BitLocker encrypts entire volumes so data is harder to access if a device is lost, stolen, or decommissioned. Microsoft says BitLocker Drive Encryption is available for Windows Pro, Enterprise, and Education editions. Windows Home devices may instead expose the separate Device Encryption feature when the hardware and software meet its requirements. [1] [2]
Before you begin
- Sign in with an administrator account.
- Confirm the Windows edition. If Manage BitLocker does not appear, the device may not have a supported edition.
- Connect the device to power and allow enough time for encryption to complete.
- Decide where the recovery key will be stored before starting.
A Trusted Platform Module (TPM) provides the strongest normal startup-integrity experience. Microsoft documents additional requirements for TPM, UEFI, system partitions, and supported configurations. [2]
1. Open BitLocker Drive Encryption
- Select Start.
- Type BitLocker.
- Select Manage BitLocker.
- Review the operating-system drive, fixed data drives, and any removable drives listed.
Use BitLocker To Go for removable drives when you need to protect USB or other removable data. Do not assume that encrypting the operating-system drive automatically encrypts every external drive.
2. Start encryption for a drive
- Next to the drive you want to protect, select Turn on BitLocker.
- Choose the unlock option offered for that drive.
- Back up the recovery key using an approved location.
- Continue through the BitLocker wizard.
- Let Windows begin encrypting the drive.
Microsoft notes that the device can remain usable while encryption progresses, although the process can take time. Avoid interrupting a device that is low on power or in the middle of a critical operation. [1]
3. Protect the recovery key
The recovery key is essential when Windows cannot automatically unlock the drive. Store it in a secure location that is available to the authorized owner or IT team but not stored only on the encrypted device. For organization-managed devices, follow the company’s recovery-key escrow policy, such as Microsoft Entra ID or Active Directory backup where configured.
Do not publish the recovery key in a ticket, chat channel, or unprotected shared folder. Verify that the stored key can be found by the people who are expected to recover the device.
4. Verify the encryption status
- Return to Manage BitLocker.
- Confirm that the intended drive shows BitLocker protection.
- Check that encryption has completed before treating the device as protected.
- Restart the device and confirm that the normal unlock path works.
For a managed deployment, verify that the recovery key was backed up to the organization’s approved directory and that the device is receiving the intended BitLocker policy.
5. Use Device Encryption when appropriate
Some Windows devices provide Device encryption in Settings instead of the full BitLocker Drive Encryption control panel. Microsoft describes Device Encryption as a simpler BitLocker-based feature that can turn on automatically on qualifying devices. It generally covers the operating-system and fixed drives, not external USB drives. [2]
Check the recovery-key state before assuming automatic encryption is complete. A device that shows encryption but has no recoverable key is not ready for safe deployment.
Common mistakes
- Starting encryption without confirming the Windows edition or hardware prerequisites.
- Saving the recovery key only on the drive being encrypted.
- Assuming external drives are protected by operating-system-drive encryption.
- Changing BIOS or UEFI settings after deployment without understanding their BitLocker impact.
- Turning off encryption during troubleshooting without recording the security and recovery consequences.
