Win32_EncryptableVolume class

The Win32_EncryptableVolume WMI provider class represents an area of storage on a hard disk that can be protected by using BitLocker Drive Encryption. Only NTFS volumes can be encrypted. It can be a volume that contains an operating system, or it can be a data volume on the local disk. It cannot be a network drive.

To realize the benefits of BitLocker, you must specify a protection method for the volume's encryption key and then fully encrypt the volume.

To protect the volume's encryption key, add key protectors by using these methods:

• ProtectKeyWithCertificateFile
• ProtectKeyWithCertificateThumbprint
• ProtectKeyWithExternalKey
• ProtectKeyWithNumericalPassword
• ProtectKeyWithPassphrase
• ProtectKeyWithTPM
• ProtectKeyWithTPMAndPIN
• ProtectKeyWithTPMAndPINAndStartupKey
• ProtectKeyWithTPMAndStartupKey

Each type of key protector provides a different authentication experience for unlocking access to the encrypted data. External keys and numerical passwords can provide authentication during recovery scenarios. For TPM-based key protectors, you may first need to properly initialize the TPM. For more information, see the Win32_Tpm WMI provider class.

Use the Encrypt or EncryptAfterHardwareTest method to begin encryption. Key protectors must be added prior to starting the encryption, or else you must use the DisableKeyProtectors method to expose an unprotected clear key. If the computer turns off while encryption is in progress, encryption will automatically resume when the computer restarts.

You can use the GetConversionStatus and GetProtectionStatus methods to check on the status of an accessible volume.

Syntax

class Win32_EncryptableVolume
{
  string DeviceID;
  string PersistentVolumeID;
  string DriveLetter;
  uint32 ProtectionStatus;
};

Members

The Win32_EncryptableVolume class has these types of members:

• Methods
• Properties

Methods

The Win32_EncryptableVolume class has these methods.

Properties

The Win32_EncryptableVolume class has these properties.

ConversionStatus

Data type: uint32

Access type: Read-only

An integer corresponding to the encryption state of the volume. This value is stored when class is instantiated. It is possible for the conversion status to change state between instantiation and when you check the value. To check the value of the ConversionStatus property in real time, use the GetConversionStatus method.

DeviceID

Data type: string

Access type: Read-only

Qualifiers: Key

A unique identifier for the volume on this system. Use this to associate a volume with other WMI provider classes, for example, Win32_Volume.

DriveLetter

Data type: string

Access type: Read-only

The drive letter of the volume. This identifier can be used to associate a volume with other WMI provider classes, for example Win32_Volume.

For volumes without drive letters, this value is NULL.

EncryptionMethod

Data type: uint32

Access type: Read-only

An integer identifying the algorithm used to encrypt the volume.

IsVolumeInitializedForProtection

Data type: bool

Access type: Read-only

States whether the volume is in a state ready for encryption to start. At least one key protector must be added before this will be True and encryption can begin.

PersistentVolumeID

Data type: string

Access type: Read-only

A persistent identifier for the volume on this system. This identifier is exclusive to Win32_EncryptableVolume.

This identifier is an empty string if the volume is a standard fully decrypted NTFS volume; otherwise, it has a unique value.

ProtectionStatus

Data type: uint32

Access type: Read-only

The status of the volume, whether or not BitLocker is protecting the volume. This value is stored when the class is instantiated. It is possible for the protection status to change state between instantiation and when you check the value. To check the value of the ProtectionStatus property in real time, use the GetProtectionStatus method.

VolumeType

Data type: uint32

Access type: Read-only

An integer identifying the type of volume relevant to encryption for use of appropriate key protectors and encryption methods.

Security Considerations

The Win32_EncryptableVolume WMI provider class relies on the WMI namespace security and on the BitLocker Drive Encryption subsystem for access control.

To use the Win32_EncryptableVolume methods, the following conditions must be met:

• You must have administrator privileges.

• Connection encryption must be able to connect to the provider.

  For more information about creating an encrypted connection, see Requiring an Encrypted Connection to a Namespace.

To enable remote connections, remote WMI traffic must be allowed. For more information about enabling WMI traffic, see Connecting to WMI Remotely Starting with Vista.

The default namespace security setting includes an entry to allow editing by default. For more information about WMI namespace auditing, see Access to WMI Namespaces.

Remarks

Managed Object Format (MOF) files contain the definitions for Windows Management Instrumentation (WMI) classes. MOF files are not installed as part of the Windows SDK. They are installed on the server when you add the associated role by using the Server Manager. For more information about MOF files, see Managed Object Format (MOF).

Requirements