BitLocker in Windows 11 and 10: How to Turn It On and Back Up the Key

A laptop left in a cab is a lost device. A laptop left in a cab without disk encryption is a data breach. BitLocker is the Windows feature that makes the difference: if the drive is encrypted, whoever finds the laptop sees a locked disk instead of your files, saved passwords and emails. Here is how BitLocker works, how to turn it on in Windows 11 and 10, and how to avoid the recovery-key panic that catches so many users.

What BitLocker does

BitLocker encrypts the entire drive with AES (XTS-AES 128-bit by default, 256-bit optional). When the PC starts, the TPM chip checks that the boot process hasn't been tampered with and then unlocks the drive automatically. You notice nothing. But if someone removes the SSD and connects it to another PC, or changes the boot configuration, the drive stays locked and asks for the 48-digit recovery key.

Which Windows editions have it?

• Windows 11/10 Pro, Enterprise and Education: full BitLocker with the management console and BitLocker To Go for USB drives.
• Windows 11/10 Home: a simpler Device Encryption feature on supported hardware. It uses the same technology and backs the key up to your Microsoft account.

Check under Settings > Privacy & security > Device encryption (Home) or Control Panel > BitLocker Drive Encryption (Pro).

Check if your drive is already encrypted

Many new laptops ship with encryption already on. Open Command Prompt as administrator:

manage-bde -status C:

Or in PowerShell:

Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, EncryptionPercentage, ProtectionStatus

"FullyEncrypted" with "Protection On" means you're covered. "Protection Off" means the data is encrypted but the key is stored in the clear, which is common while BitLocker is suspended.

Turn on BitLocker (Windows 11 Pro)

1. Open Control Panel > System and Security > BitLocker Drive Encryption.
2. Click Turn on BitLocker next to the C: drive.
3. Back up the recovery key. Choose your Microsoft account, a file on another drive, or print it. Work devices usually back it up to Active Directory or Entra ID automatically.
4. Choose Encrypt used disk space only for a new PC, or entire drive for a PC that has been in use.
5. Choose New encryption mode (XTS-AES) for the internal drive.
6. Tick Run BitLocker system check and restart. Encryption continues in the background; you can keep working.

Back up the recovery key properly

This is the step people skip and regret. You will be asked for the key after a BIOS update, a motherboard repair, a TPM reset or sometimes a major Windows update. Keep it in at least two places:

• Personal PC: your Microsoft account (account.microsoft.com/devices/recoverykey) plus a printed copy at home.
• Office PC: your IT team can see it in Entra ID or Active Directory. Make sure it shows there before you need it.

Already locked out? Follow how to find your BitLocker recovery key.

Suspend BitLocker before BIOS or firmware updates

Most "sudden" recovery screens in IT support come right after a BIOS update. Suspend protection for one reboot first:

Suspend-BitLocker -MountPoint "C:" -RebootCount 1

Run the update and restart. Protection resumes automatically after the reboot. Vendor tools from Dell, HP and Lenovo often do this for you, but don't rely on it.

BitLocker To Go for USB drives

Right-click the USB drive in File Explorer > Turn on BitLocker > set a password > save the recovery key. The drive will ask for the password on any Windows PC. For files you share with people outside your organization, a password-protected archive is often easier.

Adding a startup PIN (extra protection)

TPM-only mode protects against a stolen disk but unlocks automatically for anyone who powers on the laptop. For sensitive roles, add a pre-boot PIN through Group Policy (Require additional authentication at startup) and then:

manage-bde -protectors -add C: -TPMAndPIN

Common problems

"BitLocker waiting for activation"

The drive is encrypted but no key protector has been added yet. Open the BitLocker panel and click "Turn on", or add a TPM protector with manage-bde -protectors -add C: -tpm.

Recovery screen on every boot

Often caused by a docking station, a USB device or a changed boot order. Unplug accessories, enter the key once, then run manage-bde -protectors -disable C: followed by manage-bde -protectors -enable C: to reseal the TPM.

Does BitLocker slow the PC down?

On modern SSDs with hardware AES support, the difference is negligible in daily work.

FAQ

Can I turn BitLocker off?

Yes, from the same panel: "Turn off BitLocker" decrypts the drive. On a work device, your organization's policy will usually turn it back on.

Does BitLocker protect against ransomware?

No. It protects data when the device is powered off or stolen. While you're logged in, files are readable, so you still need backups and endpoint protection.

Can Microsoft see my files because the key is in my account?

The key is stored in your account so you can recover it. Treat your Microsoft account like the key to your house: strong password and MFA, ideally with passkeys.