fall back to minimum COM interface provided by 2008R2
import logging
-
import pythoncom # pylint: disable=import-error
import wmi # pylint: disable=import-error
@@ -13,19 +12,9 @@ def run(_, output):
# if the bitlocker drive encryption feature is not installed then the attempt
# to connect to the COM Object will raise an exception
+ mve = None
try:
- # BDE is installed
mve = wmi.WMI(moniker="//./root/cimv2/security/microsoftvolumeencryption")
- encryptable_volume_list = mve.Win32_EncryptableVolume()
- for encryptable_volume in encryptable_volume_list:
- drive = encryptable_volume.DriveLetter
- bde_enabled = 0
- bde_locked = 0
- if encryptable_volume.IsVolumeInitializedForProtection:
- bde_enabled = 1
- bde_locked = 1 if (encryptable_volume.ProtectionStatus == 2) else 0
- output.send_gauge("bitlocker_drive_encryption.enabled", bde_enabled, {"volume": drive})
- output.send_gauge("bitlocker_drive_encryption.locked", bde_locked, {"volume": drive})
except Exception as e: # pylint: disable=broad-except
# BDE is not installed, report enabled = 0, locked = 0 for all drives
logger.error("Error connecting to Bitlocker feature, assuming not installed: %s", e)
@@ -35,3 +24,14 @@ def run(_, output):
drive = logical_disk.DeviceID
output.send_gauge("bitlocker_drive_encryption.enabled", 0, {"volume": drive})
output.send_gauge("bitlocker_drive_encryption.locked", 0, {"volume": drive})
+ return
+ encryptable_volume_list = mve.Win32_EncryptableVolume()
+ for encryptable_volume in encryptable_volume_list:
+ drive = encryptable_volume.DriveLetter
+ bde_enabled = 0
+ bde_locked = 0
+ if encryptable_volume.ProtectionStatus > 0:
+ bde_enabled = 1
+ bde_locked = 1 if (encryptable_volume.ProtectionStatus == 2) else 0
+ output.send_gauge("bitlocker_drive_encryption.enabled", bde_enabled, {"volume": drive})
+ output.send_gauge("bitlocker_drive_encryption.locked", bde_locked, {"volume": drive})
