1

After following this post I was able to detect bitlocker without admin permissions, debugging in Visual Studio works fine and running my program standalone is also fine. However, my program runs as a service normally and when ran as a service it always results in 0 as the bitlocker status.

Here is the code snippet of what actually gets the BitLocker state.

public static int? GetDriveBitlocker(DriveInfo retdrive)
    {
        IShellProperty prop = ShellObject.FromParsingName(retdrive.Name.Replace(@"\", "")).Properties.GetProperty("System.Volume.BitLockerProtection");
        int? bitLocker = (prop as ShellProperty<int?>).Value;
        return bitLocker;
    }

No errors are thrown, it just results in 0 (unknown) whereas ran from VS it would be 1 (Encrypted).

A PowerShell equivalent of this is

(New-Object -ComObject Shell.Application).NameSpace('C:').Self.ExtendedProperty('System.Volume.BitLockerProtection')

So to easily reproduce i created the following script

$var = (New-Object -ComObject Shell.Application).NameSpace('C:').Self.ExtendedProperty('System.Volume.BitLockerProtection')

$date = Get-Date;

$string = "the output was " + $var + " on " + $date;

$string | Out-File -FilePath C:\Users\me\Desktop\bitlocker.txt

When ran directly via PowerShell, the following is logged which is correct

the output was 1 on 09/08/2022 16:33:49

However when ran from a service made to invoke the PowerShell script, it gives the an incorrect result

the output was 0 on 09/08/2022 16:35:22

Kacey.Haley
  • 11
  • 1
  • Most likely due to services running in a different Session than user apps. You might need to have your service call `CreateProcessAsUser()` to launch a helper process in a user Session, and then you can have that process get the BitLocker status and send it back to the service via any IPC mechanism of your choosing (even just in the process exit code would likely suffice). – Remy Lebeau Sep 08 '22 at 22:05
  • 3
    This code uses the Shell (end-user) API. From a service, you should use a different method, they are explained here: https://social.msdn.microsoft.com/Forums/en-US/9ee35234-663b-40b9-b084-a1f40da3b819/how-to-determine-whether-a-volume-is-encrypted-with-bitlocker-using-win32-api?forum=windowssecurity with WMI the preferred method https://learn.microsoft.com/en-us/archive/blogs/si_team/detecting-bitlocker – Simon Mourier Sep 09 '22 at 06:08

0 Answers0