Dargslan.WinDeviceEncryption.psm1
|
<# .SYNOPSIS Windows device encryption audit toolkit — encryption status across all drives, recovery key backup, encryption method, and compliance status .DESCRIPTION 2026 Edition — Dargslan Windows Admin Toolkit. https://dargslan.com | https://dargslan.com/cheat-sheets .LINK https://dargslan.com #> function Get-DeviceEncryptionAudit { <# .SYNOPSIS Audit device-level encryption status and compliance .DESCRIPTION Part of Dargslan.WinDeviceEncryption (2026 Edition) — https://dargslan.com #> [CmdletBinding()] param([switch]$Json) $report = [ordered]@{ BitLockerVolumes = Get-BitLockerVolume -ErrorAction SilentlyContinue | Select-Object MountPoint, VolumeStatus, EncryptionMethod, EncryptionPercentage, ProtectionStatus, LockStatus, AutoUnlockEnabled, KeyProtector EFS = [PSCustomObject]@{ Service = (Get-Service EFS -ErrorAction SilentlyContinue).Status CertCount = (Get-ChildItem Cert:\CurrentUser\My -ErrorAction SilentlyContinue | Where-Object { $_.EnhancedKeyUsageList.FriendlyName -contains "Encrypting File System" } | Measure-Object).Count } DeviceEncryption = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceEncryption" -ErrorAction SilentlyContinue) RecoveryKeys = Get-BitLockerVolume -ErrorAction SilentlyContinue | ForEach-Object { $vol = $_.MountPoint $_.KeyProtector | Where-Object KeyProtectorType -eq "RecoveryPassword" | Select-Object @{N="Volume";E={$vol}}, KeyProtectorId, KeyProtectorType } Summary = [PSCustomObject]@{ EncryptedVolumes = 0; TotalVolumes = 0; AllEncrypted = $false; RecoveryKeys = 0 } } $report.Summary.TotalVolumes = ($report.BitLockerVolumes | Measure-Object).Count $report.Summary.EncryptedVolumes = ($report.BitLockerVolumes | Where-Object VolumeStatus -eq "FullyEncrypted" | Measure-Object).Count $report.Summary.AllEncrypted = $report.Summary.EncryptedVolumes -eq $report.Summary.TotalVolumes -and $report.Summary.TotalVolumes -gt 0 $report.Summary.RecoveryKeys = ($report.RecoveryKeys | Measure-Object).Count if ($Json) { return $report | ConvertTo-Json -Depth 3 } Write-Host "`n [Device Encryption - 2026]" -ForegroundColor Cyan $report.Summary | Format-List if ($report.BitLockerVolumes) { $report.BitLockerVolumes | Format-Table MountPoint, VolumeStatus, EncryptionMethod, ProtectionStatus -AutoSize } Write-Host " All Encrypted: $($report.Summary.AllEncrypted)" -ForegroundColor $(if($report.Summary.AllEncrypted){"Green"}else{"Red"}) return $report } Export-ModuleMember -Function * |