BitLocker Discovery programmatically from C # without admin

Question

From different threads, I put together how to test BitLocker programmatically as follows:

private void TestBitLockerMenuItem_Click(object sender, RoutedEventArgs e) { var path=new ManagementPath(@"\ROOT\CIMV2\Security\MicrosoftVolumeEncryption") { ClassName="Win32_EncryptableVolume" }; var scope=new ManagementScope(path); path.Server=Environment.MachineName; var objectSearcher=new ManagementClass(scope, path, new ObjectGetOptions()); foreach (var item in objectSearcher.GetInstances()) { MessageBox.Show(item["DeviceID"].ToString()+" "+item["ProtectionStatus"].ToString()); } } 

But it only works if the process has administrator privileges.

It seems strange that any old Windows user can go to Explorer, right-click on the disk and find out if it was turned on by BitLocker, but the program seems to be unable to do this. Does anyone know a way to do this?

Answer 1

Windows displays this in a shell using the Windows Property System in the Win32 API to check the property of the undocumented shell System.Volume.BitLockerProtection . Your program will also be able to verify this property without promotion.

If the value of this property is 1, 3, or 5, BitLocker is enabled on disk. Any other value is considered off.

While searching for a solution to this problem, I found links to this shell property in HKEY_CLASSES_ROOT\Drive\shell\manage-bde\AppliesTo . Ultimately, this discovery led me to this decision.

The Windows Property System is a low-level API, but you can use the wrapper available in the Windows API Code Package .

Package

 Install-Package WindowsAPICodePack 

Using

 using Microsoft.WindowsAPICodePack.Shell; using Microsoft.WindowsAPICodePack.Shell.PropertySystem; 

the code

 IShellProperty prop = ShellObject.FromParsingName("C:").Properties.GetProperty("System.Volume.BitLockerProtection"); int? bitLockerProtectionStatus = (prop as ShellProperty<int?>).Value; if (bitLockerProtectionStatus.HasValue && (bitLockerProtectionStatus == 1 || bitLockerProtectionStatus == 3 || bitLockerProtectionStatus == 5)) Console.WriteLine("ON"); else Console.WriteLine("OFF");