Ensuring BitLocker Key Backup for Workplace-Joined Devices and Beyond

<#
.SYNOPSIS
    Backs up BitLocker RecoveryPassword key protectors to Azure AD using user-level certificates.

.DESCRIPTION
    This script reads a file containing unbacked BitLocker RecoveryPassword key protectors generated by another script. 
    It attempts to back up these protectors to Azure AD using the Invoke-WebRequest cmdlet, authenticated with a user certificate.
    This approach addresses the challenge of backing up BitLocker keys for workplace-joined devices where users do not have local admin rights.
    It uses a custom log file to track the backup status to avoid redundant backups.

.AUTHOR
    John Marcum (PJM)
    @MEM_MVP

.LEGAL DISCLAIMER
    This script is provided "as is" without any warranty or guarantee of any kind. The author is not liable for any damages or issues 
    that arise from using this script. It is the user's responsibility to ensure that the script is suitable for their environment 
    and that it does not interfere with other processes or security policies.

.PARAMETER None
    This script does not require any parameters.

.EXAMPLE
    .\Backup-RecoveryPasswords.ps1
    Runs the script to back up BitLocker key protectors to Azure AD.

.NOTES
    The script should be run as the logged-in user who has access to the necessary certificates. 
    It processes the file generated by the preceding script to back up identified key protectors.

#>

# Start Logging
$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
$LogPath = "C:\Temp\Backup_BitLocker_Keys_$timestamp.log"
Start-Transcript -Path $LogPath

# Set the security protocol to TLS 1.2
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

# Define the file path where the KeyProtectorIds and RecoveryPasswords are stored and the log for history to prevent redundant backups.
$filePath = 'C:\Temp\RecoveryPasswords.txt'
$customLogFilePath = "C:\Temp\Backup_Log.txt"

# Function to log messages to a custom log file
function Log-Message {
    param (
        [string]$message
    )
    Add-Content -Path $customLogFilePath -Value $message
}

# Check if the file exists
if (Test-Path $filePath) {

    # Initialize an array to hold the KeyProtectorId and RecoveryPassword pairs
    $keyProtectorArray = @()
    # Read each line from the file
    $fileContent = Get-Content -Path $filePath

    # Iterate through each line
    foreach ($line in $fileContent) {
        # Use a regular expression to extract KeyProtectorId and RecoveryPassword
        if ($line -match 'KeyProtectorId: (\S+), RecoveryPassword: (\S+)') {
            # Create a custom object for each pair
            $pair = [PSCustomObject]@{
                KeyProtectorId   = $matches[1]
                RecoveryPassword = $matches[2]
            }

            # Add the object to the array
            $keyProtectorArray += $pair
        }
    }

    # Output the array to verify the contents
    $keyProtectorArray

    if ($keyProtectorArray) {
        Write-Host 'We found keys to backup' 

        # Get the device details from dsregcmd /status
        $DsregCmdStatus = dsregcmd /status

        $DeviceId = $null
        $WorkplaceDeviceId = $null
        $TenantId = $null
        $WorkplaceTenantId = $null

        # Split the output into lines
        $lines = $DsregCmdStatus -split "`r?`n"

        # Loop through each line to find DeviceId, WorkplaceDeviceId, TenantId, and WorkplaceTenantId
        foreach ($line in $lines) {
            if ($line -match '^\s*DeviceId\s*:\s*([a-f0-9-]{36})\s*$') {
                $DeviceId = $matches[1]
                Write-Host "Found DeviceId: $DeviceId"
            }
            if ($line -match '^\s*WorkplaceDeviceId\s*:\s*([a-f0-9-]{36})\s*$') {
                $WorkplaceDeviceId = $matches[1]
                Write-Host "Found WorkplaceDeviceId: $WorkplaceDeviceId"
            }
            if ($line -match '^\s*TenantId\s*:\s*([a-f0-9-]{36})\s*$') {
                $TenantId = $matches[1]
                Write-Host "Found TenantId: $TenantId"
            }
            if ($line -match '^\s*WorkplaceTenantId\s*:\s*([a-f0-9-]{36})\s*$') {
                $WorkplaceTenantId = $matches[1]
                Write-Host "Found WorkplaceTenantId: $WorkplaceTenantId"
            }
        }

        # Ensure we have at least one tenant ID to proceed
        if (-not $TenantId -and -not $WorkplaceTenantId) {
            Write-Output 'No valid Tenant IDs found'
            Stop-Transcript
            Exit 1
        }

        # Get the certs that match the device ID or workplace device ID
        $certs = Get-ChildItem -Path cert:CurrentUser\My -Recurse | Where-Object {
            $_.Subject -match "CN=$DeviceId" -or $_.Subject -match "CN=$WorkplaceDeviceId"
        }

        if ($certs.Count -eq 0) {
            Write-Host "No valid certificates found matching the DeviceId or WorkplaceDeviceId."
            Stop-Transcript
            Exit 1
        }

        # Initialize success flag and error log
        $allSuccessful = $true
        $errorLog = @()

        # Attempt backup based on matching certificate
        foreach ($cert in $certs) {
            # Extract the subject name from the certificate
            $certSubject = $cert.Subject -replace "^CN=", "" # Remove the 'CN=' prefix if present
            Write-Output "Checking certificate with subject: $certSubject"

            # Determine the appropriate tenant and device based on the certificate subject
            if ($certSubject -eq $DeviceId) {
                $currentId = $DeviceId
                $currentTenant = $TenantId
            }
            elseif ($certSubject -eq $WorkplaceDeviceId) {
                $currentId = $WorkplaceDeviceId
                $currentTenant = $WorkplaceTenantId
            }
            else {
                Write-Host "No matching DeviceId or WorkplaceDeviceId for certificate subject: $certSubject"
                continue
            }

            foreach ($protector in $keyProtectorArray) {
                $body = @{
                    key = $protector.RecoveryPassword
                    kid = $protector.KeyProtectorId -replace '[{}]', ''
                    vol = "OSV"
                } | ConvertTo-Json

                # URL to send the post to
                $url = "https://enterpriseregistration.windows.net/manage/$currentTenant/device/$($certSubject)?api-version=1.0"

                try {
                    # Send the recovery information using Invoke-WebRequest
                    Write-Host "Sending data to: $($url)"
                    Write-Host "Using Cert: $($cert)"
                    Write-Host "With body: $($body)"
                    $req = Invoke-WebRequest -Uri $url -Body $body -UseBasicParsing -Method Post -Certificate $cert
                    Write-Host "Request return status: $($req.StatusCode)"

                    if ($req.StatusCode -eq 200) {
                        $successMessage = "Backup successful for protector ID: $($protector.KeyProtectorId)"
                        Write-Output $successMessage
                        Log-Message $successMessage
                    }
                    else {
                        $failureMessage = "Backup failed for protector ID: $($protector.KeyProtectorId). HTTP status code: $($req.StatusCode)"
                        Write-Output $failureMessage
                        $allSuccessful = $false
                        $errorLog += @{
                            URL   = $url
                            Error = "HTTP status code: $($req.StatusCode)"
                        }
                        Log-Message $failureMessage
                    }
                }
                catch {
                    $errorMessage = "Failed to post recovery information for protector ID: $($protector.KeyProtectorId). Error: $_"
                    Write-Output $errorMessage
                    $allSuccessful = $false
                    $errorLog += @{
                        URL   = $url
                        Error = $_.Exception.Message
                    }
                    Log-Message $errorMessage
                }
            }
        }

        # Only delete the file if all requests were successful
        if ($allSuccessful) {
            Write-Host "All backups were successful. Deleting the file."
            Remove-Item $filePath -Force
            Stop-Transcript
            Exit 0
        }
        else {
            Write-Host "Not all backups were successful. Retaining the file for further inspection."
            Write-Host "Failed backups details:"
            foreach ($errorDetail in $errorLog) {
                Write-Host "URL: $($errorDetail.URL)"
                Write-Host "Error: $($errorDetail.Error)"
            }
            Stop-Transcript
            Exit 1
        }       
    }
    else {
        Write-Host "No key protectors found in the file"
        Stop-Transcript
        Exit 0
    }
}
else {
    Write-Host "File not found: $filePath"
    Stop-Transcript
    Exit 0
}