How can I automate enabling Bitlocker on new laptops?

Have you tried running your PowerShell script directly on the machine, bypassing GPO and scheduled tasks? If it still doesn't work that way, then the issue might be with your script itself. Simplifying your conditions could help; I've found checking the ProtectionStatus directly is usually straightforward.

Honestly, you shouldn't need to script anything manually. GPO and Intune are designed to manage Bitlocker automatically as soon as the device receives the policy right after network connection or domain join—no user login required. I recommend setting that up instead.

You might want to explore using Intune or leveraging GPO more effectively. Both have built-in options to enforce Bitlocker and take care of key backups without needing custom scripts. They’ll automate the process much better once your devices are enrolled or joined to the domain.

If you're stuck on using scripts, make sure you check the BitLocker ProtectionStatus using Get-BitLockerVolume directly instead of depending on marker files. It looks like you might be overcomplicating things. But check out the Windows documentation for setting up Bitlocker through GPO—it’s often the most reliable approach.