Bitlocker Relevance Results on a single line

Content Authoring
1

How can I output the separate Bitlocker relevance results below into a single line?

Here’s the relevance results ran separately:

q: (string values of selects ("DriveLetter from win32_EncryptableVolume") of WMIs "root\CIMv2\Security\MicrosoftVolumeEncryption")
A: C:
A: D:
A: F:
T: 110.096 ms
I: plural string

q: (tuple string items (integer values of selects ("ProtectionStatus from win32_EncryptableVolume") of WMIs "root\CIMv2\Security\MicrosoftVolumeEncryption") of "Protection Off, Protection On, Protection Unknown")
A: Protection On
A: Protection On
A: Protection Off
T: 86.240 ms
I: plural string

q: (tuple string items (integer values of selects ("* from win32_EncryptableVolume") whose(name of it = "ConversionStatus") of WMIs "root\CIMv2\Security\MicrosoftVolumeEncryption") of "Fully Decrypted, Fully Encrypted, Encryption In Progress, Decryption In Progress, Encryption Paused, Decryption Paused")
A: Fully Encrypted
A: Fully Encrypted
A: Fully Decrypted
T: 66.040 ms
I: plural string

q: (tuple string items (integer values of selects ("* from win32_EncryptableVolume") whose(name of it = "EncryptionMethod") of WMIs "root\CIMv2\Security\MicrosoftVolumeEncryption") of "None, AES 128 With Diffuser, AES 256 With Diffuser, AES 128, AES 256, Hardware Encryption, XTS AES 128, XTS AES 256")
A: XTS AES 256
A: XTS AES 256
A: None
T: 44.346 ms
I: plural string

And, I’d like to put it all together into a single relevance statement with results in a single line format (comma separated) like this:

A: C:, Protection On, Fully Encrypted, XTS AES 256
A: D:, Protection On, Fully Encrypted, XTS AES 256
A: F:, Protection Off, Fully Decrypted, None

Is this possible?

2

Yes, is possible. This should help Multiple Results of WMI with error handling

3

Thanks Jason. I’m working through the link you shared, but I’m not sure that’ll get me there. I’m trying to actually use the tuple results to show the literal answer of the number value in those properties.

For example.

I can string the straight property values:

q: integer values of selects ("ProtectionStatus from win32_EncryptableVolume") of WMIs "root\CIMv2\Security\MicrosoftVolumeEncryption"
A: 1
A: 1
A: 0
T: 46.735 ms
I: plural integer

But I’m looking to string together the tuple results to present the meaning of that number value in the property, not the number itself.

q: tuple string items (integer values of selects ("ProtectionStatus from win32_EncryptableVolume") of WMIs "root\CIMv2\Security\MicrosoftVolumeEncryption") of "Protection Off, Protection On, Protection Unknown"
A: Protection On
A: Protection On
A: Protection Off
T: 23.629 ms
I: plural string

Forgive my ignorance but I am still reading your link to see how it fits. But when I put the tuple statements into the QnA I get the good ole tuple matrix of results, not a singular line for each hard drive.

This is what happens with tuples involved.

q: (string values of selects ("DriveLetter from win32_EncryptableVolume") of WMIs "root\CIMv2\Security\MicrosoftVolumeEncryption"), (tuple string items (integer values of selects ("ProtectionStatus from win32_EncryptableVolume") of WMIs "root\CIMv2\Security\MicrosoftVolumeEncryption") of "Protection Off, Protection On, Protection Unknown")
A: C:, Protection On
A: C:, Protection On
A: C:, Protection Off
A: D:, Protection On
A: D:, Protection On
A: D:, Protection Off
A: F:, Protection On
A: F:, Protection On
A: F:, Protection Off
T: 91.393 ms
I: plural ( string, string )
4

I’m afraid I won’t be able to test anything soon, but the key is to use the select objects "query" of wmi inspector instead of selects "string" of wmi.
That’s the only way I know to retrieve multiple properties as a single result from WMI. Otherwise you get these cross-products of “every drive letter” applied to “every protection status”.

You won’t be able to use ‘tuple string items’ this way, but you should be able to do something like

(string value of property "DriveLetter" of it, (if it=0 then "Off" else if it=1 then "On") of integer value of property "ProtectionStatus" of it) of select objects "DriveLetter, ProtectionStatus from win32_EncryptableVolume" of WMIs "root\CIMv2\Security\MicrosoftVolumeEncryption"

5

Thanks again Jason for the ideas. I think you got me down the proper path.

This is what I came up with:

q: ((item 0 of it),(if item 1 of it="0" then "SYSTEM" else if item 1 of it="1" then "FIXED DISK" else if item 1 of it="2" then "REMOVABLE" else "No Value"), (if item 2 of it ="0" then "Protection Off" else if item 2 of it ="1" then "Protection On" else if item 2 of it ="2" then "Protection Unknown" else "no value"), (if item 3 of it ="0" then "Fully Decrypted" else if item 3 of it ="1" then "Fully Encrypted" else if item 3 of it ="2" then "Encryption in  Progress" else if item 3 of it ="3" then "Decryption in Progress" else if item 3 of it ="4" then "Encryption Paused" else if item 3 of it ="5" then "Decryption Paused" else "no value"), (if item 4 of it ="0" then "Not Encrypted" else if item 4 of it ="1" then "AES 128 with Diffuser" else if item 4 of it ="2" then "AES 256 with Diffuser" else if item 4 of it ="3" then "AES 128" else if item 4 of it ="4" then "AES 256" else if item 4 of it ="5" then "Hardware Encryption" else if item 4 of it ="6" then "XTS-AES 128" else if item 4 of it ="7" then "XTS-AES 256" else "no value")) of (string values of properties "DriveLetter" of it, string value of properties "VolumeType" of it, string value of properties "ProtectionStatus" of it, string value of properties "ConversionStatus" of it, string value of properties "EncryptionMethod" of it) of select objects "DriveLetter,VolumeType,ProtectionStatus,ConversionStatus,EncryptionMethod from win32_EncryptableVolume" of wmis "root\CIMv2\Security\MicrosoftVolumeEncryption"
    A: C:, SYSTEM, Protection On, Fully Encrypted, XTS-AES 256
    A: D:, FIXED DISK, Protection On, Fully Encrypted, XTS-AES 256
    A: F:, REMOVABLE, Protection Off, Fully Decrypted, Not Encrypted
    T: 33.515 ms
    I: plural ( string, string, string, string, string )

I’m still open to ideas if this can be condense in any way.

2 Likes