REVIEWED by Sophos
A query that will return the BitLocker status of an Endpoint
SELECT device_id,drive_letter,percentage_encrypted, encryption_method, version, persistent_volume_id, CASE conversion_status WHEN 1 THEN 'Fully Encrypted' WHEN 2 THEN 'Encryption In Progress' WHEN 3 THEN 'Decryption In Progress' WHEN 4 THEN 'Encryption Paused' WHEN 5 THEN 'Decryption Paused' ELSE 'Fully Decrypted' END conversion_status, CASE protection_status WHEN 0 THEN 'Protection Off' WHEN 1 THEN 'Protection On' ELSE 'Unknown' END protection_status, CASE lock_status WHEN 0 THEN 'Unlocked' WHEN 1 THEN 'Locked' END lock_statusFROM bitlocker_info;