WPF BitLocker PIN prompt using Intune Remediation Script

Microsoft does not support users to set the BitLocker PIN without them being a local administrator. To overcome this I have created a script utilizing WPF to prompt the user running in SYSTEM context as an Remediation Script. Initially this project was created as a Win32 app in Endpoint Admin. The script has now been aligned to work as a Remediation Script running in 64-bit PowerShell.

Initial prompt
When clicking hint a description is available for the end users to read, potentially preventing a support ticket 😉
PIN Config Guidlines are dynamic based on the configuration applied to the endpoint (this also inherits to the PIN input boxes requirements).
Error message if something goes wrong.

Link to the repo:
BitLocker PIN prompt

The solution serves these purposes:

  1. Resuming BitLocker if suspended and suspend count is 0.
  2. Remove the Tpm key protector if both Tpm and TpmPin key protector is present.
  3. Allowing for users to set a PIN.

Detection Script (Invoke-TestBitLockerPIN.ps1)

Default log location ($Global:LogLocation\$Global:LogName):
$env:ProgramData\Microsoft\IntuneManagementExtension\Logs\Invoke-TestBitlockerPIN.log

The detection script is designed to exit with error code 0 if any of the following conditions are met:

  • The device is currently in OOBE (Out-Of-Box Experience).
  • No interactive user session is present.
  • BitLocker PIN key protector already set.
  • A BitLocker PIN prompt is already running.
  • The system is not configured to require a BitLocker PIN, as determined by the following registry settings:
    • HKLM:\SOFTWARE\Policies\Microsoft\FVE
      • UseTPMPIN
      • UseTPM

The detection script designed to exit with error code 1 if any of the following conditions are met after the success steps:

  • BitLocker is suspended and suspend count is 0.
  • KeyProtector Tpm and TpmPin is present (this would resolve in no Pre-Boot authentication screen)
  • BitLocker PIN key protector is not set.

Remediation Script (Invoke-SetBitLockerPINPrompt.ps1)

Default log location ($Global:LogLocation\$Global:LogName):
$env:ProgramData\Microsoft\IntuneManagementExtension\Logs\Invoke-SetBitLockerPINPrompt.log

This script will detect when running as system and re-run itself enabling an interactive system session. This is not something that comes with Intune out of the box.

In general the script will do as follows:

  1. Should BitLocker be resumed?
    • Yes
      • Resume BitLocker and proceed.
    • No.
      • Proceed.
  2. Is there a Tpm and TpmPin key present?
    • Yes
      • Remove the Tpm key protector and proceed.
    • No
      • Proceed.
  3. Is the prompt already running? (HKEY_LOCAL_MACHINE\SOFTWARE\EndpointAdmin\BitlockerPin\PID / $($RegistryKeyPath)\PID).
    • Yes.
      • Exit script.
    • No
      • Proceed.
  4. Is the the current runtime running as system and in interactive mode?
    • No.
      • Re-run script with interactive switch
    • Yes.
      • Show WPF prompt.

Run as Win32 application

A user requested the ability to run this as a Win32 application. To do this move the Invoke-SetBitLockerPINPrompt.ps1 file to the Win32\Toolkit\Files folder before encrypting the Win32\Toolkit folder with the Win32 prep tool. The Win32 metadata is available in the Win32\Configuration.xml file.
The detection works a little differently with a Win32 application, therefore use the Win32\Detect-Application.ps1 instead of the Invoke-SetBitLockerPINPrompt.ps1.

Customizing WPF behaviour

Custom banner can be utilized when placing a 250×50 px. PNG in the following location:
$env:ProgramData\EndpointAdmin\InstallationBanner\AppDeployToolkitBanner.png

To enable or disable the users ability to close the window using CTRL+F4. Change the default parameter value of $CancelClosingWindow to either $true = disabled, $false = enabled. (Invoke-SetBitLockerPINPrompt.ps1)

I hope this becomes handy for you and let me know of any suggestions improve the scripts.

Leave a comment