Hi everyone,

I'm having trouble activating TPM Security in the BIOS from Windows 7 x64.

I have two seperate executables, one which enables TPM in the BIOS and the other which is configured to activate TPM. The first one which enables TPM Security works fine however when the second file which is configured to activate TPM after rebooting the machine does not work.

Has anyone experienced this issue before and is there another way of activating TPM through Windows 7?

Thanks

0 Comments   [ + ] Show Comments

Comments

Please log in to comment

Answers

1

Solution:

I simply resorted to using the following VBScript which enables bit locker and as a side will activate TPM if it is deactivated.. I could break it into two seperate tasks but have decided to keep it in the one.

==================

'===============================================================================
'
' This sample script can be used to automate the deployment of BitLocker using the BitLocker WMI interfaces.
'
' Last Updated: 7/1/2006
' Microsoft Corporation
'
' Disclaimer
'
' The sample scripts are not supported under any Microsoft standard support program or service. The sample scripts are provided AS IS without warranty of any kind.
' Microsoft further disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose.
' The entire risk arising out of the use or performance of the sample scripts and documentation remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample scripts or documentation, even if Microsoft has been advised of the possibility of such damages.
'
'Version 1.2 - Updates
'1 - Removed infinate loop potential in the FindRemoveableDrive function. Three attempts are valid.
'2 - Added saving RK to the /USB option.
'3 - Will not look at local evet log if no policy key present.
'4 - Minor loging and text changes.
'5 - Fixed PIN input cancel button use.
'
'
'===============================================================================================================
'Script arguments
'/on:<tpm,tp,tsk,usb>       used to specify options for turning on BitLocker (tpm,tp,tsk) REQUIRED
'/l:<location>          specify to create a log file and it's location REQUIRED
'/em:<128d,256d,128,256>       used to specify encryption algorithm (aes128d, aes256d, aes128, aes256) OPTIONAL
'/rk            create a recovery key and store in a particular location  OPTIONAL
'/promptuser         causes script to prompt user for TPM PIN or to insert USB drive OPTIONAL
'/sms           creates an SMS status MIF for software distribution OPTIONAL
'/ro:"<existingTPMownerpassword>" changes the TPM ownership password (password must be placed between "") OPTIONAL
'----------------------------------------------------------------------------------------
'Constants And Variables
'----------------------------------------------------------------------------------------
On Error Resume Next

Const ForAppending = 8
Const SetPres = 10
const HKEY_LOCAL_MACHINE = &H80000002
const REG_SZ = 1
const REG_EXPAND_SZ = 2
const REG_BINARY = 3
const REG_DWORD = 4
const REG_MULTI_SZ = 7

Dim bIsEnabled,bIsActivated,bIsOwned,bIsOwnershipAllowed,objTPM,objLog,TakeOwnership,Enable,objEnVol,strStatusTPM,strStatusBDE,strStatusTPMState
Dim objGPPT,strOwnerPassword,strPassword,objWMIBDE,nProtStatus,ProtectVar,objOSSysDriv,objSWbemServices,objOS,coloperatingsystem,sProtID,strOldOwnerPassword
Dim argProtect,argRK,argEM,argSMS,argLOG,argRO,argPrompt,strCurrentUser,argValid,i,strPIN,objRemovableDrive,strStatusCode,strStatusData,MIF,strEKP,strEK
Dim ActiveDirectoryBackup,ActiveDirectoryInfoToStore,RequireActiveDirectoryBackup,EncryptionMethod,BackupMandatory,strStartDate,strStartTime,strRetry,strPolicy

'----------------------------------------------------------------------------------------
'General 1 - Get ready to run, create objects, create log file, parse command line arguments
'----------------------------------------------------------------------------------------
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set WSHShell = WScript.CreateObject("WScript.Shell")

'Parse command line arguments
Set args = WScript.Arguments
Argument1 = args.Item(0)
Argument2 = args.Item(1)
NumberofArgs = WScript.Arguments.Count
Set colNamedArgs = WScript.Arguments.Named

'Get all command line arguments and set them to lower Case
argProtect = LCase(colNamedArgs.Item("on"))
argRK = LCase(colNamedArgs.Item("rk"))
argEM = LCase(colNamedArgs.Item("em"))
argLOG = LCase(colNamedArgs.Item("l"))
argPrompt = LCase(colNamedArgs.Item("promptuser"))
argSMS = LCase(colNamedArgs.Item("sms"))
strOldOwnerPassword = LCase(colNamedArgs.Item("ro"))

'Evaluate named optional arguments
If colNamedArgs.Exists("rk") Then
 argRK = "1"
 Else
 argRK = "No recovery key use specified"
End If
If colNamedArgs.Exists("sms") Then
 argSMS = "1"
 Else
 argSMS = "No SMS status MIF's will be created"
End If
If colNamedArgs.Exists("ro") Then
 argRO = "1"
 Else
 argRO = "TPM ownership information will not be cleared"
End If
If colNamedArgs.Exists("promptuser") Then
 argPrompt = "1"
 Else
 argPrompt = "Users will not be prompted for PIN or to insert USB key"
End If

'Evaluate emcyption method if on command line
If Not colNamedArgs.Exists("em") Then
 argEM = "1"
Else If argEM = "" Then
 argEM = "1"
Else If argEM = "128d" Then
 argEM = "1"
Else If argEM = "256d" Then
 argEM = "2"
Else If argEM = "128" Then
 argEM = "3"
Else If argEM = "256" Then
 argEM = "4"
  End If
    End If
   End If
  End If
 End If
End If

'Create log file
Set objLog = objFSO.OpenTextFile(argLOG,ForAppending,True)
objlog.writeline "Script processing started  " & Date & "       " & Time
strStartDate = Date
strStartTime = Time

'Set the SMS default status exit code
strStatusCode = 1

'Check arguments for requiered options
If Not colNamedArgs.Exists("on") Then
 strStatusData = "No /on option was specified on the command line."
 objLog.Writeline strStatusData
 Wscript.Echo  strStatusData
    strStatusCode = 0
    CreateStatusMIF strStatusData
 ShowHelp

Else If Not colNamedArgs.Exists("l") Then
 strStatusData = "No /l option specified on the command line."
 objLog.Writeline strStatusData
 Wscript.Echo strStatusData
 strStatusCode = 1
 CreateStatusMIF strStatusData
 ShowHelp
Else If NumberofArgs < 2 Then
 strStatusData = "The required number of arguments of 2 was not met."
 objLog.Writeline strStatusData
 Wscript.Echo strStatusData
 strStatusCode = 1
 CreateStatusMIF strStatusData
 ShowHelp
Else If ((argProtect = "tp") Or (argProtect = "tsk")) And argPrompt <> "1" Then
 strStatusData = "Using the options /on:tp or /on:tsk and not using /promptuser is not allowed."
 objLog.Writeline strStatusData
 Wscript.Echo strStatusData
 strStatusCode = 1
 CreateStatusMIF strStatusData
 ShowHelp
Else If argProtect = "usb" And argPrompt <> "1" Then
 strStatusData = "Using the options /on:usb and not using /promptuser is not allowed."
 objLog.Writeline strStatusData
 Wscript.Echo strStatusData
 strStatusCode = 1
 CreateStatusMIF strStatusData
 ShowHelp
Else If argRK = "1" And argPrompt <> "1" Then
 objLog.Writeline "Using the option /rk and not using /promptuser is not allowed."
 Wscript.Echo "Using the option /rk and not using /promptuser is not allowed."
 ShowHelp
Else
    If argProtect = "tp" Or argProtect = "tpm" Or argProtect = "tsk" Or argProtect = "usb" Then
        objLog.Writeline "Proper number of command line arguments passed to the script"
    Else
     objLog.Writeline "The /on option does not match one of the required options."
     Wscript.Echo "The /on option does not match one of the required options."
     ShowHelp
   End If
     End If
    End If
   End If
  End If
 End If
End If

'Output command arguments to log file
objLog.Writeline "-----------------------------------------------------------------------"
objLog.Writeline "---------------Executing with the following arguments------------------"
objLog.Writeline "-----------------------------------------------------------------------"
objLog.Writeline "Enable parameters: " & argProtect
objLog.Writeline "Logging location: " & argLOG
objLog.Writeline "Create recovery key: " & argRK
objLog.Writeline "Encryption method: " & argEM
objLog.Writeline "Create SMS status MIF's: " & argSMS
objLog.Writeline "Reset TPM ownership: " & argRO
objLog.Writeline "User prompting: " & argPrompt
objLog.Writeline "-----------------------------------------------------------------------"

'----------------------------------------------------------------------------------------
'General 2 - Main script processing area
'----------------------------------------------------------------------------------------

ConnectTPMProv() 'Connect to the TPM WMI provider

If argProtect = "usb" Then
 ConnectBDEProv() 'Connect to the volume encryption WMI provider
 EvalGPO()
 GetBDEStatus()
Else
    GetTPMStatus() 'Get the current status of the TPM to determine action
    ConnectBDEProv() 'Connect to the volume encryption WMI provider

    'The following If statements cause the script to react differently depending on the TPM state

    If bIsEnabled = "True" and bIsActivated = "True" and bIsOwned = "True" Then
    objlog.writeline "TPM is in a ready state to enable BitLocker."
     If argRO = "1" Then
      objlog.writeline "Change TPM owner password specified on the command line."
      DenTPMPassword
      ChangeOwnerAuth strOldOwnerPassword,strOwnerPassword
      EvalGPO()
      GetBDEStatus()
     Else
      EvalGPO()
      GetBDEStatus()
     End If
    Else If bIsEnabled = "True" and bIsActivated = "True" and bIsOwned = "False" Then
     objlog.writeline "TPM ownership is not taken...will take ownership."
     DenTPMPassword
     OwnTPM
     EvalGPO()
     GetBDEStatus()
    Else If bIsEnabled = "False" And bIsActivated = "False" and bIsOwned = "False" Then
     objlog.writeline "TPM is not turned on...will Enable and Activate TPM and force a reboot."
     EnableActivateTPM()
    Else If bIsEnabled = "False" and bIsActivated = "False" and bIsOwned = "True" Then
     objlog.writeline "TPM is not turned on...will Enable and Activate TPM and force a reboot."
        EnableActivateTPM()
    Else If bIsEnabled = "True" and bIsActivated = "False" and bIsOwned = "False" Then
        objlog.writeline "TPM is turned but not activated...will Activate TPM and force a reboot."
        EnableActivateTPM()
        End If
       End If
      End If
     End If
    End If
End If

If strStatusCode = 1 then
    strStatusData = strStatusTPMState & ". " & strStatusTPM & " " & "The volume has a protection status of: " & nProtStatus & ". " & strStatusBDE & ". " & "Script Completed Successfully"
    objLog.writeline strstatusdata
    CreateStatusMIF strStatusData
End if
objlog.writeline "Script ended  " & Date & "       " & Time

'----------------------------------------------------------------------------------------
'Functions and subs
'----------------------------------------------------------------------------------------
'Function 1 - Connect to TPM WMI provider
'----------------------------------------------------------------------------------------

Function ConnectTPMProv()
strConnectionStr1 = "winmgmts:{impersonationLevel=impersonate,authenticationLevel=pktPrivacy}!root\cimv2\Security\MicrosoftTpm"

err.clear
Set objWMITPM = GetObject(strConnectionStr1)
If Err.Number <> 0 Then
    strStatusData = "ERROR - Failed to connect to the MicrosoftTPM provider. Script is exiting..."
    objLog.Writeline strStatusData
 strStatusCode = 0
 CreateStatusMIF strStatusData
    Wscript.Quit -1
    Else
    objLog.Writeline "Connection succeeded to MicrosoftTPM"
End If
err.clear

' There should either be 0 or 1 instance of the TPM provider class
Set colTpm = objWMITPM.InstancesOf("Win32_Tpm")

If colTpm.Count = 1 And argProtect = "usb" Then
 strStatusData = "Successfully retieved a TPM from the provider class. USB only protection was chosen and cannot be used when a TPM is present. Script is exiting...(Error: " & Err.Number & ")"
 objLog.Writeline strStatusData
 strStatusCode = 0
 CreateStatusMIF strStatusData
 WScript.Quit -1
Else If colTpm.Count = 0 And argProtect = "usb" Then
     objLog.Writeline "Protect option is set for USB only. Will continue with USB only protection..."
 Exit Function
Else If colTpm.Count = 0 And argProtect <> "usb" Then
 strStatusData = "ERROR - Failed get a TPM instance in the provider class. Script is exiting..."
 objLog.Writeline strStatusData
 strStatusCode = 0
 CreateStatusMIF strStatusData
 WScript.Quit -1
  End If
 End If
End If
Err.Clear

'Get a single instance of the TPM provider class
Set objTpm = objWMITPM.Get("Win32_Tpm=@")
If Err.Number <> 0 Then
 strStatusData = "ERROR - Failed get a TPM instance in the provider class. Script is exiting...(Error: " & Err.Number & ")"
 objLog.Writeline strStatusData
 strStatusCode = 0
 CreateStatusMIF strStatusData
 WScript.Quit -1
 Else
 objLog.Writeline "Successfully retrieved a TPM instance from the Win32_TPM provider class"
End If
Err.Clear

End Function

'----------------------------------------------------------------------------------------
'Function 2 - Connect to BDE WMI provider
'----------------------------------------------------------------------------------------

Function ConnectBDEProv()

strConnectionStr2 = "winmgmts:{impersonationLevel=impersonate,authenticationLevel=pktPrivacy}!root\cimv2\Security\MicrosoftVolumeEncryption"

err.clear
Set objWMIBDE = GetObject(strConnectionStr2)
If Err.Number <> 0 Then
    strStatusData = "ERROR - Failed to connect to the MicrosoftVolumeEncryption provider. Script is exiting...(Error " & Err.Number & ")"
 objLog.Writeline strStatusData
 strStatusCode = 0
 CreateStatusMIF strStatusData
 WScript.Quit -1
Else
    objLog.Writeline "Connection succeeded to MicrosoftVolumeEncryption"
End If
err.clear

End Function

'-----------------------------------------------------------------------------------------
'Function 3 - Get BDE status data and enable encryption
'-----------------------------------------------------------------------------------------

Function GetBDEStatus()

Set colEnVol = objWMIBDE.ExecQuery("Select * from Win32_EncryptableVolume")
objlog.writeline "EncryptableVolumes count is: " & colEnVol.count

If colEnVol.count < 1 then
strStatusData = "ERROR - EncryptableVolumes is null and count is: " & colEnVol.count & " Script is quitting..."
objLog.Writeline strStatusData
strStatusCode = 0
CreateStatusMIF strStatusData
WScript.Quit -1
Else
strConnectionStr3 = "winmgmts:{impersonationLevel=impersonate,authenticationLevel=pktPrivacy}!root\cimv2"
Set objSWbemServices = GetObject(strConnectionStr3)
Set coloperatingsystem = objSWbemServices.ExecQuery("Select * from Win32_OperatingSystem")
For each objOperatingSystem in colOperatingSystem
 strWin32SysDrive = objOperatingSystem.SystemDrive
Next

For Each objEnVol in colEnVol
objlog.writeline "The EncryptableVolume(s) found: " & objEnVol.DeviceID
strEncDriveLetter = objEnVol.DriveLetter

If strEncDriveLetter = strWin32SysDrive then
    objlog.writeline "EncryptableVolume used for encryption is: " & strEncDriveLetter
    intRC = objEnVol.GetProtectionStatus(nProtStatus)
    objlog.writeline "The volume has a protection status of: " & nProtStatus        

    If nProtStatus = 1 then
        strStatusData = "BitLocker Protection is already enabled. Check log file for more details. Process is quitting..."
    objLog.Writeline strStatusData
        strStatusCode = 0
        CreateStatusMIF strStatusData
    Wscript.quit -1
    Else
        If nProtStatus = 0 then
            objlog.writeline "BitLocker Protection is Off"
            nRC = objEnVol.GetConversionStatus(strCS)
            objlog.writeline "Get conversion status is: " & strCS
            If strCS = 0 Then
                err.Clear
                objlog.writeline "The volume has a status of fully decrypted"

                    If argProtect = "tpm" Then
                        intRC = objEnVol.ProtectKeyWithTPM("TPM Protection",Empty,sProtID)
                        objLog.Writeline "Attempting to enable BitLocker TPM"
                            If intRC <> 0 Then
                                    CheckError intRC
                                    strStatusData = "ERROR - the ProtectKeyWithTPM Method failed with the exit code:  " & Hex(intRC)
                                    objLog.Writeline strStatusData
                                    strStatusCode = 0
                                    CreateStatusMIF strStatusData
                                Else
                                    strStatusData = "Successfully initiated ProtectKeyWithTPM Method with an exit code of:  " & Hex(intRC)
                                    objlog.writeline strStatusData
                                    strStatusBDE = strStatusData
                                    CheckUser
                     CreateRP objEnVol
                           EnableBitlocker objEnVol
                           CreateRK sProtID
                            End If
                            err.clear
                           
                    Else
                        If argProtect = "tp" Then
                            CheckUser
                            GetPIN
                            If argPrompt = "1" and strCurrentUser = "1" and argValid = "1" Then 
                                intRC = objEnVol.ProtectKeyWithTPMAndPIN("TPM and PIN Protection",Empty,strPIN,sProtID)
        objLog.Writeline "Attempting to enable BitLocker TPM + Pin"
                                    If intRC <> 0 Then
                                        CheckError intRC
                                        strStatusData = "ERROR - the ProtectKeyWithTPMAndPIN Method failed with the exit code:  " & Hex(intRC)
                                        objLog.Writeline strStatusData
                                    strStatusCode = 0
                                    CreateStatusMIF strStatusData
                                    Else                                            
                                    strStatusData = "Successfully initiated ProtectKeyWithTPMAndPIN Method with an exit code of:  " & Hex(intRC)
                                    objlog.writeline strStatusData
                                    strStatusBDE = strStatusData
                                    CreateRP objEnVol
                                 EnableBitlocker objEnVol
                                 CreateRK sProtID
                                    End If
                                    err.clear
                            Else
                                strStatusData = "ERROR - TPM and PIN Protection failed.  One of the following conditions was not met: Command line switch /promptuser not used, No logged on User, or PIN was not of a valid format"
                                objlog.writeline strStatusData
                                strStatusBDE = strStatusData
                                Exit Function
                            End If
                        Else
                            If argProtect = "tsk" Then
                                CheckUser
                             If argPrompt = "1" Then
                                  FindRemovableDrive()
                                 Else
                                  objLog.WriteLine "TPM and StarupKey option is chosen and user prompting for USB device is disabled.  Script is exiting..."
                                  FindRemovableDrive()
                                  Exit Function
                                 End If                                 
                                        intRC = objEnVol.ProtectKeyWithTPMAndStartupKey("TPM and Startup Key Protection",Empty,Empty,sProtID)
                               objLog.Writeline "Attempting to enable BitLocker TPM + StartupKey"
                                        If intRC <> 0 Then
                                            CheckError intRC
                                            strStatusData = "ERROR - the ProtectKeyWithTPMAndStartupKey Method failed with the exit code:  " & Hex(intRC)
                                            objLog.Writeline strStatusData
                                            strStatusCode = 0
                                            CreateStatusMIF strStatusData
                                        Else
                                            objlog.writeline "Successfully initiated ProtectKeyWithTPMAndStartupKey Method with an exit code of:  " & Hex(intRC)
                             objLog.Writeline "Attempting to save startup key..."
                                      intRC = objEnVol.SaveExternalKeyToFile(sProtID,objRemovableDrive)
                                      If intRC <> 0 Then
                                                strStatusData = "ERROR - Failed to save the startup key to a USB drive with the following exit code:  " & Hex(intRC)
                                                objLog.Writeline strStatusData
                                                strStatusCode = 0
                                                CreateStatusMIF strStatusData
                                         Else
                                             strStatusData = "Successfully completed ProtectKeyWithTPMAndStartupKey Method and saved the startup key to USB drive with an exit code of:  " & Hex(intRC)
                                             objlog.writeline strStatusData
                                                strStatusBDE = strStatusData
                                       CreateRP objEnVol
                                       EnableBitlocker objEnVol
                                       CreateRK sProtID
                             End If
                                      err.clear
                               End If
                                        err.clear
                            Else
                                If argProtect = "usb" then
                                    CheckUser
                                    FindRemovableDrive()
                                    intRC = objEnVol.ProtectKeyWithExternalKey("USB Key Protection",Empty,sProtID)
                                    objLog.Writeline "Attempting to enable BitLocker with External Key only"
                                        If intRC <> 0 Then
                                            CheckError intRC
                                            strStatusData = "ERROR - the ProtectKeyWithExternalKey Method failed with the exit code:  " & Hex(intRC)
                                            objLog.Writeline strStatusData
                                            strStatusCode = 0
                                            CreateStatusMIF strStatusData
                                        Else
                                            objlog.writeline "Successfully initiated ProtectKeyWithExternalKey Method with an exit code of:  " & Hex(intRC)
              objLog.Writeline "Attempting to save USB key..."
                                      intRC = objEnVol.SaveExternalKeyToFile(sProtID,objRemovableDrive)
                                      If intRC <> 0 Then
                                          strStatusData = "ERROR - Failed to save the startup key to a USB drive with the following exit code:  " & Hex(intRC)
                                          objLog.Writeline strStatusData
                                                strStatusCode = 0
                                                CreateStatusMIF strStatusData
                                      Else
                                             strStatusData = "Successfully completed ProtectKeyWithExternalKey Method and saved the startup key to USB drive with an exit code of:  " & Hex(intRC)
                                             objlog.writeline strStatusData
                                                strStatusBDE = strStatusData
                                       CreateRP objEnVol
                                 EnableBitlocker objEnVol
                                 CreateRK sProtID
                                End If
                                      err.clear
                                        End If
                                    End If
                                End If
                            End If
                        End If
              End if 
        End if
    End if
End if               

Next
 If strCS = "" Then
  strStatusData = "ERROR - The available encyptable volumes must match the operating system volume and this did not occur.  Operating system drive found - " & strWin32SysDrive
         objLog.Writeline strStatusData
         strStatusCode = 0
         CreateStatusMIF strStatusData
 Else
  GetConversionStatus strCS
 End If
End If
End Function

'-----------------------------------------------------------------------------------------
'Function 4 - Get TPM status data to determine if TPM is enabled, activated, and owned
'-----------------------------------------------------------------------------------------

Function GetTPMStatus()

nRC = objTpm.IsEnabled(bIsEnabled)
If nRC <> 0 Then
    strStatusData = "ERROR - The method IsEnabled failed with return code 0x" & Hex(nRC)
    objLog.Writeline strStatusData
 strStatusCode = 0
 CreateStatusMIF strStatusData
End If

nRC = objTpm.IsActivated(bIsActivated)
If nRC <> 0 Then
    strStatusData = "ERROR - The method IsActivated failed with return code 0x" & Hex(nRC)
    objLog.Writeline strStatusData
 strStatusCode = 0
 CreateStatusMIF strStatusData
End If

nRC = objTpm.IsOwned(bIsOwned)
If nRC <> 0 Then
    strStatusData = "ERROR - The method IsOwned failed with return code 0x" & Hex(nRC)
    objLog.Writeline strStatusData
 strStatusCode = 0
 CreateStatusMIF strStatusData
End If

'Output TPM status information to the log file
objLog.WriteLine "TPM found in the following state:"
objLog.WriteLine "Enabled - " & bIsEnabled
objLog.WriteLine "Activated - " & bIsActivated
objLog.WriteLine "Owned - " & bIsOwned

strStatusTPMState = "TPM found in the following state: Enabled - " & bIsEnabled & ", Activated - " & bIsActivated & ", Owned - " & bIsOwned

End Function

'-----------------------------------------------------------------------------------------
'Function 5 - Enable and Activate TPM
'-----------------------------------------------------------------------------------------

Function EnableActivateTPM

Err.clear

'Enable and activate TPM device

intRC = objTPM.SetPhysicalPresenceRequest(SetPres)
objLog.Writeline "Attempting to enable and activate the TPM"
If intRC <> 0 Then
        strStatusData = "ERROR - failed to enable and activate the TPM with the following exit code:  " & Hex(intRC)
        objLog.Writeline strStatusData
     strStatusCode = 0
     CreateStatusMIF strStatusData
    Else
     objlog.writeline "Completed enabling and activating the TPM with an exit code of:  " & Hex(intRC)
End If

intRC = objTPM.GetPhysicalPresenceTransition(strPT)
objlog.writeline "Presence Transition = " & strPT
If intRC <> 0 Then
        strStatusData = "ERROR - failed to get PhysicalPresenceTransition with the following exit code:  " & Hex(intRC)
        objLog.Writeline strStatusData
     strStatusCode = 0
     CreateStatusMIF strStatusData
    Else
     objlog.writeline "Completed PhysicalPresenceTransition with an exit code of:  " & Hex(intRC)
End If
 
If strPT = 0 then
    objlog.writeline "The platform does not need to transition"
Else
    If strPT = 1 then
    strStatusData = "Shutting down system to finish enabling the TPM"
    objlog.writeline strStatusData
    strStatusTPM = strStatusData
       oReboot = WSHShell.Run("shutdown.exe /s /t 5",2,True)
       '***** Add status code???
 Else
     If strPT = 2 then
         objlog.writeline "Rebooting system to finish enabling the TPM"
            oReboot = WSHShell.Run("shutdown.exe /r /t 5",2,True)
            '***** Add status code???
        Else
            If strPT = 3 Then
             strStatusData = "The TPM transition is vendor-specific cannot continue. Contact your vendor for instructions. Script is quitting..."
                objLog.Writeline strStatusData
             strStatusCode = 0
             CreateStatusMIF strStatusData
             WScript.Quit -1
         End if
     End if
    End if
End if   

End Function

'-----------------------------------------------------------------------------------------
'Function 6 - Create a recovery key if specified on command line
'-----------------------------------------------------------------------------------------
Function CreateRK(sProtID)
If argRK = "1" Then
 FindRemovableDrive()
 intRC = objEnVol.ProtectKeyWithExternalKey("Recovery Protection",Empty,sProtID)
 objLog.Writeline "Attempting to create BitLocker Recovery Key."
    If intRC <> 0 Then
     objlog.writeline "ERROR - Failed generating Recovery Key with the exit code:  " & Hex(intRC)
    Else
  objlog.writeline "Successfully generated Recovery key with an exit code of:  " & Hex(intRC)
  objLog.Writeline "Attempting to save Recovery Key to USB..."
  intRC = objEnVol.SaveExternalKeyToFile(sProtID,objRemovableDrive)
    If intRC <> 0 Then
         objlog.writeline "ERROR - Failed to save the recovery key to a USB drive with the following exit code:  " & Hex(intRC)
    Else
       objlog.writeline "Successfully saved the recovery key to USB drive with an exit code of:  " & Hex(intRC)
  End If
  err.clear
End If
End If

End Function

'-----------------------------------------------------------------------------------------
'Function 7 - Changing TPM owner information
'-----------------------------------------------------------------------------------------
Function ChangeOwnerAuth(strOldOwnerPassword,strOwnerPassword)
err.clear

' Convert the owner password to owner authorization by using SHA-1 hashing
intRC = objTpm.ConvertToOwnerAuth(strOldOwnerPassword, OldOwnerAuthDigest)
If intRC <> 0 Then
        objlog.writeline "ERROR - Failed to converting old owner password to owner authorization:  " & Hex(intRC)
    Else
     objlog.writeline "Completed converting old owner password to owner authorization:  " & Hex(intRC)
End If
err.clear

intRC = objTpm.ConvertToOwnerAuth(strOwnerPassword, OwnerAuthDigest)
If intRC <> 0 Then
        objlog.writeline "ERROR - Failed to converting owner password to owner authorization:  " & Hex(intRC)
    Else
     objlog.writeline "Completed converting owner password to owner authorization:  " & Hex(intRC)
End If
err.clear

' Change owner authorization on the TPM
intRC = objTpm.ChangeOwnerAuth(OldOwnerAuthDigest,OwnerAuthDigest)
objlog.writeline "Starting to change owner authorization process on the TPM"
If intRC <> 0 Then
        objlog.writeline "ERROR - Failed to change owner authorization on the TPM with the following exit code:  " & Hex(intRC)
    Else
     objlog.writeline "Completed change owner authorization process on the TPM with the following exit code:  " & Hex(intRC)
End If
err.clear

'Wait for TPM to finish ownership process
Wscript.Sleep(10000)

End Function

'-----------------------------------------------------------------------------------------
'Function 8 - Generate random string for TPM owner password.  This password will range
'from 7-14 characters and will contain numbers and letters.
'-----------------------------------------------------------------------------------------
Function DenTPMPassword

'Upper and lower limits for TPM owner password
intUpperLimit = 14
intLowerLimit = 7

Randomize
intCharacters = Int(((intUpperLimit - intLowerLimit + 1) * Rnd) + intUpperLimit)  

intUpperLimit = 126
intLowerLimit = 33

For i = 1 to intCharacters
    Randomize
    intASCIIValue = Int(((intUpperLimit - intLowerLimit + 1) * Rnd) + intLowerLimit)  
    strPassword = strPassword & Chr(intASCIIValue)
Next

strOwnerPassword = strPassword
objLog.WriteLine "Random TPM owner password is: " & strOwnerPassword

End Function

'-----------------------------------------------------------------------------------------
' Function 9 - Check for endoresement key and take ownership of TPM
'-----------------------------------------------------------------------------------------

Function OwnTPM

err.clear

'Check for the presence of Endorsement Key Pair and create one if not found
intRC = objTpm.IsEndorsementKeyPairPresent(strEK)
If intRC <> 0 Then
    strStatusData = "ERROR - Failed to determine if Endorsement Key Pair is present with the following exit code:  " & Hex(intRC)
    objLog.Writeline strStatusData
 strStatusCode = 0
 CreateStatusMIF strStatusData
Else
 objlog.writeline "Successfully determined if Endorsement Key Pair is present with an exit code of:  " & Hex(intRC)
 objlog.writeline "IsEndorsementKeyPairPresent returned a value of: " & strEK
End If
err.clear

If strEK = "True" then
    objlog.writeline "Endorsement Key Pair is present."
Else
    objlog.writeline "Attempting to create Endorsement Key Pair"
    intRC = objTpm.CreateEndorsementKeyPair(strEKP)
    If intRC <> 0 Then
        strStatusData = "ERROR - Failed to create Endorsement Key Pair with the following exit code:  " & Hex(intRC)
        objLog.Writeline strStatusData
     strStatusCode = 0
     CreateStatusMIF strStatusData
     Wscript.quit -1
    Else
     objlog.writeline "Successfully created Endorsement Key Pair with an exit code of:  " & Hex(intRC)
    End If
End if

err.clear

' Convert the owner password to owner authorization by using SHA-1 hashing
intRC = objTpm.ConvertToOwnerAuth(strOwnerPassword, OwnerAuthDigest)
If intRC <> 0 Then
        strStatusData = "ERROR - Failed to hash TPM owner password with the following exit code:  " & Hex(intRC)
        objLog.Writeline strStatusData
     strStatusCode = 0
     CreateStatusMIF strStatusData
     Wscript.quit -1
    Else
     objlog.writeline "Successfully hashed TPM owner password with an exit code of:  " & Hex(intRC)
    End If

' Take ownership of the TPM - two string values to be hashed using SHA-1
intRC = objTpm.TakeOwnership(OwnerAuthDigest)
objlog.writeline "Starting to take ownership of the TPM"
If intRC <> 0 Then
        strStatusData = "ERROR - Failed to take ownership of the TPM with the following exit code:  " & Hex(intRC)
        objLog.Writeline strStatusData
     strStatusCode = 0
     CreateStatusMIF strStatusData
    Else
     objlog.writeline "Completed taking ownership of the TPM with an exit code of:  " & Hex(intRC)
End If
err.clear

'Wait for TPM to finish ownership process
Wscript.Sleep(10000)

End Function

'-----------------------------------------------------------------------------------------
'Function 10 - Enable Bitlocker
'-----------------------------------------------------------------------------------------

Function EnableBitlocker(objEnVol)

Err.clear
intRC = objEnVol.Encrypt(argEM)
objLog.Writeline "Attempting to enable BitLocker..."
If intRC <> 0 Then
        strStatusData = "ERROR - failed to initiate drive encryption with the following exit code:  " & Hex(intRC)
        objLog.Writeline strStatusData
        strStatusCode = 0
        CreateStatusMIF strStatusData

        objLog.Writeline "Deleting previously created key protectors..."
 intRC = objEnVol.DeleteKeyProtectors()
        If intRC <> 0 Then
            strStatusData = "ERROR - failed to remove key protectors with the following exit code:  " & Hex(intRC) & "  Script is quitting..."
            objLog.Writeline strStatusData
 Else
         objlog.writeline "Successfully removed key protectors with the following exit code:  " & Hex(intRC) & "  Script is quitting..."
 End If

    Else
        objlog.writeline "Successfully initiated BitLocker drive encryption with an exit code of:  " & Hex(intRC)
End If
err.clear

End Function

'--------------------------------------------------------------
'Function 11 - Find the removeable drive in WMI
'--------------------------------------------------------------
Function FindRemovableDrive()

strRetry = strRetry + 1
If strRetry > 3 Then
    strStatusData = "ERROR - User did not input a valid USB device within the 3 attempts allowed. Script is quitting..."
     objLog.Writeline strStatusData
     strStatusCode = 0
     CreateStatusMIF strStatusData
     Wscript.Quit -1
End If

Err.Clear
Set colDrives = objSWbemServices.ExecQuery("Select * from Win32_Volume where DriveType = '2'")
If Err.Number = 0 Then
        objLog.Writeline "Successfully completed the search for a USB drive with the following exit code:  " & Err.Number
    Else
     strStatusData = "ERROR - the search for a USB drive failed with the following exit code:  " & Err.Number
     objLog.Writeline strStatusData
     strStatusCode = 0
     CreateStatusMIF strStatusData
End If
err.clear

If argPrompt = "1" and strCurrentUser = "1" Then

 If colDrives.count = 1 Then
  For Each objDrive in colDrives
         objRemovableDrive = objDrive.DriveLetter
  objLog.WriteLine "Found USB drive in the system at the following drive letter: " & objDrive.DriveLetter
  Next
 Else If colDrives.count > 1 Then
     strStatusData = "ERROR - More then one USB device was found in your system cannot determine where to save key. Script is quitting..."
     objLog.Writeline strStatusData
     strStatusCode = 0
     CreateStatusMIF strStatusData
     Wscript.Quit -1
 Else If colDrives.count = 0 Then
  objLog.WriteLine "Warning - Did not find USB device to save your startup key.  Waiting for user will retry....."
     Wscript.Echo "No removeable USB device was found in your system.  To complete the BitLocker configuration please insert a USB removeable drive to save your Startup or Recovery Key."
     WScript.Sleep(10000)
     FindRemovableDrive()
   End If
  End If
 End If
Else
 If colDrives.count = 1 Then
  For Each objDrive in colDrives
         objRemovableDrive = objDrive.DriveLetter
  Next
 Else
  strStatusData = "ERROR - No USB device available to save key.  Script is quitting..."
  objLog.Writeline strStatusData
     strStatusCode = 0
     CreateStatusMIF strStatusData
  WScript.Quit -1
 End If
End If

End Function

'----------------------------------------------------------------------------------------
'Function 12 - Function used to interogate Group Policy and determine successfully backup of recovery data
'----------------------------------------------------------------------------------------
Function EvalGPO

strComputer = "."
strPolicy = "0"

err.Clear
Set objReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")
If Not Err.number=0 Then
 strStatusData = "ERROR - Could not connect to WMI StdRegProv" & Err.Description
 objLog.Writeline strStatusData
 strStatusCode = 0
 CreateStatusMIF strStatusData
 Else
 objLog.Writeline "Successfully connected to WMI StdRegProv"
End If

err.Clear
objLog.WriteLine "Checking if Group Policy encryption method is set..."
strKeyPath = "SOFTWARE\Policies\Microsoft\FVE"
objReg.EnumValues HKEY_LOCAL_MACHINE, strKeyPath, arrValueNames, arrValueTypes
If IsEmpty(arrValueNames) = True or IsNull(arrValueNames) = True Then
    strPolicy = "1"
    strStatusData = "No FVE policy registry key found" & Err.Description
    objLog.Writeline strStatusData
    strStatusCode = 0
    CreateStatusMIF strStatusData
Else
    err.clear
    For R=0 To UBound(arrValueNames)
    If arrValueNames(R) = "EncryptionMethod" Then
        objReg.GetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,arrValueNames(R),dwValue
        EncryptionMethod = dwValue
        objLog.Writeline "Found EncryptionMethod with value: " & dwValue
        objLog.Writeline "Found EncryptionMethod policy registry key ignoring any /em options on command line"
        argEM = "0"
    End If
    If arrValueNames(R) = "RequireActiveDirectoryBackup" Then
        objReg.GetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,arrValueNames(R),dwValue
        RequireActiveDirectoryBackup = dwValue
        objLog.Writeline "Found RequireActiveDirectoryBackup with value: " & dwValue
    End if
    If arrValueNames(R) = "ActiveDirectoryBackup" Then
        objReg.GetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,arrValueNames(R),dwValue
        ActiveDirectoryBackup = dwvalue
        objLog.Writeline "Found ActiveDirectoryBackup with value: " & dwValue
    End if
    Next
End If

'Process local policy to see what BDE settings are available

If ActiveDirectoryBackup = 1 and RequireActiveDirectoryBackup = 1 Then
    objLog.WriteLine "Determined client Group Policy configured to require AD escrow of recovery password"
    BackupMandatory = "1"
Else If ActiveDirectoryBackup = 1 and RequireActiveDirectoryBackup = 0 Then
    objLog.WriteLine "Warning - Determined client Group Policy is configured to require AD escrow of recovery password but is not mandatory. If AD was not available when BitLocker was enabled recovery data may not be escrowed but BitLocker will be enabled."
    BackupMandatory = "0"
 End If
End If

End Function

'----------------------------------------------------------------------------------------
'Function 13 - Function used by the EvalGPO function to scan event logs for BitLocker recovery events
'----------------------------------------------------------------------------------------
Function getBDEEvents()

If strPolicy = "1" Then
    Exit Function
End If

Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\root\cimv2")
Set colBDEEvents = objWMIService.ExecQuery("Select * from Win32_NTLogEvent Where Logfile = 'System' and EventCode = '514' or EventCode = '513'")
If colBDEEvents.Count >= 1 Then
    For Each objBDEEvent in colBDEEvents
        If objBDEEvent.EventCode = "514" Then
            objLog.Writeline "---------------------------------------------------------------------------------"
            strStatusCode =  "WARNING - Found event log entry showing unsuccessful recovery information backup."
            objLog.Writeline strStatusData
         objLog.WriteLine "Event log ID: " & objBDEEvent.EventCode
            objLog.WriteLine "Event log message: " & objBDEEvent.Message
            objLog.Writeline "---------------------------------------------------------------------------------"
         strStatusCode = 0
         CreateStatusMIF strStatusData
        ElseIf objBDEEvent.EventCode = "513" Then
            objLog.Writeline "---------------------------------------------------------------------------------"
            objLog.Writeline "Found event log entry showing successfull recovery information backup."
         objLog.Writeline "Event log ID: " & objBDEEvent.EventCode
         objLog.Writeline "Event log message: " & objBDEEvent.Message
         objLog.Writeline "---------------------------------------------------------------------------------"
        End If
    Next
Else
    objLog.WriteLine "Did not find a local event log entry for BitLocker AD backup."
End If

End Function

'----------------------------------------------------------------------------------------
'Function 14 - Used to create SMS status MIF's
'----------------------------------------------------------------------------------------
Function CreateStatusMIF(strStatusData)

err.clear
If argSMS = "1" then
    Set MIF=CreateObject("ISMIFCOM.InstallStatusMIF")
    Mif.Create "BitLocker","Microsoft","BitLocker.vbs","1.0","","",strStatusData,strStatusCode

    If Err.number <> 0 Then
     objLog.Writeline "Failed to create the SMS status MIF."
    Else
     objLog.WriteLine "Successfully created the SMS status MIF."
    End If
End if

err.clear

End Function
'----------------------------------------------------------------------------------------
'Function 15 - Check for logged on User
'----------------------------------------------------------------------------------------
Function CheckUser

Set colComputer = objSWbemServices.ExecQuery("Select * from Win32_ComputerSystem")
    For Each objComputer in colComputer
        If not objComputer.UserName = "" Then
        objlog.writeline "The following user is logged on: " & objComputer.UserName
        strCurrentUser = "1"
        Else
        objlog.writeline "There is no user currently logged on to this computer"
        strCurrentUser = "0"
        End If
    Next
End Function
'-----------------------------------------------------------------------------------------
'Function 16 - Create a Protect Key With Numerical Password
'-----------------------------------------------------------------------------------------

Function CreateRP(objEnVol)
On Error Resume Next

Err.clear
intRC = objEnVol.ProtectKeyWithNumericalPassword("Recovery Password",Empty,vProtID)
objLog.Writeline "Attempting to create a recovery password..."
If intRC <> 0 Then
        strStatusData = "WARNING - failed to create recovery password with the following exit code:  " & Hex(intRC)
        objLog.Writeline strStatusData
     strStatusCode = 0
     CreateStatusMIF strStatusData

 If Hex(intRC) = "8007054B" and BackupMandatory = "1" Then
     strStatusData = "ERROR - failed to save recovery password to active directory with the following exit code:  " & Hex(intRC)
     objlog.writeline "Group Policy is requiring AD backup of the recovery password but AD could not be contacted."
         objLog.Writeline strStatusData
      strStatusCode = 0
      CreateStatusMIF strStatusData
    
      Err.Clear
      objLog.Writeline "Deleting previously created key protectors..."
      intRC = objEnVol.DeleteKeyProtectors()
        If intRC <> 0 Then
            strStatusData = "ERROR - failed to remove key protectors with the following exit code:  " & Hex(intRC) & "  Script is quitting..."
            objLog.Writeline strStatusData
         strStatusCode = 0
         CreateStatusMIF strStatusData
         Wscript.Quit -1
        Else
         objlog.writeline "Successfully removed key protectors with the following exit code:  " & Hex(intRC) & "  Script is quitting..."
         Wscript.Quit -1
        End If
End If
    Else
     objlog.writeline "Successfully created recovery password with the following exit code:  " & Hex(intRC)
     If BackupMandatory = 0 Then
         Wscript.Sleep(5000)
  getBDEEvents
     End If
     Exit Function
End If
err.clear

End Function
'----------------------------------------------------------------------------------------
'Function 17 - Request PIN from User
'----------------------------------------------------------------------------------------
Function GetPIN

strPIN=InputBox("Enter your new PIN number. The PIN must consist of a sequence of 4 to 20 digits.")
If strPIN = "" Then
    strStatusData = "ERROR - User canceled the PIN input operation. Script is quitting..."
    objLog.Writeline strStatusData
    strStatusCode = 0
    CreateStatusMIF strStatusData
    Wscript.Quit -1
End If

If IsNumeric(strPIN) Then
iLen = Len(strPIN)
    If iLen > 3 and iLen < 21 Then
        argValid = "1"
    Else       
 i = i + 1
 
        If i < 3 Then
     Wscript.Echo "The PIN you entered was not 4 to 20 digits please re-enter a valid PIN."
     objLog.writeline "WARNING - User did not enter a PIN that was not 4 to 20 digits."
            GetPIN
        Else
            strStatusData = "ERROR - The PIN was not 4 to 20 digits. You have exceeded your maximum attempts."
            Wscript.Echo "You exceeded the maximum number of attempts(3) to enter a PIN.  The process is quitting."
         objLog.Writeline strStatusData
         strStatusCode = 0
         CreateStatusMIF strStatusData
         argValid = "0"    
        End If
    End If
Else
    Wscript.Echo "The PIN you entered contained letters or symbols.  The PIN must only contain numbers please re-enter a valid PIN."
    objlog.writeline "WARNING - User did not enter a PIN as a number."
     i = i + 1
        If i < 3 Then
            GetPIN
        Else
     Wscript.Echo "You exceeded the maximum number of attempts(3) to enter a PIN.  The process is quitting."
            strStatusData = "ERROR - The PIN was not entered as a number. You have exceeded your maximum attempts."
            objLog.Writeline strStatusData
         strStatusCode = 0
         CreateStatusMIF strStatusData
     argValid = "0"
        End If
End If

End Function

'----------------------------------------------------------------------------------------
'Function 18 - Determine conversion status
'----------------------------------------------------------------------------------------
Function GetConversionStatus(strCS)
If strCS = 1 Then
    objlog.writeline "The volume has a status of fully encrypted but a clear key is present"
    intRC = objWMIBDE.EnableKeyProtectors()
        If intRC <> 0 Then
            strStatusData = "ERROR - failed to enable key protector with the following exit code:  " & Hex(intRC)
            objLog.Writeline strStatusData
         strStatusCode = 0
         CreateStatusMIF strStatusData
        Else
         strStatusData = "Completed method EnableKeyProtectors with an exit code of:  " & Hex(intRC)
         objlog.writeline strStatusData
         strStatusBDE = strStatusData
        End If
Else
    If strCS = 2 Then
        strStatusData = "The volume has a status of encryption in progress"
        objLog.Writeline strStatusData
     strStatusCode = 0
     CreateStatusMIF strStatusData
     Wscript.Quit -1
    Else   
        If strCS = 3 Then
            strStatusData = "The volume has a status of decryption in progress"
            objLog.Writeline strStatusData
         strStatusCode = 0
         CreateStatusMIF strStatusData
  Wscript.Quit -1
        Else
            If strCS = 4 Then
                strStatusData = "The volume has a status of encryption paused"
                objLog.Writeline strStatusData
             strStatusCode = 0
             CreateStatusMIF strStatusData
      Wscript.Quit -1
            Else
                If strCS = 5 then
                    strStatusData = "The volume has a status of decryption paused"
                    objLog.Writeline strStatusData
                 strStatusCode = 0
                 CreateStatusMIF strStatusData
   Wscript.Quit -1
                End If
       End If
      End if
     End if
    End if

End Function


'----------------------------------------------------------------------------------------
'Function 19 - Check protect errors for any know problems
'----------------------------------------------------------------------------------------
Function CheckError(intRC)

If Hex(initRC) = "80310030" Then
    strStatusData = "ERROR - There is a boot CD/DVD or USB device in the system please remove and restart script.  Script is quitting..."
    objLog.Writeline strStatusData
    strStatusCode = 0
    CreateStatusMIF strStatusData
    Wscript.Quit -1
End If

End Function

'----------------------------------------------------------------------------------------
'Function 20 - Shows help for the script
'----------------------------------------------------------------------------------------
Function ShowHelp
On Error Resume Next
WScript.echo "************************************************************************************************************************************" & vbCr & _
"Example: EnableBitLocker.vbs /on:tpm /l:c:\bitlocker.log," & vbCr & vbCr & _
"/on:<tpm,tp,tsk,usb>" & vbTab & "used to specify options for turning on BitLocker (tpm,tp,tsk) REQUIRED" & vbCr & _
"/l:<location>" & vbTab & vbTab &  "specify to create a log file and it's location REQUIRED" & vbCr & _
"/rk:<location>" & vbTab & vbTab &  "create a recovery key and store in a particular location  OPTIONAL" & vbCr & _
"/em:<128d,256d,128,256>" & vbTab & "used to specify encryption algorithm if left out aes128d is used (aes128d, aes256d, aes128, aes256) OPTIONAL" & vbCr & _
"/promptuser" & vbTab & vbTab & "causes script to prompt user for TPM PIN or to insert USB drive OPTIONAL" & vbCr & _
"/sms" & vbTab & vbTab & vbTab & "creates an SMS status MIF for software distribution OPTIONAL" & vbCr & _
"/ro:" & chr(34) & "<oldownerpassword>" & chr(34) & " " & vbTab & "reset the TPM ownership using the existing owner password (password must be placed between quotes) OPTIONAL" & vbCr & vbCr & _
"************************************************************************************************************************************" & vbCr & _
WScript.quit
End Function

Answered 09/06/2012 by: White Belt
Blue Belt

Please log in to comment
Answer this question or Comment on this question for clarity