```powershell
<#
.SYNOPSIS
    Checks readiness for Windows 11 BitLocker policy deployment and validates current drive protection state.

.DESCRIPTION
    This script helps operationalize a BitLocker policy rollout by verifying common prerequisites,
    checking TPM readiness, confirming BitLocker status, refreshing policy, and optionally validating
    a specified drive. It does not enable, disable, or change BitLocker settings.

    Intended use:
    - Pilot device validation
    - Pre-rollout readiness checks
    - Helpdesk troubleshooting for policy enforcement issues

.NOTES
    Vendor-neutral and safe by default.
    No destructive actions are performed.
    Requires administrative privileges for some checks.
#>

[CmdletBinding()]
param(
    [Parameter(Mandatory = $false)]
    [ValidatePattern('^[A-Za-z]:$')]
    [string]$DriveLetter = 'C:',

    [Parameter(Mandatory = $false)]
    [switch]$RunGpUpdate,

    [Parameter(Mandatory = $false)]
    [switch]$ShowDetailedStatus
)

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

function Write-Section {
    param([string]$Text)
    Write-Host "`n=== $Text ===" -ForegroundColor Cyan
}

function Test-Administrator {
    $currentIdentity = [Security.Principal.WindowsIdentity]::GetCurrent()
    $principal = New-Object Security.Principal.WindowsPrincipal($currentIdentity)
    return $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
}

function Get-TpmReadiness {
    Write-Section 'TPM Readiness'
    try {
        $tpm = Get-Tpm
        [pscustomobject]@{
            TpmPresent  = [bool]$tpm.TpmPresent
            TpmReady    = [bool]$tpm.TpmReady
            TpmEnabled  = [bool]$tpm.TpmEnabled
            TpmOwned    = [bool]$tpm.TpmOwned
            Description = if ($tpm.TpmPresent) { 'TPM detected.' } else { 'TPM not detected.' }
        }
    }
    catch {
        [pscustomobject]@{
            TpmPresent  = $false
            TpmReady    = $false
            TpmEnabled  = $false
            TpmOwned    = $false
            Description = "Unable to query TPM: $($_.Exception.Message)"
        }
    }
}

function Get-BitLockerStatusText {
    param([string]$TargetDrive)

    Write-Section "BitLocker Status for $TargetDrive"
    try {
        $output = & manage-bde.exe -status $TargetDrive 2>&1
        if ($LASTEXITCODE -ne 0) {
            throw "manage-bde returned exit code $LASTEXITCODE"
        }
        return ($output -join [Environment]::NewLine)
    }
    catch {
        return "Unable to query BitLocker status for $TargetDrive: $($_.Exception.Message)"
    }
}

function Invoke-PolicyRefresh {
    Write-Section 'Policy Refresh'
    try {
        & gpupdate.exe /force | Out-Null
        if ($LASTEXITCODE -eq 0) {
            Write-Host 'Group Policy refresh completed.' -ForegroundColor Green
        }
        else {
            Write-Warning "gpupdate exited with code $LASTEXITCODE"
        }
    }
    catch {
        Write-Warning "Unable to run gpupdate: $($_.Exception.Message)"
    }
}

function Get-CommonRiskNotes {
    param(
        [pscustomobject]$TpmResult,
        [string]$BitLockerText
    )

    $notes = New-Object System.Collections.Generic.List[string]

    if (-not $TpmResult.TpmPresent) {
        $notes.Add('TPM is missing or not reported. TPM-backed policy may not apply as expected.')
    }
    elseif (-not $TpmResult.TpmReady) {
        $notes.Add('TPM is present but not ready. Check firmware, BIOS settings, or ownership state.')
    }

    if ($BitLockerText -match 'Conversion Status:\s+Fully Decrypted') {
        $notes.Add('Target drive is fully decrypted. Encryption has not started yet.')
    }
    elseif ($BitLockerText -match 'Protection Status:\s+Protection Off') {
        $notes.Add('Protection is off. Confirm policy, prerequisites, and recovery workflow.')
    }
    elseif ($BitLockerText -match 'Lock Status:\s+Unlocked') {
        $notes.Add('Drive is unlocked, which is normal for an active OS drive, but confirm protection status separately.')
    }

    if ($notes.Count -eq 0) {
        $notes.Add('No obvious rollout blockers detected from this basic check.')
    }

    return $notes
}

# Main
Write-Section 'Windows 11 BitLocker Policy Readiness Check'

$admin = Test-Administrator
if ($admin) {
    Write-Host 'Running with administrative privileges.' -ForegroundColor Green
}
else {
    Write-Warning 'Not running as administrator. Some status checks may be limited.'
}

if ($RunGpUpdate) {
    Invoke-PolicyRefresh
}

$tpmResult = Get-TpmReadiness
$bitlockerStatus = Get-BitLockerStatusText -TargetDrive $DriveLetter
$riskNotes = Get-CommonRiskNotes -TpmResult $tpmResult -BitLockerText $bitlockerStatus

Write-Section 'Summary'
[pscustomobject]@{
    Administrator = $admin
    TpmPresent    = $tpmResult.TpmPresent
    TpmReady      = $tpmResult.TpmReady
    TpmEnabled    = $tpmResult.TpmEnabled
    TpmOwned      = $tpmResult.TpmOwned
    DriveChecked  = $DriveLetter
} | Format-List

Write-Section 'TPM Details'
$tpmResult | Format-List

if ($ShowDetailedStatus) {
    Write-Section "Detailed manage-bde Output for $DriveLetter"
    Write-Host $bitlockerStatus
}
else {
    Write-Section "BitLocker Status Snapshot for $DriveLetter"
    $interestingLines = $bitlockerStatus -split "`r?`n" | Where-Object {
        $_ -match 'Conversion Status|Percentage Encrypted|Protection Status|Lock Status|Volume Type|Automatic Unlock'
    }
    if ($interestingLines) {
        $interestingLines | ForEach-Object { Write-Host $_ }
    }
    else {
        Write-Host $bitlockerStatus
    }
}

Write-Section 'Risk Notes'
$riskNotes | ForEach-Object { Write-Host "- $_" }

Write-Section 'Suggested Next Checks'
Write-Host '- Confirm the policy path is the only authoritative BitLocker configuration source.'
Write-Host '- Verify recovery key escrow is working before enforcing encryption at scale.'
Write-Host '- Pilot the intended protector model on at least one device.'
Write-Host '- Resolve TPM readiness or BIOS issues before rollout.'
Write-Host '- Recheck policy after refresh or sync if settings do not take effect.'

exit 0
```