNamedArgs.Item("log"))
Get_ChassisTypes

If colNamedArgs.Exists("log") Then
    LogFile = argLog
    'MsgBox LogFile
    Else
    MsgBox "No log file has been provided", vbError
    WScript.Quit
End If

q1=""""
reg = "reg add " & q1 & "HKCU\Control Panel\Desktop" & q1 & " /v PreferredUILanguagesPending /t REG_MULTI_SZ /d en-US /f"
If (ChassisType="Notebook") then
    'MsgBox "Notebook", vbInformation
    Run_Command(reg)
    Run_Command("cscript c:\Deployment\EnableBitLocker.vbs /on:tpm /l:" & LogFile )
End if

Sub Get_ChassisTypes
    Dim strComputer, objWMIService, objItem, colItems
    strComputer = "."
    Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
    Set colItems = objWMIService.ExecQuery( "select * from Win32_SystemEnclosure",,48)
    For Each objItem in colItems
        ChassisType =  Join(objItem.ChassisTypes, ",")
        Model = objItem.Model
    Next

    If (ChassisType  = "10") or (ChassisType  = "9") or (ChassisType  = "8") then
        'Msgbox "ChassisType: " & "Notebook" & "(" & ChassisType &")"
        ChassisType = "Notebook"
    Else
        'Msgbox "ChassisType: " & "Desktop" & "(" & ChassisType &")"
        ChassisType = "Desktop"
    End if
End Sub

Sub Run_Command(Command)
    Dim shell
    Set shell = CreateObject("WScript.Shell")
    shell.Run Command, 1, true
    Set shell = Nothing
End Sub

I will not go through every VBScript detail, but these are the main parts:

EnableBitLocker.vbs needs to run twice:

• Enable and activate the TPM in Windows.
• Take ownership of the TPM and reset its password, create a recovery password, save it to Active Directory and start BitLocker drive encryption.

The first run of EnableBitLocker.vbs reboots the system. In the oobeSystem Sysprep phase, I configured Administrator autologon for two sign-ins. At the first sign-in, a PowerShell script started through FirstLogonCommands SynchronousCommand ran Enable-notebook-bitlocker.vbs. After the reboot, RunOnce started the second part of the PowerShell script, which ran Enable-notebook-bitlocker.vbs again.

I use Sysprep and an answer file after the Windows 7 image has loaded. These steps can also be integrated with a software deployment solution such as SCCM.

Run the script twice, using a separate log file for each run:

1
2

cscript c:\Deployment\enable-notebook-bitlocker.vbs /log:c:\Deployment\1st-boot-EnableBitLocker.log
cscript c:\Deployment\enable-notebook-bitlocker.vbs /log:c:\Deployment\2nd-boot-EnableBitLocker.log

After a week of research, development and testing, I had automated the BitLocker encryption process. Notebook encryption took between 2 and 5 hours, depending on disk size and the age of the hardware.

References

• Technet - Enabling BitLocker by Using a WMI Script
• BitLocker Deployment Sample Resources
• Technet - Backing Up BitLocker and TPM Recovery Information to AD DS
• Technet - Enabling BitLocker by Using the Command Line