Solutions
Device management
Remotely manage, and protect laptops and mobile devices.
Orchestration
Automate tasks across devices, from app installs to scripts.
Software management
Inventory, patch, and manage installed software.
Extend Fleet
Integrate your favorite tools with Fleet.
Customers
Stripe + Fleet
Stripe consolidates multiple tools with Fleet.
Foursquare + Fleet
Foursquare quickly migrates to Fleet for device management.
What people are saying
Stories from the Fleet community.
Pricing
More
Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
bitlocker_info
bitlocker_info
Retrieve bitlocker status of the machine.
| Column | Type | Description |
|---|---|---|
| conversion_status | integer | The bitlocker conversion status of the drive. |
| device_id | text | ID of the encrypted drive. |
| drive_letter | text | Drive letter of the encrypted drive. |
| encryption_method | text | The encryption type of the device. |
| lock_status | integer | The accessibility status of the drive from Windows. |
| percentage_encrypted | integer | The percentage of the drive that is encrypted. |
| persistent_volume_id | text | Persistent ID of the drive. |
| protection_status | integer | The bitlocker protection status of the drive. |
| version | integer | The FVE metadata version of the drive. |
Example
Full Disk Encryption (FDE) reduces the risk of compromise when a device is lost or stolen. This query lists any system that does not have BitLocker enabled on its OS drive (typically C:).
SELECT * FROM bitlocker_info WHERE drive_letter='C:' AND protection_status != 1;Notes
protection_statusis quite nuanced - from the Microsoft documentation:
protection_status = 0
For an Internal HD: The volume is unencrypted, partially encrypted, or the volume's encryption key is available in the clear on the hard disk.
For an External HD: The band for the volume is perpetually unlocked, has no key manager, or is managed by a third party key manager. This can also mean that the band is managed by BitLocker but the DisableKeyProtectors method has been called and the drive is suspended.
protection_status = 1
For an Internal HD: The volume is fully encrypted and the encryption key for the volume is not available in the clear on the hard disk.
For an External HD: BitLocker is the key manager for the band. The drive can be locked or unlocked but cannot be perpetually unlocked.
protection_status = 2
The volume protection status cannot be determined. This can be caused by the volume being in a locked state.
Questions?
SOC2 Type 2
