How to set up and use Windows BitLocker to encrypt your company laptop's hard drive

Summary

This guide helps you troubleshoot and resolve: How to set up and use Windows BitLocker to encrypt your company laptop's hard drive. Follow the steps below to fix the issue.

Common Causes

BitLocker is a built-in Windows feature that encrypts your entire hard drive, safeguarding sensitive company data if your laptop is lost or stolen. Once enabled, the encryption key is tied to your device and your Microsoft account or Active Directory profile, meaning only authorised users can unlock the drive. This guide walks you through enabling BitLocker on a Windows laptop running Windows 10 or Windows 11 Pro, Enterprise, or Education editions.

Before You Begin

BitLocker requires a Trusted Platform Module (TPM) chip, which is standard on most business laptops manufactured in the last decade. You'll also need to be signed in with an administrator account and have the laptop plugged into mains power throughout the encryption process.

Check Your Windows Edition

1. Press Win + I to open Settings.
2. Select System, then scroll down and click About.
3. Under Windows specifications, check the Edition line. You need Pro, Enterprise, or Education.

Enable BitLocker Drive Encryption

1. Click the Start button and type BitLocker.
2. Select Manage BitLocker from the search results (or navigate to Settings > Privacy & Security > Device Encryption on Windows 11).
3. Find your main C: drive (labelled Operating system drive) and click Turn on BitLocker.
4. Wait for the system to initialise the TPM. This may take a few seconds.
5. When prompted, choose how you want to unlock the drive at startup:
   • Use a password — recommended for most users. Choose a strong password you haven't used elsewhere.
   • Use a smart card — only if your organisation issues smart cards.
6. Choose how to back up your recovery key. You have four options:
   • Save to your Microsoft account — recommended for laptops joined to a Microsoft Entra ID (Azure AD) account.
   • Save to a USB flash drive — useful as a physical backup.
   • Save to a file — store on an external drive or network share, not on the laptop being encrypted.
   • Print the recovery key — keep in a secure location such as a locked filing cabinet.
7. Select Encrypt entire drive (recommended for laptops) rather than just the used space. This ensures deleted files and previously written data remain protected.
8. Choose the encryption mode:
   • New encryption mode (XTS-AES) — best for fixed internal drives.
   • Compatible mode — only needed if you must use removable drives with older Windows versions.
9. Tick Run BitLocker system check to ensure your laptop can read the recovery key before encryption begins.
10. Click Start encryption.

Verify BitLocker Is Active

1. Open Manage BitLocker again from the Start menu.
2. Confirm that C: shows BitLocker on.
3. Alternatively, open Command Prompt as administrator and run manage-bde -status. Look for Protection Status: Protection On and Encryption Method: XTS-AES.

Manage Your Recovery Key

Your BitLocker recovery key is an alphanumeric string generated when you first enable encryption. Without it, you cannot access your data if BitLocker detects a hardware change or unauthorised access attempt.

Find a Recovery Key Saved to Your Microsoft Account

1. Open a web browser and go to account.microsoft.com/devices/recoverykey.
2. Sign in with the Microsoft account linked to your laptop.
3. Locate your device and copy or print the recovery key.

Find a Recovery Key Saved to a File or USB

1. Connect the USB drive or navigate to the network share where the key was saved.
2. Open the BitLocker Recovery Key text file. The filename begins with BitLocker Recovery Key followed by the device identifier.

Troubleshooting

BitLocker Prompts for the Recovery Key at Every Startup

This usually means the TPM is not recognising hardware changes. Try the following:

1. Restart the laptop and enter the recovery key when prompted.
2. Once in Windows, open Manage BitLocker and click Suspend protection.
3. Restart the laptop again.
4. Return to Manage BitLocker and click Resume protection.

If the issue persists after a BIOS update or hardware change, your IT administrator may need to reset the TPM. Open a ticket for assistance.

"This device can't use a Trusted Platform Module" Error

Your laptop's TPM may be disabled in the BIOS/UEFI settings.

1. Restart the laptop and enter the BIOS (commonly by pressing F2, F10, or Del during startup).
2. Locate the Security or Trusted Computing section.
3. Enable TPM, Intel PTT, or AMD fTPM depending on your processor.
4. Save and exit, then retry the BitLocker setup.

Encryption Is Stuck or Extremely Slow

• Confirm the laptop is plugged into mains power.
• Close resource-intensive applications.
• Run manage-bde -status in an elevated Command Prompt to check the Conversion Status and percentage complete.
• If progress has not changed for several hours, restart the laptop. BitLocker will resume automatically.

Forgot the BitLocker Password

If you cannot remember the startup password, you'll need the recovery key to regain access. See the Manage Your Recovery Key section above. If you cannot locate the recovery key, your data may be unrecoverable. Contact your IT administrator or submit a support ticket immediately.

Disabling BitLocker

If you need to disable BitLocker temporarily (for example, during a firmware update) or permanently, follow these steps:

1. Open Manage BitLocker from the Start menu.
2. Click Suspend protection to temporarily pause BitLocker, or Turn off BitLocker to decrypt the drive fully.
3. If turning off BitLocker, confirm you want to decrypt the drive. The decryption process may take several hours.

Still Having Issues?