Enable BitLocker on Windows 11: Save and Verify Your Recovery Key

BitLocker Drive Encryption can be enabled on a Windows 11 Pro, Enterprise, Education, Pro Education, or SE PC in about 15–45 minutes, depending on drive size and whether you encrypt used space or the entire drive. Windows 11 Home uses the simpler Device encryption feature on compatible hardware instead. These steps protect the Windows system drive (C:) with the PC’s TPM and create a recovery key you must keep outside the PC.

Before you start​

• Sign in with an administrator account.
• Connect a laptop to AC power.
• Back up important files first. BitLocker normally runs safely in the background, but encryption changes the drive’s security state.
• Have a safe place for the 48-digit recovery key:
  • Personal device: Microsoft account, printout, or USB drive stored separately.
  • Work or school device: Microsoft Entra ID or your organization’s Active Directory, as directed by IT.
• Do not enable BitLocker yourself if the PC is managed by an employer or school unless its IT policy permits it.

BitLocker is not ransomware protection and does not protect files while Windows is already unlocked. It protects data at rest if the drive is removed, the PC is lost, or someone attempts to boot it outside its trusted configuration.

Enable BitLocker in 11 steps​

1. Confirm that you have a supported Windows edition​

1. Press Windows + R.
2. Type winver and press Enter.
3. Check the edition shown.

Full BitLocker management is available on Windows 11 Pro, Enterprise, Education, Pro Education, and SE. If you have Windows 11 Home, open Settings > Privacy & security > Device encryption instead. If that page is absent, the device does not meet the requirements for Device encryption.

2. Check the TPM​

1. Press Windows + R.
2. Type tpm.msc and press Enter.
3. Confirm that the status says The TPM is ready for use.

A TPM is strongly recommended because it verifies key boot components before releasing the drive key. BitLocker can work without one, but that requires a startup key or password and requires a policy change first.

3. Check whether BitLocker is already enabled​

1. Open Start.
2. Search for Manage BitLocker and open it.
3. Under Operating system drive, look at drive C:.

If it says BitLocker on, do not repeat the setup. Select Back up your recovery key if you need an additional backup, then skip to verification.

4. Start the BitLocker wizard​

1. In BitLocker Drive Encryption, expand Operating system drive.
2. Select Turn on BitLocker next to C:.
3. If prompted, choose Let BitLocker automatically unlock my drive.

For most personal PCs, TPM-only startup protection is the practical default: Windows starts normally unless BitLocker detects a significant boot or firmware change.

5. Save the recovery key before proceeding​

Choose one or more recovery-key options presented by the wizard.

• Save to your Microsoft account: Best for an unmanaged personal PC signed in with a Microsoft account.
• Save to a file: Save it to a network location or removable storage—not to C:.
• Print the recovery key: Keep the printout in a secure location away from the PC.
• Save to a USB flash drive: Keep the USB drive separate from the laptop.

Warning: Anyone with the 48-digit recovery key can unlock the encrypted drive. Do not email it to yourself, store it in an unprotected document on the PC, or keep the USB key in the laptop bag.
For a work or school PC, confirm with IT that the key has been escrowed in Microsoft Entra ID or Active Directory. Microsoft Support cannot retrieve or recreate a lost recovery key.

6. Choose how much of the drive to encrypt​

Select one of the wizard’s options:

• Encrypt used disk space only: Appropriate for a new PC or a newly installed Windows drive that has never contained sensitive unencrypted data.
• Encrypt entire drive: Choose this for an existing PC or any drive that has held data before.

Full-drive encryption takes longer because it encrypts free space as well as currently used sectors. This matters because deleted files can remain recoverable in unencrypted free space until overwritten.

7. Choose the encryption mode​

1. Select New encryption mode for the internal Windows drive on a Windows 11 PC.
2. Select Compatible mode only when the drive may be moved to an older Windows device.

For an internal C: drive that will remain in its current PC, use New encryption mode.

8. Run the BitLocker system check​

1. Select Next.
2. Select Continue.
3. When prompted, select Restart now.

The restart performs the BitLocker system check. After Windows starts again, encryption begins. You can generally continue using the PC while it runs, but leave it connected to power and avoid forced shutdowns.

9. Verify that encryption is progressing​

1. Open Start, search for Manage BitLocker, and open it.
2. Confirm that the operating system drive reports that BitLocker is on or encryption is in progress.

For a detailed check, open Terminal (Admin) or Windows PowerShell (Admin) and run:
Get-BitLockerVolume -MountPoint C: | Format-List MountPoint,VolumeStatus,EncryptionPercentage,ProtectionStatus,EncryptionMethod,KeyProtector
A completed, protected drive should show:

• VolumeStatus : FullyEncrypted
• EncryptionPercentage : 100
• ProtectionStatus : On
• A TPM protector and a recovery-password protector.

You can also use:
manage-bde -status C:

10. Back up or confirm the recovery key again​

After BitLocker is enabled, return to Manage BitLocker, expand C:, and select Back up your recovery key.
For a personal Microsoft account, verify the key from another device before you rely on it. For an organization-managed PC, have IT confirm that the recovery information is available for the correct device.
Windows 11 version 24H2 and later can show a hint on the BitLocker recovery screen identifying the Microsoft account associated with the key, but that hint is not a substitute for recording where the key is stored.

11. Plan for firmware updates and recovery​

Before a BIOS, UEFI, or TPM firmware update, suspend protection rather than turning BitLocker off.

1. Open Terminal (Admin).
2. Run:

Suspend-BitLocker -MountPoint "C:" -RebootCount 1

1. Install the firmware update and restart as instructed.
2. Confirm that BitLocker protection is back on:

Get-BitLockerVolume -MountPoint C: | Format-List ProtectionStatus
For firmware updates that require several restarts, use a higher reboot count or suspend protection until you manually resume it:
Suspend-BitLocker -MountPoint "C:" -RebootCount 0
Warning: A reboot count of 0 leaves protection suspended until you explicitly restore it. Run this as soon as maintenance is complete:
Resume-BitLocker -MountPoint "C:"

Optional: enable BitLocker from PowerShell​

Use PowerShell when you need a scriptable method. Open Terminal (Admin) and run:

Enable-BitLocker C: -TpmProtector
Add-BitLockerKeyProtector -MountPoint C: -RecoveryPasswordProtector

Then inspect the protectors:
(Get-BitLockerVolume -MountPoint C:).KeyProtector
For a Microsoft Entra-joined device, an administrator can back up a specific recovery-password protector to Entra ID with:
BackupToAAD-BitLockerKeyProtector -MountPoint C: -KeyProtectorId "{GUID}"
Replace {GUID} with the recovery-password protector ID returned by Get-BitLockerVolume. Include the braces.
Do not use a script that silently enables BitLocker across business PCs until recovery-key escrow, Windows Recovery Environment availability, TPM status, existing third-party encryption software, and Intune or Group Policy conflicts have been reviewed.

If BitLocker asks for a recovery key​

A recovery prompt can follow a firmware change, boot configuration change, TPM issue, repeated PIN failures, or suspected tampering.

1. Note the first eight characters of the Recovery Key ID shown on screen.
2. From another device, locate the matching key in the Microsoft account, work or school account, Active Directory, USB drive, saved file, or printout chosen during setup.
3. Enter the matching 48-digit key.

If the recovery key cannot be found, Windows cannot decrypt the drive. Resetting the PC can reinstall Windows, but it removes the encrypted data.

---

References​

1. Primary source: tech-insider.org
   Published: 2026-07-19T15:09:55+00:00
   
   

   Enable BitLocker on Windows 11: 11 Steps, 45 Min [2026]

   Enable BitLocker on Windows 11: check TPM, back up recovery keys and deploy encryption fleet-wide with Intune. 2026 guide.

   tech-insider.org
2. Official source: learn.microsoft.com
   
   

   Encrypt Windows devices with BitLocker using Intune - Microsoft Intune | Microsoft Learn

   Use Microsoft Intune policy to manage BitLocker encryption on Windows devices, including silent encryption and Personal Data Encryption.

   learn.microsoft.com
3. Official source: support.microsoft.com
   
   

   Find your BitLocker recovery key | Microsoft Support

   Learn how to find your BitLocker recovery key in Windows.

   support.microsoft.com