PowerShell: Intune – Remediation Script for Stuck BitLocker Encryption

<#
.SYNOPSIS
    Detection script: flags a paused, suspended or stalled BitLocker volume.
.DESCRIPTION
    Reads Get-BitLockerVolume for the OS volume, compares it with the state
    recorded on the previous run, and records the new state. Exits 1 when the
    volume is EncryptionPaused, suspended past the grace period, or stuck at
    the same encryption percentage past the stall threshold. Exits 0 otherwise.
.NOTES
    Author  : Thomas Lasswell (https://www.techcolumnist.com)
    Version : 1.0 (2025-09-10)
    Requires: Runs as SYSTEM in an Intune remediation.
#>

$MountPoint = "C:"
$StateRegPath = "HKLM:\SOFTWARE\IntuneRemediations\BitLockerStuck"
$StallThresholdMinutes = 240
$SuspendGraceHours = 24

try {
    $volume = Get-BitLockerVolume -MountPoint $MountPoint -ErrorAction Stop
} catch {
    Write-Output "UNKNOWN: could not read BitLocker status for $MountPoint. $($_.Exception.Message)"
    exit 0
}

$status = [string]$volume.VolumeStatus
$protection = [string]$volume.ProtectionStatus
$percent = [int]$volume.EncryptionPercentage
$nowUtc = (Get-Date).ToUniversalTime()

if (-not (Test-Path -Path $StateRegPath)) {
    New-Item -Path $StateRegPath -Force | Out-Null
}

# Keep LastChangeUtc unless the status or percentage moved since the last run.
$state = Get-ItemProperty -Path $StateRegPath -ErrorAction SilentlyContinue
$lastChangeUtc = $nowUtc

if ($state -and $state.LastStatus -eq $status -and $state.LastPercent -eq $percent -and $state.LastChangeUtc) {
    $lastChangeUtc = [datetime]::Parse($state.LastChangeUtc).ToUniversalTime()
}

New-ItemProperty -Path $StateRegPath -Name "LastStatus" -Value $status -PropertyType String -Force | Out-Null
New-ItemProperty -Path $StateRegPath -Name "LastPercent" -Value $percent -PropertyType DWord -Force | Out-Null
New-ItemProperty -Path $StateRegPath -Name "LastChangeUtc" -Value $lastChangeUtc.ToString("o") -PropertyType String -Force | Out-Null

$since = $lastChangeUtc.ToString("yyyy-MM-ddTHH:mm:ssZ")
$minutesUnchanged = ($nowUtc - $lastChangeUtc).TotalMinutes

if ($status -eq "EncryptionPaused") {
    Write-Output "PAUSED: $MountPoint EncryptionPaused at $percent% since $since"
    exit 1
}

if ($status -eq "FullyEncrypted" -and $protection -eq "Off" -and @($volume.KeyProtector).Count -gt 0 -and $minutesUnchanged -ge ($SuspendGraceHours * 60)) {
    Write-Output "SUSPENDED: $MountPoint fully encrypted, protection off since $since"
    exit 1
}

if ($status -eq "EncryptionInProgress" -and $minutesUnchanged -ge $StallThresholdMinutes) {
    Write-Output "STALLED: $MountPoint EncryptionInProgress at $percent% since $since"
    exit 1
}

Write-Output "OK: $MountPoint $status, protection $protection, $percent%"
exit 0

.\Detect-StuckBitLocker.ps1; if ($LASTEXITCODE -eq 1) { .\Repair-StuckBitLocker.ps1 }

Detection   : PAUSED: C: EncryptionPaused at 43% since 2025-09-09T14:05:11Z
Remediation : C: EncryptionPaused at 43%. manage-bde -resume exit code 0. Status now EncryptionInProgress.

Detection   : STALLED: C: EncryptionInProgress at 61% since 2025-09-08T22:40:03Z
Remediation : C: stalled at 61%, no automatic fix. Recent BitLocker-API events: [2025-09-08 22:39] 854 Failed to enable Silent Encryption. WinRe is not configured. ...

<#
.SYNOPSIS
    Remediation script: resumes paused BitLocker encryption or suspended
    protection, and reports why a stalled encryption can't be fixed.
.DESCRIPTION
    Runs after Detect-StuckBitLocker.ps1 exits 1. Re-reads the OS volume and
    acts on the documented cases only:
      - EncryptionPaused: runs manage-bde -resume, which resumes encryption
        or decryption after it has been paused.
      - FullyEncrypted with protection off and key protectors present: runs
        Resume-BitLocker, which restores protection on a suspended volume.
      - EncryptionInProgress with no progress: no supported fix exists, so it
        writes the most recent BitLocker-API Management errors and warnings to
        the output (trimmed to the 2,048-character remediation limit) and
        exits 1 so the device shows as failed in the report.
.NOTES
    Author  : Thomas Lasswell (https://www.techcolumnist.com)
    Version : 1.0 (2025-09-10)
    Requires: Runs as SYSTEM in an Intune remediation, paired with
              Detect-StuckBitLocker.ps1. BitLocker module, manage-bde.exe.
#>

$MountPoint = "C:"
$MaxOutput = 2000

# Write the output once, trimmed below Intune's 2,048-character limit, then exit.
function Complete-Remediation {
    param ([string]$Message, [int]$ExitCode)
    if ($Message.Length -gt $MaxOutput) {
        $Message = $Message.Substring(0, $MaxOutput)
    }
    Write-Output $Message
    exit $ExitCode
}

# Use the native manage-bde.exe even if Intune started a 32-bit PowerShell host.
$system32 = if ([Environment]::Is64BitOperatingSystem -and -not [Environment]::Is64BitProcess) { "Sysnative" } else { "System32" }
$manageBde = Join-Path -Path $env:SystemRoot -ChildPath "$system32\manage-bde.exe"

try {
    $volume = Get-BitLockerVolume -MountPoint $MountPoint -ErrorAction Stop
} catch {
    Complete-Remediation -Message "Could not read BitLocker status for $MountPoint. $($_.Exception.Message)" -ExitCode 1
}

$status = [string]$volume.VolumeStatus
$protection = [string]$volume.ProtectionStatus
$percent = [int]$volume.EncryptionPercentage
$summary = "${MountPoint} $status at $percent%."

# Case 1: conversion paused.
if ($status -eq "EncryptionPaused") {
    $result = & $manageBde -resume $MountPoint 2>&1
    $code = $LASTEXITCODE
    $after = Get-BitLockerVolume -MountPoint $MountPoint
    if ($code -eq 0) {
        Complete-Remediation -Message "$summary manage-bde -resume exit code 0. Status now $($after.VolumeStatus)." -ExitCode 0
    }
    Complete-Remediation -Message "$summary manage-bde -resume failed with exit code ${code}: $($result -join ' ')" -ExitCode 1
}

# Case 2: fully encrypted but protectors suspended.
if ($status -eq "FullyEncrypted" -and $protection -eq "Off" -and @($volume.KeyProtector).Count -gt 0) {
    try {
        Resume-BitLocker -MountPoint $MountPoint -ErrorAction Stop | Out-Null
        $after = Get-BitLockerVolume -MountPoint $MountPoint
        Complete-Remediation -Message "$summary Resume-BitLocker ran. ProtectionStatus now $($after.ProtectionStatus)." -ExitCode 0
    } catch {
        Complete-Remediation -Message "$summary Resume-BitLocker failed: $($_.Exception.Message)" -ExitCode 1
    }
}

# Case 3: stalled in progress. Report the evidence instead of guessing at a fix.
if ($status -eq "EncryptionInProgress") {
    $filter = @{
        LogName   = "Microsoft-Windows-BitLocker/BitLocker Management"
        Level     = 2, 3
        StartTime = (Get-Date).AddDays(-7)
    }
    $events = Get-WinEvent -FilterHashtable $filter -MaxEvents 5 -ErrorAction SilentlyContinue
    $lines = foreach ($logEntry in $events) {
        $firstLine = ($logEntry.Message -split "`r?`n")[0]
        "[{0:yyyy-MM-dd HH:mm}] {1} {2}" -f $logEntry.TimeCreated, $logEntry.Id, $firstLine
    }
    if (-not $lines) {
        $lines = @("No BitLocker-API errors or warnings in the last 7 days.")
    }
    Complete-Remediation -Message "${MountPoint} stalled at $percent%, no automatic fix. Recent BitLocker-API events: $($lines -join ' | ')" -ExitCode 1
}

# The state changed between detection and remediation (for example it finished).
Complete-Remediation -Message "$summary Nothing to do; state changed since detection." -ExitCode 0