feat: windows bitlocker check (#120)

* feat: windows bitlocker check

* Drive letter change

* Shorten description

cmd/checks_windows.go

@@ -169,6 +169,18 @@ func processCheck(check *check, checkType, arg1, arg2, arg3 string) bool {
 		}
 		result, err := serviceStatus(arg1, arg2, arg3)
 		return err == nil && !result
+	case "BitlockerEnabled":
+		if check.Message == "" {
+			check.Message = "Bitlocker drive encryption has been enabled"
+		}
+		result, err := bitlockerEnabled()
+		return err == nil && result
+	case "BitlockerEnabledNot":
+		if check.Message == "" {
+			check.Message = "Bitlocker drive encryption has been disabled"
+		}
+		result, err := bitlockerEnabled()
+		return err == nil && !result
 	default:
 		failPrint("No check type " + checkType)
 	}
@@ -306,6 +318,18 @@ func firewallUp() (bool, error) {
 	return true, nil
 }
 
+func bitlockerEnabled() (bool, error) {
+	const FULLY_ENCRYPTED = 1
+	const ENCRYPTION_IN_PROGRESS = 2
+	status, err := wapi.GetBitLockerConversionStatusForDrive("C:")
+	if err == nil {
+		if status.ConversionStatus == FULLY_ENCRYPTED || status.ConversionStatus == ENCRYPTION_IN_PROGRESS {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
 func userDetail(userName, detailName, detailValue string) (bool, error) {
 	detailValue = strings.TrimSpace(detailValue)
 	lookingFor := false

docs/checks.md

@@ -185,6 +185,13 @@ arg2='644'
 
 ### Windows-Specific Checks
 
+**BitlockerEnabled**: pass if a drive has been fully encrypted with bitlocker drive encription or is in the process of being encrypted
+
+```
+type="BitlockerEnabled"
+```
+> This check will succeed if the drive is either encrypted or encryption is in progress.
+
 **ServiceStatus**: pass if service status and service startup type is the same as specified
 
 ```

docs/examples/windows-allchecks.conf

@@ -218,3 +218,12 @@ arg2='87'
 type='ProgramVersionNot'
 arg1='Firefox'
 arg2='87'
+
+[[check]]
+[[check.pass]]
+type='BitlockerEnabled'
+
+
+[[check]]
+[[check.pass]]
+type='BitlockerEnabledNot'