```powershell
<#
.SYNOPSIS
    Checks readiness for BitLocker with TPM + PIN and verifies post-enable status on Windows 10.

.DESCRIPTION
    This script performs non-destructive checks to help validate a device before or after
    enabling BitLocker with a TPM + PIN protector.

    It reports on:
      - TPM presence, readiness, and enablement
      - OS version and administrative context
      - UEFI/Secure Boot state when available
      - BitLocker status on the operating system drive
      - Presence of BitLocker protectors
      - Recovery password protector detection
      - Common readiness blockers and recommendations

    Optional switches can be used to:
      - Attempt to add a TPM+PIN protector (requires policy support and user interaction)
      - Start BitLocker encryption on the OS drive

    By default, no destructive action is taken.

.NOTES
    Vendor-neutral operational helper.
    Run in an elevated PowerShell session for fullest results.
#>

[CmdletBinding(SupportsShouldProcess = $true)]
param(
    [Parameter()]
    [ValidatePattern('^[A-Za-z]$')]
    [string]$DriveLetter = 'C',

    [Parameter()]
    [switch]$AttemptEnableBitLocker,

    [Parameter()]
    [switch]$AttemptAddTpmAndPinProtector,

    [Parameter()]
    [switch]$ShowRecommendations
)

function Write-Section {
    param([string]$Title)
    Write-Host "`n=== $Title ===" -ForegroundColor Cyan
}

function Test-IsAdministrator {
    $currentUser = [Security.Principal.WindowsIdentity]::GetCurrent()
    $principal = New-Object Security.Principal.WindowsPrincipal($currentUser)
    return $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
}

function Get-SecureBootStateSafe {
    try {
        if (Get-Command Confirm-SecureBootUEFI -ErrorAction SilentlyContinue) {
            return Confirm-SecureBootUEFI
        }
    }
    catch {
        return $null
    }
    return $null
}

function Get-BitLockerVolumeSafe {
    param([string]$Letter)
    try {
        if (Get-Command Get-BitLockerVolume -ErrorAction SilentlyContinue) {
            return Get-BitLockerVolume -MountPoint "$Letter:`"  -ErrorAction Stop
        }
    }
    catch {
        return $null
    }
    return $null
}

function Get-TpmSafe {
    try {
        if (Get-Command Get-Tpm -ErrorAction SilentlyContinue) {
            return Get-Tpm
        }
    }
    catch {
        return $null
    }
    return $null
}

function Get-ManageBdeProtectorText {
    param([string]$Letter)
    try {
        $output = & manage-bde -protectors -get "$Letter:`" 2>$null
        return ($output -join "`n")
    }
    catch {
        return $null
    }
}

function Get-OSVolume {
    param([string]$Letter)
    try {
        return Get-Volume -DriveLetter $Letter -ErrorAction Stop
    }
    catch {
        return $null
    }
}

Write-Section "System context"
$os = Get-CimInstance Win32_OperatingSystem
Write-Host ("Computer: {0}" -f $env:COMPUTERNAME)
Write-Host ("OS: {0} {1}" -f $os.Caption, $os.Version)
Write-Host ("Administrator: {0}" -f (Test-IsAdministrator))

Write-Section "TPM status"
$tpm = Get-TpmSafe
if ($null -ne $tpm) {
    $tpm | Select-Object TpmPresent, TpmReady, TpmEnabled, TpmOwned, ManufacturerVersion, SpecVersion | Format-List
} else {
    Write-Warning "TPM information could not be retrieved. Confirm the TPM module is available and the device supports TPM."
}

Write-Section "Boot security"
$secureBoot = Get-SecureBootStateSafe
if ($null -eq $secureBoot) {
    Write-Host "Secure Boot: Unable to determine from this session."
} else {
    Write-Host ("Secure Boot: {0}" -f $secureBoot)
}

$firmware = Get-CimInstance Win32_ComputerSystem
Write-Host ("Manufacturer: {0}" -f $firmware.Manufacturer)
Write-Host ("Model: {0}" -f $firmware.Model)

Write-Section "OS volume"
$volume = Get-OSVolume -Letter $DriveLetter
if ($null -ne $volume) {
    $volume | Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | Format-List
} else {
    Write-Warning "Could not read volume information for $DriveLetter`:"
}

Write-Section "BitLocker status"
$blv = Get-BitLockerVolumeSafe -Letter $DriveLetter
if ($null -ne $blv) {
    $blv | Select-Object MountPoint, VolumeStatus, ProtectionStatus, EncryptionPercentage, EncryptionMethod, LockStatus | Format-List
} else {
    Write-Warning "Get-BitLockerVolume was not available or failed. Falling back to manage-bde output if present."
    $mbde = Get-ManageBdeProtectorText -Letter $DriveLetter
    if ($mbde) {
        $mbde
    }
}

Write-Section "Protector check"
$protectorText = Get-ManageBdeProtectorText -Letter $DriveLetter
if ($protectorText) {
    $protectorText
    if ($protectorText -match 'TPM And PIN|TPM\+PIN|TpmAndPin') {
        Write-Host "Detected a TPM+PIN protector in manage-bde output." -ForegroundColor Green
    }
    if ($protectorText -match 'Numerical Password|Recovery Password') {
        Write-Host "Detected a recovery password protector in manage-bde output." -ForegroundColor Green
    }
} else {
    Write-Warning "Unable to retrieve protector details."
}

if ($ShowRecommendations) {
    Write-Section "Readiness recommendations"
    $recommendations = New-Object System.Collections.Generic.List[string]

    if ($null -eq $tpm -or -not $tpm.TpmPresent) { $recommendations.Add('TPM is not present or not readable. Confirm firmware TPM settings.') }
    elseif (-not $tpm.TpmEnabled) { $recommendations.Add('TPM is present but disabled. Enable TPM in firmware.') }
    elseif (-not $tpm.TpmReady) { $recommendations.Add('TPM is not ready. Initialize or clear stale TPM state according to policy.') }

    if ($secureBoot -eq $false) { $recommendations.Add('Secure Boot is disabled. Confirm this is aligned with your standard build.') }

    if ($null -ne $blv) {
        if ($blv.ProtectionStatus -ne 'On') { $recommendations.Add('BitLocker protection is not on for the OS drive.') }
        if ($blv.EncryptionPercentage -lt 100) { $recommendations.Add('Encryption is not complete yet. Monitor progress before declaring completion.') }
    }

    if ($protectorText -and $protectorText -notmatch 'Recovery Password|Numerical Password') {
        $recommendations.Add('No recovery password protector was detected. Verify escrow or recovery-key handling.')
    }

    if ($recommendations.Count -eq 0) {
        Write-Host 'No obvious issues detected from the current checks.' -ForegroundColor Green
    } else {
        $recommendations | ForEach-Object { Write-Host "- $_" }
    }
}

if ($AttemptAddTpmAndPinProtector -or $AttemptEnableBitLocker) {
    Write-Section "Optional actions"
    if (-not (Test-IsAdministrator)) {
        throw 'Administrative privileges are required for BitLocker changes.'
    }

    if ($AttemptAddTpmAndPinProtector) {
        Write-Host 'You selected TPM+PIN protector addition.' -ForegroundColor Yellow
        Write-Host 'This operation is intentionally not automated here because PIN collection should be performed through an approved interactive process or management workflow.' -ForegroundColor Yellow
        Write-Host 'Use your organization-approved method to add the TPM+PIN protector after confirming policy support.' -ForegroundColor Yellow
    }

    if ($AttemptEnableBitLocker) {
        if ($PSCmdlet.ShouldProcess("$DriveLetter`:", 'Start BitLocker encryption')) {
            Write-Host 'Starting BitLocker is environment-specific and may require your organization-approved workflow.' -ForegroundColor Yellow
            Write-Host 'Use manage-bde or an approved management tool only after you have confirmed recovery-key escrow and policy compliance.' -ForegroundColor Yellow
            Write-Host 'No encryption command was executed by this script.' -ForegroundColor Yellow
        }
    }
}

Write-Section "Completion"
Write-Host "Review the output above for TPM readiness, boot configuration, BitLocker status, and recovery-key handling." -ForegroundColor Cyan
Write-Host "This script does not change system state unless you integrate it into an approved management workflow." -ForegroundColor Cyan
```