Powershell – How to input password to manage-bde -pw option via windows powershell

This is a bit of an old topic, but all of the answers are more round-about than this.

Import-Module .\Common.ps1 -Force
# Now you can call common functions locally

$commonFunctions = (Get-Command .\Common.ps1).ScriptContents
Invoke-Command -Session $session -ArgumentList $commonFunctions -ScriptBlock {
    param($commonFunctions)
    Invoke-Expression $commonFunctions

    # Now you can call common functions on the remote computer
}

It looks like all Amazon is doing is storing the Bitlocker keys in DPAPI in the SYSTEM context. While this is much less secure than storing the keys in a TPM (because the plaintext key can be retrieved by any service running as SYSTEM versus a key stored in a TPM which cannot be recovered) if the TPM isn't exposed to the virtual machine this is probably your only option.

To accomplish something similar to what they're describing I'd probably use the ConvertFrom-SecureString and complimentary ConvertTo-SecureString PowerShell APIs. Per the Microsoft docs the ConvertFrom-SecureString cmdlet uses DPAPI if no static key is specified. Run the script in the SYSTEM context and DPAPI will encrypt your string w/ the machine account's password.

From that point it's a matter of using the manage-bde tool to unlock the drive using the retrieved password (e.g. manage-bde -unlock x: -password)