The first thing that comes to mind is the easiest and laziest, and that is, I think to write a service that you have run on StartUp/Boot of the machine. This service retrieves the parameters (MAC and HardwareID of the hard drive, etc) and then compares that data to what it retrieves from the Machine and the Drive itself. If that test passes, everything is good and nothing happens. The service kills itself.
If, instead any of the data that you checked does not match, then you want to encrypt the hard drive, if I understand correctly. I don’t know if the BitLocker’s and the VeraCrypt’s types of software have a CLI to encrypt. I would suspect they do, but if they don’t, you can always encrypt with PGP. That does have a CLI. You will need to create private key beforehand and use that to encrypt the target drive/files (instead of a simple password, as you would with BitLocker and VeraCrypt).
What is your intent? To avoid someone taking the drive? Do you expect them to return it? If not, why not bleach and destroy it then? No encryption required. That feature is built-into the OS. That is way easier. I don’t have the whole picture. I hope that helped a bit.
To add on: Look at BitLocker and VeraCrypt. There are many others, I am sure just as good. I would not look at Symantec. Anyhow, make sure you select the "Full Disk Encryption" option. What this does, is that it encrypts the hard drive entirely, including the boot loader. This mean
This means that you will be prompted for a password. During the bootup phase, during the black screen. With this password, the boot sector is decrypted and the OS is allowed to start up. Notice that the data on the hard drive is always encrypted and data that is requested from the hard drive is decrypted on-the-fly. Only the data that is in RAM is in clear text if you will. Your hard drive is safe at all times. Whether the machine is on or not.
Last, if you want yet another layer of security, BitLocker has a nifty set up with YubiKey - a USB key that provides a TOTP password, which is impossible to guess and one must be physically present at the machine with this key in hand to start the machine.
This way the TaxMan can't look at the Post-It note and type in the password that's written in plain sight.
I wish you good luck with the project. It's really simple. It's all built -in, extremely well tested and most large corporations use it. I know at it was mandatory for the reason you mention (except we didn't fear the taxman).
Best of luck with your project, and you may not have to write a single line of code and go home early today. Not bad....
