Enable BitLocker on Windows 11: 11 Steps, 45 Min [2026]

A stolen laptop can quickly escalate into a significant data breach, particularly when it is taken from an unsuspecting café table. In response to this growing concern, Windows 11 has introduced a solution that many IT teams have yet to fully implement. BitLocker, Microsoft’s full-disk encryption feature, has been around since Windows Vista, but as of 2026, it has become a mandatory requirement for Australian businesses. The Office of the Australian Information Commissioner reported 766 notifiable data breaches in the latter half of 2024, with unauthorized access to devices being a leading cause. Full-disk encryption serves as a crucial technical control in compliance with the Essential Eight framework, which mandates the protection of data on portable devices and laptops.

Why Full-Disk Encryption Is Non-Negotiable in 2026

Full-disk encryption has transitioned from a mere checkbox on compliance lists to an essential safeguard as remote and hybrid work has proliferated. Corporate laptops are now frequently found in homes, cafés, and co-working spaces, rather than secured offices. Incidents involving laptops left in taxis have become commonplace.

The financial implications are stark. According to IBM’s Cost of a Data Breach Report, the global average cost of a breach stands at approximately US.88 million, with lost or stolen devices being one of the more preventable entry points. In Australia, the OAIC’s Notifiable Data Breaches scheme recorded 766 notifications in the second half of 2024, underscoring the urgency of addressing unauthorized access. It’s important to note that this threat does not require sophisticated hacking; it simply necessitates an unencrypted drive and physical access.

BitLocker addresses a specific issue that is often misunderstood. While it does not prevent someone from accessing files while logged in, it ensures that the data on a drive becomes unreadable as soon as it leaves the machine it was encrypted on. If the drive is removed and connected to another computer, or if an attacker attempts to mount it using forensic tools, all they will encounter is ciphertext. For a lost or stolen laptop, this distinction can mean the difference between a policy violation and a reportable breach.

Moreover, BitLocker aligns with the Australian Cyber Security Centre’s Essential Eight framework, specifically under Maturity Level 1, which requires the protection of data on portable devices and laptops. Assessors seek concrete evidence of encryption, rather than relying on claims that the login screen is protected. They expect to see the volume encrypted, the encryption algorithm documented, and recovery keys securely stored, rather than hastily noted on a sticky note.

BitLocker vs Device Encryption vs File-Level Encryption

When discussing “encryption” on a Windows 11 machine, it’s essential to clarify that it can refer to three distinct types, depending on the installed edition.

• Device Encryption: This version is included with Windows 11 Home and operates automatically if the hardware meets Microsoft’s specifications. It encrypts the system drive upon signing in with a Microsoft account, but lacks configuration options and the ability to encrypt secondary drives separately.
• BitLocker Drive Encryption: Available only on Windows 11 Pro, Enterprise, Education, and Workstation editions, BitLocker provides a comprehensive feature set, including management through Settings, Control Panel, PowerShell, and Group Policy. It allows for the encryption of both fixed and removable data drives independently.
• File-Level or Container-Level Encryption: This method encrypts individual files and folders rather than the entire volume. While useful, it does not protect the operating system or critical data stored in the page file or hibernation data.

To determine which version is in use, right-click the Start button, select System, and check the Windows specifications panel for the edition name. Home indicates Device Encryption at best, while Pro and above provide full BitLocker capabilities.

Prerequisites and System Requirements

Before initiating the BitLocker setup, ensure that the following prerequisites are met:

• Operating System: Windows 11 Pro, Enterprise, Education, or Pro for Workstations, version 22H2 or later (version 24H2 is recommended).
• TPM: Trusted Platform Module 2.0 is required, which is standard for most machines built for Windows 11.
• Firmware: UEFI with Secure Boot enabled is necessary, as Legacy BIOS mode will block BitLocker’s strongest protections.
• Permissions: Local administrator rights on the machine, along with Global Administrator or Intune Administrator access for fleet deployment.
• PowerShell: Version 5.1 or later, which is included with Windows 11.
• Power: Ensure the device is plugged in or has a battery level above 40% to avoid interruptions during the encryption process.
• For Fleet Rollout: A Microsoft Intune license is required, along with devices that are Entra ID-joined or hybrid-joined.
• Optional but Recommended: A spare USB drive and printer access for local recovery key backup.

Edition is the most critical factor, as it determines whether the full toolset or a limited consumer version is available.

Step 1: Confirm Your Edition, Build and License

Begin by confirming the specific edition and build you are working with. Press Windows key + R, type winver, and press Enter. This will display the edition name and build number, allowing you to identify any Home-edition machines before proceeding.

For fleet management, PowerShell can streamline this process:

Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber

Run this command through a remote management tool or a scheduled script across your device list, exporting the results to CSV and filtering out any machines reporting “Home” in the product name.

Step 2: Check TPM Status and Secure Boot

Once the edition is confirmed, verify that the TPM is present and ready. There are two methods to accomplish this:

• Graphical Method: Press Windows key + R, type tpm.msc, and press Enter. A functioning setup will display “The TPM is ready for use” along with a version number. If it indicates that the TPM is disabled or not detected, you will need to enable it in the UEFI firmware menu.
• Scriptable Method: Use PowerShell, run as administrator:

Get-TPM | Select-Object TpmPresent, TpmReady, TpmEnabled, TpmVersion

A healthy result should indicate that the TPM is present, ready, and enabled.

Additionally, confirm Secure Boot by running msinfo32 from the Run dialog and checking the “Secure Boot State” line. It should read “On.” If it displays “Unsupported” or “Off,” return to the UEFI firmware settings to switch the boot mode from Legacy to UEFI and enable Secure Boot.

Step 3: Enable BitLocker From Windows Settings

For individual machines, the graphical wizard is the quickest method. Open Settings, navigate to Privacy & Security, then Device Encryption or BitLocker Drive Encryption, and select “Turn on BitLocker” next to the operating system drive.

The wizard will guide you through a series of questions regarding how to unlock the drive at startup, backup recovery key options, the extent of the drive to encrypt, and the encryption mode to use. After confirming your selections, Windows will perform a BitLocker system check and prompt for a restart. This step is crucial, as it verifies the ability to read the recovery key before proceeding with encryption.

Step 4: Enable BitLocker With PowerShell

For larger deployments, PowerShell is the preferred method, as it allows for remote execution. The core cmdlet is Enable-BitLocker, typically configured to combine a TPM protector with a recovery password:

Enable-BitLocker -MountPoint "C:" 
  -EncryptionMethod XtsAes256 
  -UsedSpaceOnly `
  -TpmProtector

Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector

Run PowerShell as an administrator to execute these commands successfully. The first command activates encryption using the TPM as the unlock mechanism, while the second adds a numerical recovery password as a backup protector.

To check progress, use the following command:

Get-BitLockerVolume -MountPoint "C:" | Select-Object MountPoint, VolumeStatus, EncryptionPercentage, ProtectionStatus

Step 5: Enable BitLocker With manage-bde

The manage-bde command-line tool remains relevant, particularly in environments where PowerShell modules are not loaded. Open an elevated Command Prompt and execute:

manage-bde -on C: -used -rp -tpm

This command activates encryption for the C drive, encrypting only the used space while generating a numerical recovery password. To check the status, use:

manage-bde -status C:

Step 6: Pick Your Encryption Scope and Cipher Strength

Two critical decisions must be made during encryption that are difficult to alter later: the scope of encryption and the cipher strength.

• Encryption Scope: Choose between encrypting used space only or the full drive. Full encryption is recommended for devices that have been previously used, while used-space-only is suitable for new devices.
• Cipher Strength: Select between XTS-AES 128-bit and XTS-AES 256-bit. The latter is generally preferred for business environments due to its stronger security profile.

Step 7: Back Up the Recovery Key

This step is often overlooked but is essential. The recovery key, a 48-digit numerical password, is crucial for unlocking the drive if the TPM cannot verify the boot environment. Windows provides five storage options for the recovery key, each with varying suitability for business devices:

Backup Method	Where the Key Lives	Best For	Business-Ready?
Microsoft Entra ID	The device object in Entra ID	Entra-joined or hybrid-joined business devices	Yes, recommended default
Active Directory	The computer object in on-premises AD	Legacy or hybrid domain-joined fleets	Yes, for hybrid environments
Microsoft Account	account.microsoft.com under the signed-in personal account	Personal devices	No, avoid for corporate assets
USB Flash Drive	A plain text file saved to removable media	Air-gapped machines	Only with strict physical custody controls
Printed Copy	A physical printout in a secured location	High-security offline backups	Only as a secondary backup

For business fleets, storing the key in Entra ID is the default approach, with other methods serving as backups. The PowerShell command for this process is:

$BLV = Get-BitLockerVolume -MountPoint "C:"
BackupToAAD-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[1].KeyProtectorId

Step 8: Deploy BitLocker Fleet-Wide With Microsoft Intune

For larger organizations, deploying BitLocker on a machine-by-machine basis is impractical. Microsoft Intune allows for the enforcement of BitLocker policies across all devices automatically. In the Intune admin center, navigate to Endpoint security, then Disk encryption, to create a new policy. Key settings include requiring additional authentication at startup and specifying encryption methods.

Assign the policy to a device group, ensuring that any new machines added to that group automatically inherit the policy. Intune checks compliance regularly, flagging any devices that fall out of compliance.

Step 9: Enforce TPM+PIN for Pre-Boot Authentication

While TPM-only protection is convenient, it allows anyone who powers on the laptop to bypass the initial security checkpoint. Adding a PIN enhances security but introduces an additional prompt at every boot. To add a PIN protector to an already-encrypted drive, use:

Add-BitLockerKeyProtector -MountPoint "C:" -TpmAndPinProtector -Pin (ConvertTo-SecureString "654321" -AsPlainText -Force)

Replace the placeholder PIN with a user-defined value during rollout. It’s advisable to inform the help desk about this change to manage potential support calls effectively.

Step 10: Verify Encryption Status and Test Recovery

Verification is crucial. To check the encryption status, use:

Get-BitLockerVolume -MountPoint "C:" | Format-List *

Ensure that the VolumeStatus reads “FullyEncrypted,” EncryptionPercentage is at 100, and ProtectionStatus is “On.” Testing the recovery key is equally important; simulate a recovery scenario on a test device to confirm the process works as intended.

Step 11: Build the Complete Deployment Script

Integrating the steps into a single script can streamline the deployment process. This script should check prerequisites, enable encryption, and escrow the recovery key in one go. This approach ensures a repeatable, auditable rollout.

Common Pitfalls When Rolling Out BitLocker

• Skipping recovery key backup: Always confirm the backup succeeded before proceeding with encryption.
• Assuming Home edition machines are covered: Device Encryption is not equivalent to BitLocker.
• Defaulting to used-space-only on drives with existing data: This can leave recoverable fragments in unencrypted space.
• Neglecting to test the recovery key: A backed-up key must be verified to ensure it functions correctly.
• Implementing TPM+PIN without notifying the help desk: This can lead to a surge in support tickets.
• Allowing laptops to sleep during encryption: This can significantly prolong the encryption process.
• Treating firmware updates as routine: Always suspend protection before updates to avoid unexpected recovery prompts.

Troubleshooting: 8 BitLocker Problems and Fixes

Common issues with BitLocker can typically be resolved by identifying the symptoms and applying the appropriate fixes:

Symptom	Likely Cause	Fix
Error 0x80090016, “TPM not ready for use”	TPM is disabled in UEFI firmware	Enable TPM in the UEFI/BIOS menu
“This device can’t use a Trusted Platform Module”	Firmware is in legacy BIOS mode	Switch to UEFI mode
BitLocker option missing from Settings	Device is running Windows 11 Home	Upgrade to Pro or use Device Encryption
Encryption stuck at the same percentage	Encryption paused due to power loss	Plug in the charger and resume
Recovery screen appears without the key	The recovery key was never backed up	No shortcut; this is why backup is critical
ProtectionStatus shows Off after reboot	A protector was suspended during an update	Run manage-bde -protectors -enable C:
Unexpected recovery prompt after a BIOS update	Firmware update changed boot measurements	Run Suspend-BitLocker before updates
Intune reports device as non-compliant	The drive is encrypted, but the key was not escrowed	Re-run the BackupToAAD-BitLockerKeyProtector step

Advanced Tips for Hardened, Audit-Ready Deployments

Once the basic rollout is stable, consider implementing additional controls to enhance security:

• Suspend before maintenance: Use Suspend-BitLocker to avoid accidental recovery prompts during updates.
• Enable Kernel DMA Protection: This protects against direct memory access attacks on unlocked machines.
• Consider Network Unlock: This allows domain-joined desktops to skip the PIN when on a trusted network.
• Rotate recovery passwords after offboarding: Generate new passwords for departing employees.
• Audit compliance at the fleet level: Use Intune’s compliance dashboard for a comprehensive overview.

How BitLocker Maps to the ACSC Essential Eight

While full-disk encryption does not have a dedicated line item in the Essential Eight framework, it is integral to the requirement for protecting data on portable devices and laptops. Assessors generally expect to see documentation confirming that BitLocker is enabled, that XTS-AES 256 is the cipher in use, and that recovery keys are securely stored in Entra ID or Active Directory.

Documenting compliance is crucial, as it is straightforward to enable BitLocker on each laptop, but proving that every device has an active, retrievable recovery key is a more complex task. This is why the deployment process and verification steps are essential for maintaining compliance.

Frequently Asked Questions

Does BitLocker slow down my PC?

Modern CPUs with AES-NI hardware acceleration minimize performance impact, with the initial encryption pass being the only noticeable slowdown.

Can I use BitLocker on Windows 11 Home?

No, Windows 11 Home includes only Device Encryption, which lacks the full feature set of BitLocker.

What happens if I lose the recovery key and the TPM fails?

The data becomes unrecoverable. This highlights the importance of backing up the recovery key before encryption.

Does BitLocker protect against ransomware?

No, BitLocker protects data at rest but does not guard against ransomware attacks that occur while the system is running.

Is XTS-AES 256 required for Essential Eight compliance?

While not explicitly mandated, XTS-AES 256 is the expected standard among Australian assessors.

Can I enable BitLocker without a TPM?

Technically yes, but it requires a USB startup key, which complicates operational processes.

How long does full encryption actually take?

On an NVMe SSD, full encryption typically takes one to three hours, depending on the amount of data stored.

Does BitLocker work with dual-boot setups or external drives?

BitLocker can encrypt external drives, but dual-boot configurations can complicate the encryption process.