Windows BitLocker Configuration

Learn how to enable, configure, and fix BitLocker in Windows 10/11. Complete step-by-step setup with TPM, PowerShell, Group Policy, and recovery troubleshooting tips.

Windows BitLocker Configuration Prerequisites

• Edition: BitLocker needs Pro/Enterprise/Education. (Home only has “Device Encryption” on supported hardware.)
• Admin rights on the machine.
• TPM 2.0 (preferred) enabled in BIOS/UEFI (Intel PTT / AMD fTPM). Also enable UEFI + Secure Boot.
• System drive NTFS, healthy, with a small EFI + MSR partition (default on UEFI installs).
• Recovery key plan: Decide where keys will be stored (Microsoft Account, Azure AD/Intune, AD DS, or file/print).

How to enable BitLocker in Windows 10 / 11

1. Check TPM: Press Win+R → tpm.msc → Status should say “TPM is ready for use.”
2. Start BitLocker:Control Panel → BitLocker Drive Encryption → Turn on BitLocker on C:
   • If asked, choose TPM only or TPM + PIN (more secure).
   • Backup recovery key: Save to Microsoft account / file / print. Keep it offline & safe.
   • Choose Encrypt used disk space only (fast, recommended for new PCs) or entire drive (for reused PCs).
   • Choose XTS-AES (128/256; 256 if your policy requires).
3. Reboot if prompted; encryption starts in background.

For data drives (D:, E:): In the same BitLocker screen, Turn on for each drive and save a recovery key.

For USB (BitLocker To Go): Right-click the USB drive → Turn on BitLocker → set a strong password → save recovery key.

BitLocker PowerShell commands

Run PowerShell as Administrator:

# 1) Verify TPM/Secure Boot
Get-Tpm
Confirm-SecureBootUEFI

# 2) Enable BitLocker OS drive (TPM protector)
Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmProtector

# Optional: add a pre-boot PIN (recommended for sensitive machines)
$pin = Read-Host -AsSecureString "Enter pre-boot PIN (4-20 digits)"
Add-BitLockerKeyProtector -MountPoint "C:" -TPMAndPinProtector -Pin $pin

# 3) Backup recovery key (file example)
$bk = BackupToAAD-BitLockerKeyProtector -MountPoint "C:" -ErrorAction SilentlyContinue
(Get-BitLockerVolume -MountPoint "C:").KeyProtector | Out-String
# Or export to a file:
(Get-BitLockerVolume -MountPoint "C:").KeyProtector |
  ConvertTo-Json | Out-File "$env:PUBLIC\C_Drive_RecoveryKeyInfo.json"

# 4) Data drive example
Enable-BitLocker -MountPoint "D:" -EncryptionMethod XtsAes256 -UsedSpaceOnly
Add-BitLockerKeyProtector -MountPoint "D:" -RecoveryPasswordProtector

Status check:

Get-BitLockerVolume | Select MountPoint,VolumeStatus,EncryptionPercentage,ProtectionStatus,KeyProtector

Legacy/CLI alternative:

manage-bde -status
manage-bde -on C: -usedspaceonly -rp
manage-bde -protectors -add C: -TPMAndPIN
manage-bde -protectors -get C:

Windows Home (Device Encryption)

If your device supports Device Encryption (Modern Standby hardware), go to:
Settings → Privacy & security → Device encryption → Turn on.
Recovery keys are typically auto-backed up to your Microsoft Account.

Organization Setup (GPO / Intune essentials)

BitLocker Group Policy Configurations (on-prem AD)

gpedit.msc (or domain GPO):

• OS drives:
  Computer Configuration → Admin Templates → Windows Components → BitLocker Drive Encryption → Operating System Drives
  • Require additional authentication at startup → Enabled
    • Allow BitLocker without a compatible TPM (only if you must)
    • Configure TPM + PIN if your policy requires
  • Choose drive encryption method → XTS-AES 256 (or your standard)
  • Store recovery information in AD DS → Enabled
• Fixed/Removable drives: Set encryption method, require password/smart card for removable, and Disable hardware-based encryption (recommended) via:
  • Configure use of hardware-based encryption for fixed data drives → Disabled
  • Configure use of hardware-based encryption for operating system drives → Disabled
  • Configure use of hardware-based encryption for removable data drives → Disabled

Disabling hardware-based (SSD self-encrypt) ensures Windows uses proven software crypto and consistent key escrow.

Intune (MDM/Azure AD)

• Endpoint security → Disk encryption (Windows) profile:
  • OS drive: Require TPM (with or without PIN), XTS-AES 256, Used space only for new devices.
  • Automatic key escrow to Azure AD.
  • Fixed/removable drive settings per policy; block hardware encryption if desired.

BitLocker Configuration Verify & Monitor

• Progress/State:
  • manage-bde -status or Get-BitLockerVolume
• Event Viewer:
  Applications and Services Logs → Microsoft → Windows → BitLocker-API/Management
  Also check Microsoft-Windows-BitLocker/BitLocker Management.
• Services:
  services.msc → BitLocker Drive Encryption Service (BDESVC) = Running (Manual trigger).
• Where’s my recovery key?
  • Microsoft Account: account.microsoft.com/devices → your PC → BitLocker recovery keys
  • Azure AD: Intune/Entra admin center → Devices → (device) → Recovery keys
  • AD DS: Computer object → BitLocker Recovery tab (requires schema/GP set)

BitLocker troubleshooting guide

“This device can’t use a Trusted Platform Module.”

• Cause: TPM off/absent, or GPO forbids non-TPM.
• Fix: Enable TPM (PTT/fTPM) in BIOS/UEFI; in GPO, Require additional authentication at startup → Enabled, and if needed, tick Allow BitLocker without a compatible TPM (then use USB key or password). Prefer TPM+PIN when possible.

Fix BitLocker recovery key issue after BIOS/firmware changes

• Cause: PCR measurements changed.
• Fix: Before updates, run: manage-bde -protectors -disable C: → update/BIOS change → manage-bde -protectors -enable C:.
• If already locked: enter the recovery key once, then suspend/resume protectors.

“Waiting for activation” or encryption not starting

• Check: Get-BitLockerVolume.
• Fix: Ensure BDESVC is running; try: manage-bde -protectors -disable C: manage-bde -protectors -enable C: Confirm drive is NTFS, and there’s adequate free space on the system partition (~500MB+ for EFI/System).

BitLocker service error / can’t enable

• Fix:
  • Service: sc query bdesvc → start it if stopped.
  • Ensure no third-party disk filter is blocking (older AV/dlp drivers). Update drivers.
  • Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth if system corruption is suspected.

“The Group Policy settings are in conflict”

• Cause: Mismatched GPO/MDM settings (e.g., TPM+PIN required but PIN length policy not set).
• Fix: Run gpresult /h c:\gp.html, align all BitLocker policies (OS/fixed/removable) consistently, then gpupdate /force.

Can’t encrypt: drive isn’t NTFS / is read-only

• Fix: Convert or reformat to NTFS. For read-only: diskpart list disk select disk <n> attributes disk attributes disk clear readonly exit

Hardware encryption unexpectedly used (self-encrypting drive)

• Fix: In GPO/Intune, disable hardware-based encryption for OS/fixed/removable, suspend BitLocker, decrypt, then re-enable BitLocker so Windows software crypto is used.

Performance is slow during encryption

• Fix: Use Used space only for new devices; avoid encrypting over low battery/thermal throttling; ensure SSD firmware & chipset drivers are current.

Lost BitLocker recovery key

• Reality check: Without a valid key, data cannot be recovered. Check Microsoft account / Azure AD / AD DS / printed copy. Consider re-imaging if unrecoverable.

BitLocker Commands (cheat sheet)

:: Status & protectors
manage-bde -status
manage-bde -protectors -get C:

:: Enable OS drive (software crypto, used space)
manage-bde -on C: -usedspaceonly -rp

:: Add TPM+PIN
manage-bde -protectors -add C: -TPMAndPIN

:: Suspend/Resume (for BIOS updates)
manage-bde -protectors -disable C:
manage-bde -protectors -enable C:

:: Decrypt
manage-bde -off C:

Get-BitLockerVolume
Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmProtector
Add-BitLockerKeyProtector -MountPoint "C:" -TPMAndPinProtector -Pin (Read-Host -AsSecureString)
Suspend-BitLocker -MountPoint "C:"
Resume-BitLocker -MountPoint "C:"

FAQ

Q1. What is BitLocker and why is it used?
BitLocker is a built-in disk encryption feature in Windows that protects your data by encrypting the entire drive. It prevents unauthorized access even if the device is lost or stolen.

Q2. How do I enable BitLocker on Windows 10 or Windows 11?
You can enable BitLocker via Control Panel > BitLocker Drive Encryption or using PowerShell / manage-bde commands. A TPM chip is recommended for secure automatic unlocking.

Q3. What should I do if BitLocker keeps asking for a recovery key at star-tup?
This usually happens after BIOS updates or hardware changes. Use your recovery key once, then suspend and resume BitLocker protection to reset the TPM binding.

Q4. BitLocker says “This device can’t use a Trusted Platform Module.” How do I fix it?
Enable TPM / PTT / fTPM in BIOS, or go to Group Policy and enable “Allow BitLocker without a compatible TPM” to use a password or USB key instead.

Q5. Where can I find my BitLocker recovery key?
Recovery keys may be stored in your Microsoft Account, Azure AD, Active Directory, or saved file/print copy. Visit account.microsoft.com/devices/recovery key to check.

Q6. How do I check BitLocker encryption status?
Use manage-bde -status in Command Prompt or Get-BitLockerVolume in PowerShell to view encryption percentage and protectors.

Q7. Can I disable or remove BitLocker encryption?
Yes. Open Command Prompt as admin and run manage-bde -off C:. This will decrypt the drive, but it may take time depending on drive size.