How to set up and use BitLocker drive encryption to protect sensitive data on Windows 11

Summary

This guide helps you troubleshoot and resolve: How to set up and use BitLocker drive encryption to protect sensitive data on Windows 11. Follow the steps below to fix the issue.

Common Causes

BitLocker is a built-in encryption feature in Windows 11 Pro, Enterprise, and Education editions that protects the data on your hard drive by encrypting the entire drive. Once enabled, anyone who tries to access the drive without the correct credentials will be locked out, making it an essential tool for businesses and home office users handling sensitive information. This guide walks you through enabling, configuring, and using BitLocker on your Windows 11 device.

Check if BitLocker is Available on Your Device

1. Press Windows + I to open Settings.
2. Navigate to Privacy & security > Device encryption.
3. If you see a Device encryption toggle, your device supports basic encryption. Click the toggle to turn it on.
4. If you do not see this option, search for BitLocker in the Start menu. If BitLocker appears, your edition of Windows supports full drive encryption.
5. If neither option is available, your device may not meet the hardware requirements for encryption, or you may be running Windows 11 Home.

Enable BitLocker on Your Main Drive

1. Click the Start button and type BitLocker.
2. Select Manage BitLocker from the search results.
3. In the BitLocker Drive Encryption window, locate your main drive (usually C:) under "Operating system drive".
4. Click Turn on BitLocker next to the drive.
5. Wait for the initial scan to complete. Windows will check that your system meets the requirements.
6. Choose how you want to unlock the drive at startup:
   • Use a password — Enter and confirm a strong password.
   • Use a smart card — Requires a smart card and PIN (typically used in enterprise environments).
7. Choose how to back up your recovery key:
   • Save to your Microsoft account — Recommended for personal devices.
   • Save to a file — Saves a .txt file to another drive or USB stick.
   • Print the recovery key — Prints a physical copy.
8. Select the encryption option:
   • Encrypt used disk space only — Faster, suitable for new drives.
   • Encrypt entire drive — Recommended for drives that already contain data.
9. Choose the encryption mode:
   • New encryption mode — Best for fixed drives on this device.
   • Compatible mode — Use if the drive may be moved to an older Windows device.
10. Click Start encrypting.
11. Restart your computer when prompted. Encryption will continue in the background and may take several hours depending on the drive size.

Encrypt Additional Drives with BitLocker To Go

BitLocker To Go allows you to encrypt removable drives such as USB sticks and external hard drives.

1. Connect the removable drive to your computer.
2. Open File Explorer and right-click the drive.
3. Select Show more options > Turn on BitLocker.
4. Choose how you want to unlock the drive (password or smart card).
5. Back up your recovery key using one of the methods described above.
6. Choose whether to encrypt the used space only or the entire drive.
7. Select the encryption mode (compatible mode is recommended for removable drives).
8. Click Start encrypting.

Manage BitLocker After Setup

Check Encryption Status

1. Open Control Panel > System and Security > BitLocker Drive Encryption.
2. Each drive will display its status: BitLocker on, BitLocker off, or BitLocker suspended.

Suspend BitLocker Temporarily

1. Open BitLocker Drive Encryption in Control Panel.
2. Click Suspend protection next to the drive.
3. Confirm by clicking Yes.

Suspension is useful when performing firmware updates or troubleshooting hardware issues. BitLocker will automatically resume on the next restart, or you can resume it manually.

Resume BitLocker Protection

1. Open BitLocker Drive Encryption in Control Panel.
2. Click Resume protection next to the suspended drive.

Turn Off BitLocker

1. Open BitLocker Drive Encryption in Control Panel.
2. Click Turn off BitLocker next to the drive.
3. Confirm by clicking Turn off BitLocker again.
4. Wait for the decryption process to complete. This may take some time depending on the amount of data on the drive.

Change Your BitLocker Password

1. Open BitLocker Drive Encryption in Control Panel.
2. Click Change password next to the drive.
3. Enter the old password, then enter and confirm the new password.
4. Click Change password.

Troubleshooting Common BitLocker Issues

BitLocker Prompts for Recovery Key on Every Startup

This usually indicates a hardware or firmware change, or a problem with the Trusted Platform Module (TPM).

• Try restarting the computer several times. Windows may resolve the issue automatically.
• Check for recent hardware changes in Device Manager and roll back any drivers that may have been updated.
• Access the BIOS/UEFI settings and confirm that the TPM is enabled.
• If the issue persists, suspend and resume BitLocker protection to reset the key validation.

Cannot Find the Recovery Key

• If the key was saved to your Microsoft account, sign in to account.microsoft.com/devices/recoverykey using the same Microsoft account linked to your device.
• Search your computer for files named BitLocker Recovery Key.
• Check your printer history if you printed a copy.
• Look in your organisation's Active Directory if your device is joined to a domain.

BitLocker Will Not Encrypt the Drive

• Ensure your drive has at least 250 MB of free space.
• Run chkdsk /f from an elevated Command Prompt to repair any file system errors.
• Update your BIOS/UEFI firmware and TPM drivers from your device manufacturer's website.
• Check the system event log under Event Viewer > Windows Logs > System for BitLocker-related errors.

Performance Issues After Enabling BitLocker

Modern hardware with a TPM and self-encrypting drive support should not experience noticeable slowdowns. If performance is affected:

• Confirm your drive supports hardware-based encryption (e.g., eDrive or OPAL) by checking the manufacturer's specifications.
• Run the Windows Performance Recorder to identify any bottlenecks caused by disk activity.
• Ensure the latest storage controller drivers are installed from your device manufacturer.
• If the issue persists, consider decrypting the drive and re-encrypting it using the alternative encryption mode.

When to Seek Further Assistance

If you have followed the steps in this guide and are still experiencing issues with BitLocker, contact your IT support team or a qualified technician. Do not attempt to force decryption or modify system files, as this may result in permanent data loss.

Still Having Issues?