[{"data":1,"prerenderedAt":2676},["ShallowReactive",2],{"post:\u002F2025\u002F09\u002F10\u002Fpowershell-intune-remediation-script-for-stuck-bitlocker-encryption\u002F":3},{"post":4,"newer":2628,"older":2636,"related":2646,"series":2674},{"id":5,"title":6,"body":7,"canonical":2609,"categories":2610,"date":2613,"description":2614,"extension":2615,"featured":2616,"hero":2617,"image":2617,"meta":2618,"navigation":435,"path":2619,"readingTime":382,"seo":2620,"series":2617,"seriesOrder":2617,"sites":2621,"source":2617,"stem":2622,"tags":2623,"updated":2617,"url":2626,"__hash__":2627},"blog\u002Fblog\u002F2025\u002F09\u002F10\u002Fpowershell-intune-remediation-script-for-stuck-bitlocker-encryption.md","PowerShell: Intune – Remediation Script for Stuck BitLocker Encryption",{"type":8,"value":9,"toc":2601},"minimark",[10,35,62,141,154,159,206,210,217,311,315,332,1205,1223,1260,1267,1275,1279,2381,2385,2522,2526,2597],[11,12,13,14,18,19,22,23,26,27,30,31,34],"p",{},"BitLocker encryption doesn't fail loudly. It just stops moving. ",[15,16,17],"code",{},"Get-BitLockerVolume"," reports ",[15,20,21],{},"EncryptionInProgress"," at 43% for days, or the volume sits in ",[15,24,25],{},"EncryptionPaused",", or a fully encrypted drive shows ",[15,28,29],{},"ProtectionStatus"," ",[15,32,33],{},"Off"," long after whatever suspended it has finished. Nobody notices until a compliance report or a lost-laptop incident asks whether the drive was actually protected. There's no built-in alert for \"encryption stalled,\" so this is an Intune Remediations pair: a Detect script that classifies the volume and remembers what it saw last time, and a Remediate script that applies the documented fix for each case.",[11,36,37,38,41,42,44,45,49,50,53,54,57,58,61],{},"The first version of this post restarted the BitLocker service and called ",[15,39,40],{},"Resume-BitLocker"," for every stall. That was wrong for the most common case. ",[15,43,40],{}," restores ",[46,47,48],"em",{},"protection"," on a volume that was suspended with ",[15,51,52],{},"Suspend-BitLocker",", and has no effect on a volume that isn't suspended. It doesn't restart a paused ",[46,55,56],{},"conversion",": that's ",[15,59,60],{},"manage-bde -resume",". The scripts below treat those as separate conditions.",[63,64,65,81],"table",{},[66,67,68],"thead",{},[69,70,71,75,78],"tr",{},[72,73,74],"th",{},"What the volume reports",[72,76,77],{},"What it means",[72,79,80],{},"Fix in this script",[82,83,84,103,126],"tbody",{},[69,85,86,95,98],{},[87,88,89,92,93],"td",{},[15,90,91],{},"VolumeStatus"," = ",[15,94,25],{},[87,96,97],{},"Conversion was paused partway through",[87,99,100],{},[15,101,102],{},"manage-bde -resume C:",[69,104,105,118,121],{},[87,106,107,92,109,112,113,92,115,117],{},[15,108,91],{},[15,110,111],{},"FullyEncrypted",", ",[15,114,29],{},[15,116,33],{},", key protectors present, unchanged for longer than the grace period",[87,119,120],{},"Protectors are disabled (suspended)",[87,122,123],{},[15,124,125],{},"Resume-BitLocker -MountPoint C:",[69,127,128,135,138],{},[87,129,130,92,132,134],{},[15,131,91],{},[15,133,21],{},", percentage unchanged for longer than the threshold",[87,136,137],{},"Conversion is running but not progressing",[87,139,140],{},"None. Report the recent BitLocker-API errors and escalate",[11,142,143,144,146,147,149,150,153],{},"One trap to avoid: ",[15,145,29],{}," is ",[15,148,33],{}," on ",[46,151,152],{},"every"," volume that is still encrypting. Microsoft's definition of protection off includes \"unencrypted, partially encrypted, or the volume's encryption key is available in the clear.\" Flagging \"protection off with partial encryption\" catches every healthy device in the middle of its first encryption, so neither script does.",[155,156,158],"h2",{"id":157},"requirements","Requirements",[160,161,162,182,185,188,195],"ul",{},[163,164,165,166,112,170,173,174,177,178,181],"li",{},"Deployed as an Intune remediation: ",[167,168,169],"strong",{},"Devices > Manage devices > Scripts and remediations",[167,171,172],{},"Create script package",", upload both files. Run as SYSTEM (",[167,175,176],{},"Run this script using the logged-on credentials"," = No), ",[167,179,180],{},"Enforce script signature check"," = No.",[163,183,184],{},"Licensing: device users need Windows Enterprise E3 or E5 (included in Microsoft 365 F3, E3 or E5), Windows Education A3 or A5, or Windows VDA per user.",[163,186,187],{},"Devices must be Microsoft Entra joined or hybrid joined, and either Intune-enrolled on Windows Enterprise, Professional or Education, or co-managed.",[163,189,190,191,194],{},"A BitLocker policy already targeted at the device (an endpoint security disk encryption profile or equivalent). This pair unsticks an encryption that policy started; it never calls ",[15,192,193],{},"Enable-BitLocker",".",[163,196,197,198,201,202,205],{},"No extra modules: the ",[15,199,200],{},"BitLocker"," module and ",[15,203,204],{},"manage-bde.exe"," ship with Windows.",[155,207,209],{"id":208},"parameters","Parameters",[11,211,212,213,216],{},"Intune remediations don't pass arguments, so the scripts use variables at the top. The Detect script uses all four; the Remediate script only uses ",[15,214,215],{},"$MountPoint",", so keep that value the same in both files.",[63,218,219,235],{},[66,220,221],{},[69,222,223,226,229,232],{},[72,224,225],{},"Name",[72,227,228],{},"Type",[72,230,231],{},"Required",[72,233,234],{},"Description",[82,236,237,255,272,293],{},[69,238,239,243,246,249],{},[87,240,241],{},[15,242,215],{},[87,244,245],{},"String",[87,247,248],{},"No",[87,250,251,252,194],{},"Volume to check. Defaults to ",[15,253,254],{},"C:",[69,256,257,262,264,266],{},[87,258,259],{},[15,260,261],{},"$StateRegPath",[87,263,245],{},[87,265,248],{},[87,267,268,269,194],{},"Registry key where the Detect script records the last status, percentage and when they last changed. Defaults to ",[15,270,271],{},"HKLM:\\SOFTWARE\\IntuneRemediations\\BitLockerStuck",[69,273,274,279,282,284],{},[87,275,276],{},[15,277,278],{},"$StallThresholdMinutes",[87,280,281],{},"Int",[87,283,248],{},[87,285,286,287,289,290,194],{},"How long ",[15,288,21],{}," can sit at the same percentage before it counts as stalled. Defaults to ",[15,291,292],{},"240",[69,294,295,300,302,304],{},[87,296,297],{},[15,298,299],{},"$SuspendGraceHours",[87,301,281],{},[87,303,248],{},[87,305,306,307,310],{},"How long a fully encrypted volume may stay suspended before it's flagged. Defaults to ",[15,308,309],{},"24",", so a suspension that is meant to clear itself after a restart gets time to do that.",[155,312,314],{"id":313},"usage","Usage",[11,316,317,318,321,322,325,326,329,330,194],{},"Save this as ",[15,319,320],{},"Detect-StuckBitLocker.ps1"," and upload it as the ",[167,323,324],{},"Detection script file",". It exits ",[15,327,328],{},"1"," only when there's something for the Remediate script to look at; Intune runs the remediation only on exit code ",[15,331,328],{},[333,334,339],"pre",{"className":335,"code":336,"language":337,"meta":338,"style":338},"language-powershell shiki shiki-themes github-dark","\u003C#\n.SYNOPSIS\n    Detection script: flags a paused, suspended or stalled BitLocker volume.\n.DESCRIPTION\n    Reads Get-BitLockerVolume for the OS volume, compares it with the state\n    recorded on the previous run, and records the new state. Exits 1 when the\n    volume is EncryptionPaused, suspended past the grace period, or stuck at\n    the same encryption percentage past the stall threshold. Exits 0 otherwise.\n.NOTES\n    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n    Version : 1.0 (2025-09-10)\n    Requires: Runs as SYSTEM in an Intune remediation.\n#>\n\n$MountPoint = \"C:\"\n$StateRegPath = \"HKLM:\\SOFTWARE\\IntuneRemediations\\BitLockerStuck\"\n$StallThresholdMinutes = 240\n$SuspendGraceHours = 24\n\ntry {\n    $volume = Get-BitLockerVolume -MountPoint $MountPoint -ErrorAction Stop\n} catch {\n    Write-Output \"UNKNOWN: could not read BitLocker status for $MountPoint. $($_.Exception.Message)\"\n    exit 0\n}\n\n$status = [string]$volume.VolumeStatus\n$protection = [string]$volume.ProtectionStatus\n$percent = [int]$volume.EncryptionPercentage\n$nowUtc = (Get-Date).ToUniversalTime()\n\nif (-not (Test-Path -Path $StateRegPath)) {\n    New-Item -Path $StateRegPath -Force | Out-Null\n}\n\n# Keep LastChangeUtc unless the status or percentage moved since the last run.\n$state = Get-ItemProperty -Path $StateRegPath -ErrorAction SilentlyContinue\n$lastChangeUtc = $nowUtc\n\nif ($state -and $state.LastStatus -eq $status -and $state.LastPercent -eq $percent -and $state.LastChangeUtc) {\n    $lastChangeUtc = [datetime]::Parse($state.LastChangeUtc).ToUniversalTime()\n}\n\nNew-ItemProperty -Path $StateRegPath -Name \"LastStatus\" -Value $status -PropertyType String -Force | Out-Null\nNew-ItemProperty -Path $StateRegPath -Name \"LastPercent\" -Value $percent -PropertyType DWord -Force | Out-Null\nNew-ItemProperty -Path $StateRegPath -Name \"LastChangeUtc\" -Value $lastChangeUtc.ToString(\"o\") -PropertyType String -Force | Out-Null\n\n$since = $lastChangeUtc.ToString(\"yyyy-MM-ddTHH:mm:ssZ\")\n$minutesUnchanged = ($nowUtc - $lastChangeUtc).TotalMinutes\n\nif ($status -eq \"EncryptionPaused\") {\n    Write-Output \"PAUSED: $MountPoint EncryptionPaused at $percent% since $since\"\n    exit 1\n}\n\nif ($status -eq \"FullyEncrypted\" -and $protection -eq \"Off\" -and @($volume.KeyProtector).Count -gt 0 -and $minutesUnchanged -ge ($SuspendGraceHours * 60)) {\n    Write-Output \"SUSPENDED: $MountPoint fully encrypted, protection off since $since\"\n    exit 1\n}\n\nif ($status -eq \"EncryptionInProgress\" -and $minutesUnchanged -ge $StallThresholdMinutes) {\n    Write-Output \"STALLED: $MountPoint EncryptionInProgress at $percent% since $since\"\n    exit 1\n}\n\nWrite-Output \"OK: $MountPoint $status, protection $protection, $percent%\"\nexit 0\n","powershell","",[15,340,341,350,360,366,374,380,386,392,398,406,412,418,424,430,437,451,462,473,484,489,498,521,532,564,573,579,584,601,616,632,649,654,675,697,702,707,713,733,744,749,784,800,805,810,846,880,919,924,941,957,962,978,1002,1010,1015,1020,1077,1094,1101,1106,1111,1132,1153,1160,1165,1170,1197],{"__ignoreMap":338},[342,343,346],"span",{"class":344,"line":345},"line",1,[342,347,349],{"class":348},"sAwPA","\u003C#\n",[342,351,353,356],{"class":344,"line":352},2,[342,354,194],{"class":355},"sDLfK",[342,357,359],{"class":358},"snl16","SYNOPSIS\n",[342,361,363],{"class":344,"line":362},3,[342,364,365],{"class":348},"    Detection script: flags a paused, suspended or stalled BitLocker volume.\n",[342,367,369,371],{"class":344,"line":368},4,[342,370,194],{"class":355},[342,372,373],{"class":358},"DESCRIPTION\n",[342,375,377],{"class":344,"line":376},5,[342,378,379],{"class":348},"    Reads Get-BitLockerVolume for the OS volume, compares it with the state\n",[342,381,383],{"class":344,"line":382},6,[342,384,385],{"class":348},"    recorded on the previous run, and records the new state. Exits 1 when the\n",[342,387,389],{"class":344,"line":388},7,[342,390,391],{"class":348},"    volume is EncryptionPaused, suspended past the grace period, or stuck at\n",[342,393,395],{"class":344,"line":394},8,[342,396,397],{"class":348},"    the same encryption percentage past the stall threshold. Exits 0 otherwise.\n",[342,399,401,403],{"class":344,"line":400},9,[342,402,194],{"class":355},[342,404,405],{"class":358},"NOTES\n",[342,407,409],{"class":344,"line":408},10,[342,410,411],{"class":348},"    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n",[342,413,415],{"class":344,"line":414},11,[342,416,417],{"class":348},"    Version : 1.0 (2025-09-10)\n",[342,419,421],{"class":344,"line":420},12,[342,422,423],{"class":348},"    Requires: Runs as SYSTEM in an Intune remediation.\n",[342,425,427],{"class":344,"line":426},13,[342,428,429],{"class":348},"#>\n",[342,431,433],{"class":344,"line":432},14,[342,434,436],{"emptyLinePlaceholder":435},true,"\n",[342,438,440,444,447],{"class":344,"line":439},15,[342,441,443],{"class":442},"s95oV","$MountPoint ",[342,445,446],{"class":358},"=",[342,448,450],{"class":449},"sU2Wk"," \"C:\"\n",[342,452,454,457,459],{"class":344,"line":453},16,[342,455,456],{"class":442},"$StateRegPath ",[342,458,446],{"class":358},[342,460,461],{"class":449}," \"HKLM:\\SOFTWARE\\IntuneRemediations\\BitLockerStuck\"\n",[342,463,465,468,470],{"class":344,"line":464},17,[342,466,467],{"class":442},"$StallThresholdMinutes ",[342,469,446],{"class":358},[342,471,472],{"class":355}," 240\n",[342,474,476,479,481],{"class":344,"line":475},18,[342,477,478],{"class":442},"$SuspendGraceHours ",[342,480,446],{"class":358},[342,482,483],{"class":355}," 24\n",[342,485,487],{"class":344,"line":486},19,[342,488,436],{"emptyLinePlaceholder":435},[342,490,492,495],{"class":344,"line":491},20,[342,493,494],{"class":358},"try",[342,496,497],{"class":442}," {\n",[342,499,501,504,506,509,512,515,518],{"class":344,"line":500},21,[342,502,503],{"class":442},"    $volume ",[342,505,446],{"class":358},[342,507,508],{"class":355}," Get-BitLockerVolume",[342,510,511],{"class":358}," -",[342,513,514],{"class":442},"MountPoint $MountPoint ",[342,516,517],{"class":358},"-",[342,519,520],{"class":442},"ErrorAction Stop\n",[342,522,524,527,530],{"class":344,"line":523},22,[342,525,526],{"class":442},"} ",[342,528,529],{"class":358},"catch",[342,531,497],{"class":442},[342,533,535,538,541,543,546,549,552,555,558,561],{"class":344,"line":534},23,[342,536,537],{"class":355},"    Write-Output",[342,539,540],{"class":449}," \"UNKNOWN: could not read BitLocker status for ",[342,542,215],{"class":442},[342,544,545],{"class":449},". ",[342,547,548],{"class":358},"$",[342,550,551],{"class":449},"(",[342,553,554],{"class":355},"$_",[342,556,557],{"class":442},".Exception.Message",[342,559,560],{"class":449},")",[342,562,563],{"class":449},"\"\n",[342,565,567,570],{"class":344,"line":566},24,[342,568,569],{"class":358},"    exit",[342,571,572],{"class":355}," 0\n",[342,574,576],{"class":344,"line":575},25,[342,577,578],{"class":442},"}\n",[342,580,582],{"class":344,"line":581},26,[342,583,436],{"emptyLinePlaceholder":435},[342,585,587,590,592,595,598],{"class":344,"line":586},27,[342,588,589],{"class":442},"$status ",[342,591,446],{"class":358},[342,593,594],{"class":442}," [",[342,596,597],{"class":358},"string",[342,599,600],{"class":442},"]$volume.VolumeStatus\n",[342,602,604,607,609,611,613],{"class":344,"line":603},28,[342,605,606],{"class":442},"$protection ",[342,608,446],{"class":358},[342,610,594],{"class":442},[342,612,597],{"class":358},[342,614,615],{"class":442},"]$volume.ProtectionStatus\n",[342,617,619,622,624,626,629],{"class":344,"line":618},29,[342,620,621],{"class":442},"$percent ",[342,623,446],{"class":358},[342,625,594],{"class":442},[342,627,628],{"class":358},"int",[342,630,631],{"class":442},"]$volume.EncryptionPercentage\n",[342,633,635,638,640,643,646],{"class":344,"line":634},30,[342,636,637],{"class":442},"$nowUtc ",[342,639,446],{"class":358},[342,641,642],{"class":442}," (",[342,644,645],{"class":355},"Get-Date",[342,647,648],{"class":442},").ToUniversalTime()\n",[342,650,652],{"class":344,"line":651},31,[342,653,436],{"emptyLinePlaceholder":435},[342,655,657,660,662,665,667,670,672],{"class":344,"line":656},32,[342,658,659],{"class":358},"if",[342,661,642],{"class":442},[342,663,664],{"class":358},"-not",[342,666,642],{"class":442},[342,668,669],{"class":355},"Test-Path",[342,671,511],{"class":358},[342,673,674],{"class":442},"Path $StateRegPath)) {\n",[342,676,678,681,683,686,688,691,694],{"class":344,"line":677},33,[342,679,680],{"class":355},"    New-Item",[342,682,511],{"class":358},[342,684,685],{"class":442},"Path $StateRegPath ",[342,687,517],{"class":358},[342,689,690],{"class":442},"Force ",[342,692,693],{"class":358},"|",[342,695,696],{"class":355}," Out-Null\n",[342,698,700],{"class":344,"line":699},34,[342,701,578],{"class":442},[342,703,705],{"class":344,"line":704},35,[342,706,436],{"emptyLinePlaceholder":435},[342,708,710],{"class":344,"line":709},36,[342,711,712],{"class":348},"# Keep LastChangeUtc unless the status or percentage moved since the last run.\n",[342,714,716,719,721,724,726,728,730],{"class":344,"line":715},37,[342,717,718],{"class":442},"$state ",[342,720,446],{"class":358},[342,722,723],{"class":355}," Get-ItemProperty",[342,725,511],{"class":358},[342,727,685],{"class":442},[342,729,517],{"class":358},[342,731,732],{"class":442},"ErrorAction SilentlyContinue\n",[342,734,736,739,741],{"class":344,"line":735},38,[342,737,738],{"class":442},"$lastChangeUtc ",[342,740,446],{"class":358},[342,742,743],{"class":442}," $nowUtc\n",[342,745,747],{"class":344,"line":746},39,[342,748,436],{"emptyLinePlaceholder":435},[342,750,752,754,757,760,763,766,769,771,774,776,779,781],{"class":344,"line":751},40,[342,753,659],{"class":358},[342,755,756],{"class":442}," ($state ",[342,758,759],{"class":358},"-and",[342,761,762],{"class":442}," $state.LastStatus ",[342,764,765],{"class":358},"-eq",[342,767,768],{"class":442}," $status ",[342,770,759],{"class":358},[342,772,773],{"class":442}," $state.LastPercent ",[342,775,765],{"class":358},[342,777,778],{"class":442}," $percent ",[342,780,759],{"class":358},[342,782,783],{"class":442}," $state.LastChangeUtc) {\n",[342,785,787,790,792,794,797],{"class":344,"line":786},41,[342,788,789],{"class":442},"    $lastChangeUtc ",[342,791,446],{"class":358},[342,793,594],{"class":442},[342,795,796],{"class":358},"datetime",[342,798,799],{"class":442},"]::Parse($state.LastChangeUtc).ToUniversalTime()\n",[342,801,803],{"class":344,"line":802},42,[342,804,578],{"class":442},[342,806,808],{"class":344,"line":807},43,[342,809,436],{"emptyLinePlaceholder":435},[342,811,813,816,818,820,822,825,828,830,833,835,838,840,842,844],{"class":344,"line":812},44,[342,814,815],{"class":355},"New-ItemProperty",[342,817,511],{"class":358},[342,819,685],{"class":442},[342,821,517],{"class":358},[342,823,824],{"class":442},"Name ",[342,826,827],{"class":449},"\"LastStatus\"",[342,829,511],{"class":358},[342,831,832],{"class":442},"Value $status ",[342,834,517],{"class":358},[342,836,837],{"class":442},"PropertyType String ",[342,839,517],{"class":358},[342,841,690],{"class":442},[342,843,693],{"class":358},[342,845,696],{"class":355},[342,847,849,851,853,855,857,859,862,864,867,869,872,874,876,878],{"class":344,"line":848},45,[342,850,815],{"class":355},[342,852,511],{"class":358},[342,854,685],{"class":442},[342,856,517],{"class":358},[342,858,824],{"class":442},[342,860,861],{"class":449},"\"LastPercent\"",[342,863,511],{"class":358},[342,865,866],{"class":442},"Value $percent ",[342,868,517],{"class":358},[342,870,871],{"class":442},"PropertyType DWord ",[342,873,517],{"class":358},[342,875,690],{"class":442},[342,877,693],{"class":358},[342,879,696],{"class":355},[342,881,883,885,887,889,891,893,896,898,901,904,907,909,911,913,915,917],{"class":344,"line":882},46,[342,884,815],{"class":355},[342,886,511],{"class":358},[342,888,685],{"class":442},[342,890,517],{"class":358},[342,892,824],{"class":442},[342,894,895],{"class":449},"\"LastChangeUtc\"",[342,897,511],{"class":358},[342,899,900],{"class":442},"Value $lastChangeUtc.ToString(",[342,902,903],{"class":449},"\"o\"",[342,905,906],{"class":442},") ",[342,908,517],{"class":358},[342,910,837],{"class":442},[342,912,517],{"class":358},[342,914,690],{"class":442},[342,916,693],{"class":358},[342,918,696],{"class":355},[342,920,922],{"class":344,"line":921},47,[342,923,436],{"emptyLinePlaceholder":435},[342,925,927,930,932,935,938],{"class":344,"line":926},48,[342,928,929],{"class":442},"$since ",[342,931,446],{"class":358},[342,933,934],{"class":442}," $lastChangeUtc.ToString(",[342,936,937],{"class":449},"\"yyyy-MM-ddTHH:mm:ssZ\"",[342,939,940],{"class":442},")\n",[342,942,944,947,949,952,954],{"class":344,"line":943},49,[342,945,946],{"class":442},"$minutesUnchanged ",[342,948,446],{"class":358},[342,950,951],{"class":442}," ($nowUtc ",[342,953,517],{"class":358},[342,955,956],{"class":442}," $lastChangeUtc).TotalMinutes\n",[342,958,960],{"class":344,"line":959},50,[342,961,436],{"emptyLinePlaceholder":435},[342,963,965,967,970,972,975],{"class":344,"line":964},51,[342,966,659],{"class":358},[342,968,969],{"class":442}," ($status ",[342,971,765],{"class":358},[342,973,974],{"class":449}," \"EncryptionPaused\"",[342,976,977],{"class":442},") {\n",[342,979,981,983,986,988,991,994,997,1000],{"class":344,"line":980},52,[342,982,537],{"class":355},[342,984,985],{"class":449}," \"PAUSED: ",[342,987,215],{"class":442},[342,989,990],{"class":449}," EncryptionPaused at ",[342,992,993],{"class":442},"$percent",[342,995,996],{"class":449},"% since ",[342,998,999],{"class":442},"$since",[342,1001,563],{"class":449},[342,1003,1005,1007],{"class":344,"line":1004},53,[342,1006,569],{"class":358},[342,1008,1009],{"class":355}," 1\n",[342,1011,1013],{"class":344,"line":1012},54,[342,1014,578],{"class":442},[342,1016,1018],{"class":344,"line":1017},55,[342,1019,436],{"emptyLinePlaceholder":435},[342,1021,1023,1025,1027,1029,1032,1035,1038,1040,1043,1045,1048,1051,1054,1057,1059,1062,1065,1068,1071,1074],{"class":344,"line":1022},56,[342,1024,659],{"class":358},[342,1026,969],{"class":442},[342,1028,765],{"class":358},[342,1030,1031],{"class":449}," \"FullyEncrypted\"",[342,1033,1034],{"class":358}," -and",[342,1036,1037],{"class":442}," $protection ",[342,1039,765],{"class":358},[342,1041,1042],{"class":449}," \"Off\"",[342,1044,1034],{"class":358},[342,1046,1047],{"class":358}," @",[342,1049,1050],{"class":442},"($volume.KeyProtector).Count ",[342,1052,1053],{"class":358},"-gt",[342,1055,1056],{"class":355}," 0",[342,1058,1034],{"class":358},[342,1060,1061],{"class":442}," $minutesUnchanged ",[342,1063,1064],{"class":358},"-ge",[342,1066,1067],{"class":442}," ($SuspendGraceHours ",[342,1069,1070],{"class":358},"*",[342,1072,1073],{"class":355}," 60",[342,1075,1076],{"class":442},")) {\n",[342,1078,1080,1082,1085,1087,1090,1092],{"class":344,"line":1079},57,[342,1081,537],{"class":355},[342,1083,1084],{"class":449}," \"SUSPENDED: ",[342,1086,215],{"class":442},[342,1088,1089],{"class":449}," fully encrypted, protection off since ",[342,1091,999],{"class":442},[342,1093,563],{"class":449},[342,1095,1097,1099],{"class":344,"line":1096},58,[342,1098,569],{"class":358},[342,1100,1009],{"class":355},[342,1102,1104],{"class":344,"line":1103},59,[342,1105,578],{"class":442},[342,1107,1109],{"class":344,"line":1108},60,[342,1110,436],{"emptyLinePlaceholder":435},[342,1112,1114,1116,1118,1120,1123,1125,1127,1129],{"class":344,"line":1113},61,[342,1115,659],{"class":358},[342,1117,969],{"class":442},[342,1119,765],{"class":358},[342,1121,1122],{"class":449}," \"EncryptionInProgress\"",[342,1124,1034],{"class":358},[342,1126,1061],{"class":442},[342,1128,1064],{"class":358},[342,1130,1131],{"class":442}," $StallThresholdMinutes) {\n",[342,1133,1135,1137,1140,1142,1145,1147,1149,1151],{"class":344,"line":1134},62,[342,1136,537],{"class":355},[342,1138,1139],{"class":449}," \"STALLED: ",[342,1141,215],{"class":442},[342,1143,1144],{"class":449}," EncryptionInProgress at ",[342,1146,993],{"class":442},[342,1148,996],{"class":449},[342,1150,999],{"class":442},[342,1152,563],{"class":449},[342,1154,1156,1158],{"class":344,"line":1155},63,[342,1157,569],{"class":358},[342,1159,1009],{"class":355},[342,1161,1163],{"class":344,"line":1162},64,[342,1164,578],{"class":442},[342,1166,1168],{"class":344,"line":1167},65,[342,1169,436],{"emptyLinePlaceholder":435},[342,1171,1173,1176,1179,1181,1184,1187,1190,1192,1194],{"class":344,"line":1172},66,[342,1174,1175],{"class":355},"Write-Output",[342,1177,1178],{"class":449}," \"OK: ",[342,1180,215],{"class":442},[342,1182,1183],{"class":442}," $status",[342,1185,1186],{"class":449},", protection ",[342,1188,1189],{"class":442},"$protection",[342,1191,112],{"class":449},[342,1193,993],{"class":442},[342,1195,1196],{"class":449},"%\"\n",[342,1198,1200,1203],{"class":344,"line":1199},67,[342,1201,1202],{"class":358},"exit",[342,1204,572],{"class":355},[11,1206,1207,1208,321,1211,1214,1215,1218,1219,1222],{},"Save the script in the next section as ",[15,1209,1210],{},"Repair-StuckBitLocker.ps1",[167,1212,1213],{},"Remediation script file",". Assign the package to a device group with an ",[167,1216,1217],{},"Hourly"," schedule. To test on one machine first, run both from an elevated 64-bit PowerShell session, or use the ",[167,1220,1221],{},"Run remediation"," device action on a single device:",[333,1224,1226],{"className":335,"code":1225,"language":337,"meta":338,"style":338},".\\Detect-StuckBitLocker.ps1; if ($LASTEXITCODE -eq 1) { .\\Repair-StuckBitLocker.ps1 }\n",[15,1227,1228],{"__ignoreMap":338},[342,1229,1230,1233,1235,1238,1240,1242,1245,1248,1251,1254,1257],{"class":344,"line":345},[342,1231,1232],{"class":442},".\\Detect",[342,1234,517],{"class":358},[342,1236,1237],{"class":442},"StuckBitLocker.ps1; ",[342,1239,659],{"class":358},[342,1241,642],{"class":442},[342,1243,1244],{"class":355},"$LASTEXITCODE",[342,1246,1247],{"class":358}," -eq",[342,1249,1250],{"class":355}," 1",[342,1252,1253],{"class":442},") { .",[342,1255,1256],{"class":355},"\\Repair-StuckBitLocker.ps1",[342,1258,1259],{"class":442}," }\n",[11,1261,1262,1263,1266],{},"What the detection and remediation output look like in the remediation's ",[167,1264,1265],{},"Device status"," report (the output columns can be added to the view or exported to CSV):",[333,1268,1273],{"className":1269,"code":1271,"language":1272,"meta":338},[1270],"language-text","Detection   : PAUSED: C: EncryptionPaused at 43% since 2025-09-09T14:05:11Z\nRemediation : C: EncryptionPaused at 43%. manage-bde -resume exit code 0. Status now EncryptionInProgress.\n\nDetection   : STALLED: C: EncryptionInProgress at 61% since 2025-09-08T22:40:03Z\nRemediation : C: stalled at 61%, no automatic fix. Recent BitLocker-API events: [2025-09-08 22:39] 854 Failed to enable Silent Encryption. WinRe is not configured. ...\n","text",[15,1274,1271],{"__ignoreMap":338},[155,1276,1278],{"id":1277},"script","Script",[333,1280,1282],{"className":335,"code":1281,"language":337,"meta":338,"style":338},"\u003C#\n.SYNOPSIS\n    Remediation script: resumes paused BitLocker encryption or suspended\n    protection, and reports why a stalled encryption can't be fixed.\n.DESCRIPTION\n    Runs after Detect-StuckBitLocker.ps1 exits 1. Re-reads the OS volume and\n    acts on the documented cases only:\n      - EncryptionPaused: runs manage-bde -resume, which resumes encryption\n        or decryption after it has been paused.\n      - FullyEncrypted with protection off and key protectors present: runs\n        Resume-BitLocker, which restores protection on a suspended volume.\n      - EncryptionInProgress with no progress: no supported fix exists, so it\n        writes the most recent BitLocker-API Management errors and warnings to\n        the output (trimmed to the 2,048-character remediation limit) and\n        exits 1 so the device shows as failed in the report.\n.NOTES\n    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n    Version : 1.0 (2025-09-10)\n    Requires: Runs as SYSTEM in an Intune remediation, paired with\n              Detect-StuckBitLocker.ps1. BitLocker module, manage-bde.exe.\n#>\n\n$MountPoint = \"C:\"\n$MaxOutput = 2000\n\n# Write the output once, trimmed below Intune's 2,048-character limit, then exit.\nfunction Complete-Remediation {\n    param ([string]$Message, [int]$ExitCode)\n    if ($Message.Length -gt $MaxOutput) {\n        $Message = $Message.Substring(0, $MaxOutput)\n    }\n    Write-Output $Message\n    exit $ExitCode\n}\n\n# Use the native manage-bde.exe even if Intune started a 32-bit PowerShell host.\n$system32 = if ([Environment]::Is64BitOperatingSystem -and -not [Environment]::Is64BitProcess) { \"Sysnative\" } else { \"System32\" }\n$manageBde = Join-Path -Path $env:SystemRoot -ChildPath \"$system32\\manage-bde.exe\"\n\ntry {\n    $volume = Get-BitLockerVolume -MountPoint $MountPoint -ErrorAction Stop\n} catch {\n    Complete-Remediation -Message \"Could not read BitLocker status for $MountPoint. $($_.Exception.Message)\" -ExitCode 1\n}\n\n$status = [string]$volume.VolumeStatus\n$protection = [string]$volume.ProtectionStatus\n$percent = [int]$volume.EncryptionPercentage\n$summary = \"${MountPoint} $status at $percent%.\"\n\n# Case 1: conversion paused.\nif ($status -eq \"EncryptionPaused\") {\n    $result = & $manageBde -resume $MountPoint 2>&1\n    $code = $LASTEXITCODE\n    $after = Get-BitLockerVolume -MountPoint $MountPoint\n    if ($code -eq 0) {\n        Complete-Remediation -Message \"$summary manage-bde -resume exit code 0. Status now $($after.VolumeStatus).\" -ExitCode 0\n    }\n    Complete-Remediation -Message \"$summary manage-bde -resume failed with exit code ${code}: $($result -join ' ')\" -ExitCode 1\n}\n\n# Case 2: fully encrypted but protectors suspended.\nif ($status -eq \"FullyEncrypted\" -and $protection -eq \"Off\" -and @($volume.KeyProtector).Count -gt 0) {\n    try {\n        Resume-BitLocker -MountPoint $MountPoint -ErrorAction Stop | Out-Null\n        $after = Get-BitLockerVolume -MountPoint $MountPoint\n        Complete-Remediation -Message \"$summary Resume-BitLocker ran. ProtectionStatus now $($after.ProtectionStatus).\" -ExitCode 0\n    } catch {\n        Complete-Remediation -Message \"$summary Resume-BitLocker failed: $($_.Exception.Message)\" -ExitCode 1\n    }\n}\n\n# Case 3: stalled in progress. Report the evidence instead of guessing at a fix.\nif ($status -eq \"EncryptionInProgress\") {\n    $filter = @{\n        LogName   = \"Microsoft-Windows-BitLocker\u002FBitLocker Management\"\n        Level     = 2, 3\n        StartTime = (Get-Date).AddDays(-7)\n    }\n    $events = Get-WinEvent -FilterHashtable $filter -MaxEvents 5 -ErrorAction SilentlyContinue\n    $lines = foreach ($logEntry in $events) {\n        $firstLine = ($logEntry.Message -split \"`r?`n\")[0]\n        \"[{0:yyyy-MM-dd HH:mm}] {1} {2}\" -f $logEntry.TimeCreated, $logEntry.Id, $firstLine\n    }\n    if (-not $lines) {\n        $lines = @(\"No BitLocker-API errors or warnings in the last 7 days.\")\n    }\n    Complete-Remediation -Message \"${MountPoint} stalled at $percent%, no automatic fix. Recent BitLocker-API events: $($lines -join ' | ')\" -ExitCode 1\n}\n\n# The state changed between detection and remediation (for example it finished).\nComplete-Remediation -Message \"$summary Nothing to do; state changed since detection.\" -ExitCode 0\n",[15,1283,1284,1288,1294,1299,1304,1310,1315,1320,1325,1330,1335,1340,1345,1350,1355,1360,1366,1370,1374,1379,1384,1388,1392,1400,1410,1414,1419,1430,1453,1466,1484,1489,1496,1503,1507,1511,1516,1563,1598,1602,1608,1624,1632,1669,1673,1677,1689,1701,1713,1736,1740,1745,1757,1778,1788,1802,1815,1851,1855,1899,1903,1907,1912,1942,1949,1967,1980,2012,2022,2056,2061,2066,2071,2077,2090,2103,2114,2130,2150,2155,2183,2203,2238,2260,2265,2277,2294,2299,2342,2347,2352,2358],{"__ignoreMap":338},[342,1285,1286],{"class":344,"line":345},[342,1287,349],{"class":348},[342,1289,1290,1292],{"class":344,"line":352},[342,1291,194],{"class":355},[342,1293,359],{"class":358},[342,1295,1296],{"class":344,"line":362},[342,1297,1298],{"class":348},"    Remediation script: resumes paused BitLocker encryption or suspended\n",[342,1300,1301],{"class":344,"line":368},[342,1302,1303],{"class":348},"    protection, and reports why a stalled encryption can't be fixed.\n",[342,1305,1306,1308],{"class":344,"line":376},[342,1307,194],{"class":355},[342,1309,373],{"class":358},[342,1311,1312],{"class":344,"line":382},[342,1313,1314],{"class":348},"    Runs after Detect-StuckBitLocker.ps1 exits 1. Re-reads the OS volume and\n",[342,1316,1317],{"class":344,"line":388},[342,1318,1319],{"class":348},"    acts on the documented cases only:\n",[342,1321,1322],{"class":344,"line":394},[342,1323,1324],{"class":348},"      - EncryptionPaused: runs manage-bde -resume, which resumes encryption\n",[342,1326,1327],{"class":344,"line":400},[342,1328,1329],{"class":348},"        or decryption after it has been paused.\n",[342,1331,1332],{"class":344,"line":408},[342,1333,1334],{"class":348},"      - FullyEncrypted with protection off and key protectors present: runs\n",[342,1336,1337],{"class":344,"line":414},[342,1338,1339],{"class":348},"        Resume-BitLocker, which restores protection on a suspended volume.\n",[342,1341,1342],{"class":344,"line":420},[342,1343,1344],{"class":348},"      - EncryptionInProgress with no progress: no supported fix exists, so it\n",[342,1346,1347],{"class":344,"line":426},[342,1348,1349],{"class":348},"        writes the most recent BitLocker-API Management errors and warnings to\n",[342,1351,1352],{"class":344,"line":432},[342,1353,1354],{"class":348},"        the output (trimmed to the 2,048-character remediation limit) and\n",[342,1356,1357],{"class":344,"line":439},[342,1358,1359],{"class":348},"        exits 1 so the device shows as failed in the report.\n",[342,1361,1362,1364],{"class":344,"line":453},[342,1363,194],{"class":355},[342,1365,405],{"class":358},[342,1367,1368],{"class":344,"line":464},[342,1369,411],{"class":348},[342,1371,1372],{"class":344,"line":475},[342,1373,417],{"class":348},[342,1375,1376],{"class":344,"line":486},[342,1377,1378],{"class":348},"    Requires: Runs as SYSTEM in an Intune remediation, paired with\n",[342,1380,1381],{"class":344,"line":491},[342,1382,1383],{"class":348},"              Detect-StuckBitLocker.ps1. BitLocker module, manage-bde.exe.\n",[342,1385,1386],{"class":344,"line":500},[342,1387,429],{"class":348},[342,1389,1390],{"class":344,"line":523},[342,1391,436],{"emptyLinePlaceholder":435},[342,1393,1394,1396,1398],{"class":344,"line":534},[342,1395,443],{"class":442},[342,1397,446],{"class":358},[342,1399,450],{"class":449},[342,1401,1402,1405,1407],{"class":344,"line":566},[342,1403,1404],{"class":442},"$MaxOutput ",[342,1406,446],{"class":358},[342,1408,1409],{"class":355}," 2000\n",[342,1411,1412],{"class":344,"line":575},[342,1413,436],{"emptyLinePlaceholder":435},[342,1415,1416],{"class":344,"line":581},[342,1417,1418],{"class":348},"# Write the output once, trimmed below Intune's 2,048-character limit, then exit.\n",[342,1420,1421,1424,1428],{"class":344,"line":586},[342,1422,1423],{"class":358},"function",[342,1425,1427],{"class":1426},"svObZ"," Complete-Remediation",[342,1429,497],{"class":442},[342,1431,1432,1435,1438,1440,1443,1446,1448,1450],{"class":344,"line":603},[342,1433,1434],{"class":358},"    param",[342,1436,1437],{"class":442}," ([",[342,1439,597],{"class":358},[342,1441,1442],{"class":442},"]$Message",[342,1444,1445],{"class":358},",",[342,1447,594],{"class":442},[342,1449,628],{"class":358},[342,1451,1452],{"class":442},"]$ExitCode)\n",[342,1454,1455,1458,1461,1463],{"class":344,"line":618},[342,1456,1457],{"class":358},"    if",[342,1459,1460],{"class":442}," ($Message.Length ",[342,1462,1053],{"class":358},[342,1464,1465],{"class":442}," $MaxOutput) {\n",[342,1467,1468,1471,1473,1476,1479,1481],{"class":344,"line":634},[342,1469,1470],{"class":442},"        $Message ",[342,1472,446],{"class":358},[342,1474,1475],{"class":442}," $Message.Substring(",[342,1477,1478],{"class":355},"0",[342,1480,1445],{"class":358},[342,1482,1483],{"class":442}," $MaxOutput)\n",[342,1485,1486],{"class":344,"line":651},[342,1487,1488],{"class":442},"    }\n",[342,1490,1491,1493],{"class":344,"line":656},[342,1492,537],{"class":355},[342,1494,1495],{"class":442}," $Message\n",[342,1497,1498,1500],{"class":344,"line":677},[342,1499,569],{"class":358},[342,1501,1502],{"class":442}," $ExitCode\n",[342,1504,1505],{"class":344,"line":699},[342,1506,578],{"class":442},[342,1508,1509],{"class":344,"line":704},[342,1510,436],{"emptyLinePlaceholder":435},[342,1512,1513],{"class":344,"line":709},[342,1514,1515],{"class":348},"# Use the native manage-bde.exe even if Intune started a 32-bit PowerShell host.\n",[342,1517,1518,1521,1523,1526,1528,1531,1534,1536,1539,1541,1543,1546,1549,1552,1555,1558,1561],{"class":344,"line":715},[342,1519,1520],{"class":442},"$system32 ",[342,1522,446],{"class":358},[342,1524,1525],{"class":358}," if",[342,1527,1437],{"class":442},[342,1529,1530],{"class":358},"Environment",[342,1532,1533],{"class":442},"]::Is64BitOperatingSystem ",[342,1535,759],{"class":358},[342,1537,1538],{"class":358}," -not",[342,1540,594],{"class":442},[342,1542,1530],{"class":358},[342,1544,1545],{"class":442},"]::Is64BitProcess) { ",[342,1547,1548],{"class":449},"\"Sysnative\"",[342,1550,1551],{"class":442}," } ",[342,1553,1554],{"class":358},"else",[342,1556,1557],{"class":442}," { ",[342,1559,1560],{"class":449},"\"System32\"",[342,1562,1259],{"class":442},[342,1564,1565,1568,1570,1573,1575,1578,1581,1584,1586,1589,1592,1595],{"class":344,"line":735},[342,1566,1567],{"class":442},"$manageBde ",[342,1569,446],{"class":358},[342,1571,1572],{"class":355}," Join-Path",[342,1574,511],{"class":358},[342,1576,1577],{"class":442},"Path $",[342,1579,1580],{"class":355},"env:",[342,1582,1583],{"class":442},"SystemRoot ",[342,1585,517],{"class":358},[342,1587,1588],{"class":442},"ChildPath ",[342,1590,1591],{"class":449},"\"",[342,1593,1594],{"class":442},"$system32",[342,1596,1597],{"class":449},"\\manage-bde.exe\"\n",[342,1599,1600],{"class":344,"line":746},[342,1601,436],{"emptyLinePlaceholder":435},[342,1603,1604,1606],{"class":344,"line":751},[342,1605,494],{"class":358},[342,1607,497],{"class":442},[342,1609,1610,1612,1614,1616,1618,1620,1622],{"class":344,"line":786},[342,1611,503],{"class":442},[342,1613,446],{"class":358},[342,1615,508],{"class":355},[342,1617,511],{"class":358},[342,1619,514],{"class":442},[342,1621,517],{"class":358},[342,1623,520],{"class":442},[342,1625,1626,1628,1630],{"class":344,"line":802},[342,1627,526],{"class":442},[342,1629,529],{"class":358},[342,1631,497],{"class":442},[342,1633,1634,1637,1639,1642,1645,1647,1649,1651,1653,1655,1657,1659,1661,1663,1666],{"class":344,"line":807},[342,1635,1636],{"class":355},"    Complete-Remediation",[342,1638,511],{"class":358},[342,1640,1641],{"class":442},"Message ",[342,1643,1644],{"class":449},"\"Could not read BitLocker status for ",[342,1646,215],{"class":442},[342,1648,545],{"class":449},[342,1650,548],{"class":358},[342,1652,551],{"class":449},[342,1654,554],{"class":355},[342,1656,557],{"class":442},[342,1658,560],{"class":449},[342,1660,1591],{"class":449},[342,1662,511],{"class":358},[342,1664,1665],{"class":442},"ExitCode ",[342,1667,1668],{"class":355},"1\n",[342,1670,1671],{"class":344,"line":812},[342,1672,578],{"class":442},[342,1674,1675],{"class":344,"line":848},[342,1676,436],{"emptyLinePlaceholder":435},[342,1678,1679,1681,1683,1685,1687],{"class":344,"line":882},[342,1680,589],{"class":442},[342,1682,446],{"class":358},[342,1684,594],{"class":442},[342,1686,597],{"class":358},[342,1688,600],{"class":442},[342,1690,1691,1693,1695,1697,1699],{"class":344,"line":921},[342,1692,606],{"class":442},[342,1694,446],{"class":358},[342,1696,594],{"class":442},[342,1698,597],{"class":358},[342,1700,615],{"class":442},[342,1702,1703,1705,1707,1709,1711],{"class":344,"line":926},[342,1704,621],{"class":442},[342,1706,446],{"class":358},[342,1708,594],{"class":442},[342,1710,628],{"class":358},[342,1712,631],{"class":442},[342,1714,1715,1718,1720,1723,1726,1728,1731,1733],{"class":344,"line":943},[342,1716,1717],{"class":442},"$summary ",[342,1719,446],{"class":358},[342,1721,1722],{"class":449}," \"",[342,1724,1725],{"class":442},"${MountPoint}",[342,1727,1183],{"class":442},[342,1729,1730],{"class":449}," at ",[342,1732,993],{"class":442},[342,1734,1735],{"class":449},"%.\"\n",[342,1737,1738],{"class":344,"line":959},[342,1739,436],{"emptyLinePlaceholder":435},[342,1741,1742],{"class":344,"line":964},[342,1743,1744],{"class":348},"# Case 1: conversion paused.\n",[342,1746,1747,1749,1751,1753,1755],{"class":344,"line":980},[342,1748,659],{"class":358},[342,1750,969],{"class":442},[342,1752,765],{"class":358},[342,1754,974],{"class":449},[342,1756,977],{"class":442},[342,1758,1759,1762,1764,1767,1770,1772,1775],{"class":344,"line":1004},[342,1760,1761],{"class":442},"    $result ",[342,1763,446],{"class":358},[342,1765,1766],{"class":358}," &",[342,1768,1769],{"class":442}," $manageBde ",[342,1771,517],{"class":358},[342,1773,1774],{"class":442},"resume $MountPoint ",[342,1776,1777],{"class":358},"2>&1\n",[342,1779,1780,1783,1785],{"class":344,"line":1012},[342,1781,1782],{"class":442},"    $code ",[342,1784,446],{"class":358},[342,1786,1787],{"class":355}," $LASTEXITCODE\n",[342,1789,1790,1793,1795,1797,1799],{"class":344,"line":1017},[342,1791,1792],{"class":442},"    $after ",[342,1794,446],{"class":358},[342,1796,508],{"class":355},[342,1798,511],{"class":358},[342,1800,1801],{"class":442},"MountPoint $MountPoint\n",[342,1803,1804,1806,1809,1811,1813],{"class":344,"line":1022},[342,1805,1457],{"class":358},[342,1807,1808],{"class":442}," ($code ",[342,1810,765],{"class":358},[342,1812,1056],{"class":355},[342,1814,977],{"class":442},[342,1816,1817,1820,1822,1824,1826,1829,1832,1834,1836,1839,1841,1844,1846,1848],{"class":344,"line":1079},[342,1818,1819],{"class":355},"        Complete-Remediation",[342,1821,511],{"class":358},[342,1823,1641],{"class":442},[342,1825,1591],{"class":449},[342,1827,1828],{"class":442},"$summary",[342,1830,1831],{"class":449}," manage-bde -resume exit code 0. Status now ",[342,1833,548],{"class":358},[342,1835,551],{"class":449},[342,1837,1838],{"class":442},"$after.VolumeStatus",[342,1840,560],{"class":449},[342,1842,1843],{"class":449},".\"",[342,1845,511],{"class":358},[342,1847,1665],{"class":442},[342,1849,1850],{"class":355},"0\n",[342,1852,1853],{"class":344,"line":1096},[342,1854,1488],{"class":442},[342,1856,1857,1859,1861,1863,1865,1867,1870,1873,1876,1878,1880,1883,1886,1889,1891,1893,1895,1897],{"class":344,"line":1103},[342,1858,1636],{"class":355},[342,1860,511],{"class":358},[342,1862,1641],{"class":442},[342,1864,1591],{"class":449},[342,1866,1828],{"class":442},[342,1868,1869],{"class":449}," manage-bde -resume failed with exit code ",[342,1871,1872],{"class":442},"${code}",[342,1874,1875],{"class":449},": ",[342,1877,548],{"class":358},[342,1879,551],{"class":449},[342,1881,1882],{"class":442},"$result",[342,1884,1885],{"class":358}," -join",[342,1887,1888],{"class":449}," ' '",[342,1890,560],{"class":449},[342,1892,1591],{"class":449},[342,1894,511],{"class":358},[342,1896,1665],{"class":442},[342,1898,1668],{"class":355},[342,1900,1901],{"class":344,"line":1108},[342,1902,578],{"class":442},[342,1904,1905],{"class":344,"line":1113},[342,1906,436],{"emptyLinePlaceholder":435},[342,1908,1909],{"class":344,"line":1134},[342,1910,1911],{"class":348},"# Case 2: fully encrypted but protectors suspended.\n",[342,1913,1914,1916,1918,1920,1922,1924,1926,1928,1930,1932,1934,1936,1938,1940],{"class":344,"line":1155},[342,1915,659],{"class":358},[342,1917,969],{"class":442},[342,1919,765],{"class":358},[342,1921,1031],{"class":449},[342,1923,1034],{"class":358},[342,1925,1037],{"class":442},[342,1927,765],{"class":358},[342,1929,1042],{"class":449},[342,1931,1034],{"class":358},[342,1933,1047],{"class":358},[342,1935,1050],{"class":442},[342,1937,1053],{"class":358},[342,1939,1056],{"class":355},[342,1941,977],{"class":442},[342,1943,1944,1947],{"class":344,"line":1162},[342,1945,1946],{"class":358},"    try",[342,1948,497],{"class":442},[342,1950,1951,1954,1956,1958,1960,1963,1965],{"class":344,"line":1167},[342,1952,1953],{"class":355},"        Resume-BitLocker",[342,1955,511],{"class":358},[342,1957,514],{"class":442},[342,1959,517],{"class":358},[342,1961,1962],{"class":442},"ErrorAction Stop ",[342,1964,693],{"class":358},[342,1966,696],{"class":355},[342,1968,1969,1972,1974,1976,1978],{"class":344,"line":1172},[342,1970,1971],{"class":442},"        $after ",[342,1973,446],{"class":358},[342,1975,508],{"class":355},[342,1977,511],{"class":358},[342,1979,1801],{"class":442},[342,1981,1982,1984,1986,1988,1990,1992,1995,1997,1999,2002,2004,2006,2008,2010],{"class":344,"line":1199},[342,1983,1819],{"class":355},[342,1985,511],{"class":358},[342,1987,1641],{"class":442},[342,1989,1591],{"class":449},[342,1991,1828],{"class":442},[342,1993,1994],{"class":449}," Resume-BitLocker ran. ProtectionStatus now ",[342,1996,548],{"class":358},[342,1998,551],{"class":449},[342,2000,2001],{"class":442},"$after.ProtectionStatus",[342,2003,560],{"class":449},[342,2005,1843],{"class":449},[342,2007,511],{"class":358},[342,2009,1665],{"class":442},[342,2011,1850],{"class":355},[342,2013,2015,2018,2020],{"class":344,"line":2014},68,[342,2016,2017],{"class":442},"    } ",[342,2019,529],{"class":358},[342,2021,497],{"class":442},[342,2023,2025,2027,2029,2031,2033,2035,2038,2040,2042,2044,2046,2048,2050,2052,2054],{"class":344,"line":2024},69,[342,2026,1819],{"class":355},[342,2028,511],{"class":358},[342,2030,1641],{"class":442},[342,2032,1591],{"class":449},[342,2034,1828],{"class":442},[342,2036,2037],{"class":449}," Resume-BitLocker failed: ",[342,2039,548],{"class":358},[342,2041,551],{"class":449},[342,2043,554],{"class":355},[342,2045,557],{"class":442},[342,2047,560],{"class":449},[342,2049,1591],{"class":449},[342,2051,511],{"class":358},[342,2053,1665],{"class":442},[342,2055,1668],{"class":355},[342,2057,2059],{"class":344,"line":2058},70,[342,2060,1488],{"class":442},[342,2062,2064],{"class":344,"line":2063},71,[342,2065,578],{"class":442},[342,2067,2069],{"class":344,"line":2068},72,[342,2070,436],{"emptyLinePlaceholder":435},[342,2072,2074],{"class":344,"line":2073},73,[342,2075,2076],{"class":348},"# Case 3: stalled in progress. Report the evidence instead of guessing at a fix.\n",[342,2078,2080,2082,2084,2086,2088],{"class":344,"line":2079},74,[342,2081,659],{"class":358},[342,2083,969],{"class":442},[342,2085,765],{"class":358},[342,2087,1122],{"class":449},[342,2089,977],{"class":442},[342,2091,2093,2096,2098,2100],{"class":344,"line":2092},75,[342,2094,2095],{"class":442},"    $filter ",[342,2097,446],{"class":358},[342,2099,1047],{"class":358},[342,2101,2102],{"class":442},"{\n",[342,2104,2106,2109,2111],{"class":344,"line":2105},76,[342,2107,2108],{"class":442},"        LogName   ",[342,2110,446],{"class":358},[342,2112,2113],{"class":449}," \"Microsoft-Windows-BitLocker\u002FBitLocker Management\"\n",[342,2115,2117,2120,2122,2125,2127],{"class":344,"line":2116},77,[342,2118,2119],{"class":442},"        Level     ",[342,2121,446],{"class":358},[342,2123,2124],{"class":355}," 2",[342,2126,1445],{"class":358},[342,2128,2129],{"class":355}," 3\n",[342,2131,2133,2136,2138,2140,2142,2145,2148],{"class":344,"line":2132},78,[342,2134,2135],{"class":442},"        StartTime ",[342,2137,446],{"class":358},[342,2139,642],{"class":442},[342,2141,645],{"class":355},[342,2143,2144],{"class":442},").AddDays(",[342,2146,2147],{"class":355},"-7",[342,2149,940],{"class":442},[342,2151,2153],{"class":344,"line":2152},79,[342,2154,1488],{"class":442},[342,2156,2158,2161,2163,2166,2168,2171,2173,2176,2179,2181],{"class":344,"line":2157},80,[342,2159,2160],{"class":442},"    $events ",[342,2162,446],{"class":358},[342,2164,2165],{"class":355}," Get-WinEvent",[342,2167,511],{"class":358},[342,2169,2170],{"class":442},"FilterHashtable $filter ",[342,2172,517],{"class":358},[342,2174,2175],{"class":442},"MaxEvents ",[342,2177,2178],{"class":355},"5",[342,2180,511],{"class":358},[342,2182,732],{"class":442},[342,2184,2186,2189,2191,2194,2197,2200],{"class":344,"line":2185},81,[342,2187,2188],{"class":442},"    $lines ",[342,2190,446],{"class":358},[342,2192,2193],{"class":358}," foreach",[342,2195,2196],{"class":442}," ($logEntry ",[342,2198,2199],{"class":358},"in",[342,2201,2202],{"class":442}," $events) {\n",[342,2204,2206,2209,2211,2214,2217,2219,2222,2225,2228,2230,2233,2235],{"class":344,"line":2205},82,[342,2207,2208],{"class":442},"        $firstLine ",[342,2210,446],{"class":358},[342,2212,2213],{"class":442}," ($logEntry.Message ",[342,2215,2216],{"class":358},"-split",[342,2218,1722],{"class":449},[342,2220,2221],{"class":355},"`r",[342,2223,2224],{"class":449},"?",[342,2226,2227],{"class":355},"`n",[342,2229,1591],{"class":449},[342,2231,2232],{"class":442},")[",[342,2234,1478],{"class":355},[342,2236,2237],{"class":442},"]\n",[342,2239,2241,2244,2247,2250,2252,2255,2257],{"class":344,"line":2240},83,[342,2242,2243],{"class":449},"        \"[{0:yyyy-MM-dd HH:mm}] {1} {2}\"",[342,2245,2246],{"class":358}," -f",[342,2248,2249],{"class":442}," $logEntry.TimeCreated",[342,2251,1445],{"class":358},[342,2253,2254],{"class":442}," $logEntry.Id",[342,2256,1445],{"class":358},[342,2258,2259],{"class":442}," $firstLine\n",[342,2261,2263],{"class":344,"line":2262},84,[342,2264,1488],{"class":442},[342,2266,2268,2270,2272,2274],{"class":344,"line":2267},85,[342,2269,1457],{"class":358},[342,2271,642],{"class":442},[342,2273,664],{"class":358},[342,2275,2276],{"class":442}," $lines) {\n",[342,2278,2280,2283,2285,2287,2289,2292],{"class":344,"line":2279},86,[342,2281,2282],{"class":442},"        $lines ",[342,2284,446],{"class":358},[342,2286,1047],{"class":358},[342,2288,551],{"class":442},[342,2290,2291],{"class":449},"\"No BitLocker-API errors or warnings in the last 7 days.\"",[342,2293,940],{"class":442},[342,2295,2297],{"class":344,"line":2296},87,[342,2298,1488],{"class":442},[342,2300,2302,2304,2306,2308,2310,2312,2315,2317,2320,2322,2324,2327,2329,2332,2334,2336,2338,2340],{"class":344,"line":2301},88,[342,2303,1636],{"class":355},[342,2305,511],{"class":358},[342,2307,1641],{"class":442},[342,2309,1591],{"class":449},[342,2311,1725],{"class":442},[342,2313,2314],{"class":449}," stalled at ",[342,2316,993],{"class":442},[342,2318,2319],{"class":449},"%, no automatic fix. Recent BitLocker-API events: ",[342,2321,548],{"class":358},[342,2323,551],{"class":449},[342,2325,2326],{"class":442},"$lines",[342,2328,1885],{"class":358},[342,2330,2331],{"class":449}," ' | '",[342,2333,560],{"class":449},[342,2335,1591],{"class":449},[342,2337,511],{"class":358},[342,2339,1665],{"class":442},[342,2341,1668],{"class":355},[342,2343,2345],{"class":344,"line":2344},89,[342,2346,578],{"class":442},[342,2348,2350],{"class":344,"line":2349},90,[342,2351,436],{"emptyLinePlaceholder":435},[342,2353,2355],{"class":344,"line":2354},91,[342,2356,2357],{"class":348},"# The state changed between detection and remediation (for example it finished).\n",[342,2359,2361,2364,2366,2368,2370,2372,2375,2377,2379],{"class":344,"line":2360},92,[342,2362,2363],{"class":355},"Complete-Remediation",[342,2365,511],{"class":358},[342,2367,1641],{"class":442},[342,2369,1591],{"class":449},[342,2371,1828],{"class":442},[342,2373,2374],{"class":449}," Nothing to do; state changed since detection.\"",[342,2376,511],{"class":358},[342,2378,1665],{"class":442},[342,2380,1850],{"class":355},[155,2382,2384],{"id":2383},"notes","Notes",[160,2386,2387,2407,2417,2423,2443,2462,2495,2516],{},[163,2388,2389,2392,2393,2395,2396,112,2399,2402,2403,2406],{},[167,2390,2391],{},"Detection has to record state itself."," Intune only runs the remediation when detection exits ",[15,2394,328],{},", so a design where only the Remediate script writes the \"last seen\" values never builds history on a device that looks healthy. Here the Detect script writes ",[15,2397,2398],{},"LastStatus",[15,2400,2401],{},"LastPercent"," and ",[15,2404,2405],{},"LastChangeUtc"," every run. A stall is flagged at the first run after the threshold passes.",[163,2408,2409,2412,2413,2416],{},[167,2410,2411],{},"Output is stable on purpose."," Microsoft's guidance is to keep detection results stable and avoid values that change on every run. The detection line carries the time the state ",[46,2414,2415],{},"last changed",", which stays the same across runs, not an elapsed-minutes counter.",[163,2418,2419,2422],{},[167,2420,2421],{},"Schedule and reporting lag."," The Intune Management Extension retrieves remediation policy at restart, at user sign-in and every 8 hours. For recurring scripts the client reports within the first six days only when the result changes, then every seven days regardless. An hourly schedule catches a stall quickly on the device, but don't expect the admin center report to update every hour.",[163,2424,2425,2428,2429,2432,2433,2435,2436,2438,2439,2442],{},[167,2426,2427],{},"64-bit host."," I set ",[167,2430,2431],{},"Run script in 64-bit PowerShell"," to Yes for this pair, even though Microsoft's generic recommendation for custom packages is No. Both scripts depend on the BitLocker module and ",[15,2434,204],{},", and I'd rather they run in the native host. The remediation also resolves ",[15,2437,204],{}," through ",[15,2440,2441],{},"Sysnative"," if it finds itself in a 32-bit process. Test on a pilot device either way.",[163,2444,2445,30,2448,2451,2452,2455,2456,2458,2459,2461],{},[167,2446,2447],{},"Suspensions that should clear on their own.",[15,2449,2450],{},"Suspend-BitLocker -RebootCount"," suspends protection for 1 to 15 restarts (the default is 1) and BitLocker restores it by itself afterwards; ",[15,2453,2454],{},"-RebootCount 0"," suspends it until someone runs ",[15,2457,40],{},". The ",[15,2460,299],{}," window exists so the remediation only acts on suspensions that have outlived any planned restart. Don't set it shorter than your longest maintenance window.",[163,2463,2464,2467,2468,2471,2472,2475,2476,2479,2480,2482,2483,2486,2487,2490,2491,2494],{},[167,2465,2466],{},"When the remediation reports a stall, read the event IDs."," The BitLocker-API Management log (",[15,2469,2470],{},"Microsoft-Windows-BitLocker\u002FBitLocker Management",") is Microsoft's first stop for Intune BitLocker failures. The names don't line up, which trips people up: Event Viewer shows this log as ",[167,2473,2474],{},"Applications and Services Logs > Microsoft > Windows > BitLocker-API > Management",", but its channel name, the one ",[15,2477,2478],{},"Get-WinEvent -LogName"," needs, is ",[15,2481,2470],{}," (the file on disk is ",[15,2484,2485],{},"Microsoft-Windows-BitLocker%4BitLocker Management.evtx",", with ",[15,2488,2489],{},"%4"," standing in for the slash). Use that channel name, not the Event Viewer label, when you query it. Documented events include 853 (no compatible TPM found, or bootable media detected), 854 (WinRE not configured; check with ",[15,2492,2493],{},"reagentc.exe \u002Finfo","), 851 (contact the manufacturer for BIOS upgrade instructions, typically legacy BIOS instead of UEFI), and 846 with 778 (recovery information backup to Microsoft Entra ID failed and the volume was reverted to unprotected). Events 796 and 845 appear during normal operation. None of those is fixed by rerunning a script. Most of them need firmware, WinRE or policy changes.",[163,2496,2497,2500,2501,2504,2505,2508,2509,2512,2513,194],{},[167,2498,2499],{},"Useful manual checks"," on an escalated device: ",[15,2502,2503],{},"manage-bde -status C:"," for conversion status and protectors, ",[15,2506,2507],{},"manage-bde -protectors -get C:"," to confirm the TPM protector includes PCR 7, ",[15,2510,2511],{},"Get-Tpm"," for TPM readiness, and the policy the device received under ",[15,2514,2515],{},"HKLM\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device\\BitLocker",[163,2517,2518,2521],{},[167,2519,2520],{},"Scripts must be UTF-8."," Upload the files rather than pasting into the browser, don't put reboot commands in either script, and keep output under 2,048 characters. Microsoft documents all three as Remediations requirements.",[155,2523,2525],{"id":2524},"source","Source",[160,2527,2528,2538,2552,2564,2581,2589],{},[163,2529,2530,2537],{},[2531,2532,2536],"a",{"href":2533,"rel":2534},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fintune\u002Fdevice-management\u002Ftools\u002Fdeploy-remediations",[2535],"nofollow","Use Remediations to detect and fix support issues",": script requirements, licensing, schedules, client reporting cycle",[163,2539,2540,112,2544,2402,2548],{},[2531,2541,40],{"href":2542,"rel":2543},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fpowershell\u002Fmodule\u002Fbitlocker\u002Fresume-bitlocker",[2535],[2531,2545,52],{"href":2546,"rel":2547},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fpowershell\u002Fmodule\u002Fbitlocker\u002Fsuspend-bitlocker",[2535],[2531,2549,17],{"href":2550,"rel":2551},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fpowershell\u002Fmodule\u002Fbitlocker\u002Fget-bitlockervolume",[2535],[163,2553,2554,2402,2559],{},[2531,2555,2558],{"href":2556,"rel":2557},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fadministration\u002Fwindows-commands\u002Fmanage-bde-resume",[2535],"manage-bde resume",[2531,2560,2563],{"href":2561,"rel":2562},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fadministration\u002Fwindows-commands\u002Fmanage-bde-status",[2535],"manage-bde status",[163,2565,2566,2402,2571,2576,2577,2402,2579],{},[2531,2567,2570],{"href":2568,"rel":2569},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Fsecprov\u002Fgetconversionstatus-win32-encryptablevolume",[2535],"GetConversionStatus",[2531,2572,2575],{"href":2573,"rel":2574},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Fsecprov\u002Fgetprotectionstatus-win32-encryptablevolume",[2535],"GetProtectionStatus"," (Win32_EncryptableVolume): the status values behind ",[15,2578,91],{},[15,2580,29],{},[163,2582,2583,2588],{},[2531,2584,2587],{"href":2585,"rel":2586},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Ftroubleshoot\u002Fwindows-client\u002Fwindows-security\u002Fenforcing-bitlocker-policies-by-using-intune-known-issues",[2535],"Enforcing BitLocker policies by using Intune: known issues",": event IDs and resolutions",[163,2590,2591,2596],{},[2531,2592,2595],{"href":2593,"rel":2594},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Ftroubleshoot\u002Fmem\u002Fintune\u002Fdevice-protection\u002Ftroubleshoot-bitlocker-policies",[2535],"Troubleshooting BitLocker policies from the client side",": log locations and registry keys",[2598,2599,2600],"style",{},"html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html pre.shiki code .sDLfK, html code.shiki .sDLfK{--shiki-default:#79B8FF}html pre.shiki code .snl16, html code.shiki .snl16{--shiki-default:#F97583}html pre.shiki code .s95oV, html code.shiki .s95oV{--shiki-default:#E1E4E8}html pre.shiki code .sU2Wk, html code.shiki .sU2Wk{--shiki-default:#9ECBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .svObZ, html code.shiki .svObZ{--shiki-default:#B392F0}",{"title":338,"searchDepth":352,"depth":352,"links":2602},[2603,2604,2605,2606,2607,2608],{"id":157,"depth":352,"text":158},{"id":208,"depth":352,"text":209},{"id":313,"depth":352,"text":314},{"id":1277,"depth":352,"text":1278},{"id":2383,"depth":352,"text":2384},{"id":2524,"depth":352,"text":2525},"techcolumnist",[2611,2612],"ps","scripts","2025-09-10T14:00:00Z","An Intune Remediations detect and remediate pair that finds paused, suspended or stalled BitLocker encryption on Windows and fixes the cases that have a documented fix.","md",false,null,{},"\u002Fblog\u002F2025\u002F09\u002F10\u002Fpowershell-intune-remediation-script-for-stuck-bitlocker-encryption",{"title":6,"description":2614},[2609],"blog\u002F2025\u002F09\u002F10\u002Fpowershell-intune-remediation-script-for-stuck-bitlocker-encryption",[337,2624,2625],"intune","windows","\u002F2025\u002F09\u002F10\u002Fpowershell-intune-remediation-script-for-stuck-bitlocker-encryption\u002F","PLdaxCntLKSnCwSgA1OlAEsYgpjeCO9kRTXhhngPwT0",{"title":2629,"description":2630,"date":2631,"url":2632,"categories":2633,"tags":2634,"image":2617,"readingTime":376,"canonical":2609,"sites":2635,"series":2617,"seriesOrder":2617},"PowerShell: Windows Server – Harden RDP Without Breaking Access","A PowerShell script that locks down Windows Server RDP: NLA, TLS-only, session limits, redirection, a firewall allowlist, Restricted Admin support and legacy TLS off.","2025-09-17T14:00:00Z","\u002F2025\u002F09\u002F17\u002Fpowershell-windows-server-harden-rdp-without-breaking-access\u002F",[2611,2612],[337,2625],[2609],{"title":2637,"description":2638,"date":2639,"url":2640,"categories":2641,"tags":2642,"image":2617,"readingTime":376,"canonical":2609,"sites":2645,"series":2617,"seriesOrder":2617},"PowerShell: Exchange Online – Report Mailboxes Approaching Their Quota","Flag Exchange Online mailboxes above a percentage of their ProhibitSendQuota, plus Recoverable Items pressure, using the EXO V3 Get-EXO cmdlets.","2025-09-03T14:00:00Z","\u002F2025\u002F09\u002F03\u002Fpowershell-exchange-online-report-mailboxes-approaching-their-quota\u002F",[2611,2612],[337,2643,2644],"exchange-online","reporting",[2609],[2647,2655,2666],{"title":2648,"description":2649,"date":2650,"url":2651,"categories":2652,"tags":2653,"image":2617,"readingTime":368,"canonical":2609,"sites":2654,"series":2617,"seriesOrder":2617},"PowerShell: Windows Server – Disable SMBv1 Fleet-Wide and Verify","A script that audits SMBv1 access (event 3000), disables the SMBv1 server and optional feature across Windows servers, and reports which ones still need a restart.","2025-11-26T14:00:00Z","\u002F2025\u002F11\u002F26\u002Fpowershell-windows-server-disable-smbv1-fleet-wide-and-verify-it-stuck\u002F",[2611,2612],[337,2625],[2609],{"title":2656,"description":2657,"date":2658,"url":2659,"categories":2660,"tags":2661,"image":2617,"readingTime":376,"canonical":2609,"sites":2665,"series":2617,"seriesOrder":2617},"PowerShell: Windows 11 – Strip Preinstalled Apps from an Image","A PowerShell script that removes provisioned apps from a mounted Windows 11 WIM or a running system, plus the Windows 11 24H2+ policy that does it natively.","2025-11-05T14:00:00Z","\u002F2025\u002F11\u002F05\u002Fpowershell-windows-11-strip-preinstalled-apps-from-a-deployment-image\u002F",[2611,2612],[337,2662,2663,2664,2624],"windows-11","debloat","gpo",[2609],{"title":2667,"description":2668,"date":2669,"url":2670,"categories":2671,"tags":2672,"image":2617,"readingTime":362,"canonical":2609,"sites":2673,"series":2617,"seriesOrder":2617},"PowerShell: Intune – Force Compliance Re-Evaluation Fleet-Wide","A Microsoft Graph PowerShell script that sends the syncDevice action to every matching Intune-managed device, throttled, so compliance is re-evaluated at once.","2025-10-22T14:00:00Z","\u002F2025\u002F10\u002F22\u002Fpowershell-intune-force-a-compliance-policy-re-evaluation-fleet-wide\u002F",[2611,2612],[337,2624],[2609],{"doc":2617,"posts":2675},[],1790052513175]