BitLocker on Windows 11: when to enable it, and how not to lock yourself out
BitLocker protects data at rest, not a running PC. Learn the TPM requirements, recovery key, suspend procedure and the mistakes that cause lockouts.
- Build
- 26300.9457
- Edition
- Pro / Enterprise
- Architecture
- x64
- Support
- Documentation (E1)
- Evidence
- E1Official documentation
- Verified
- 2026-10-28
- Page type
- Task
The short answer
Section titled “The short answer”BitLocker encrypts the disk so that someone who removes it or boots another OS cannot read your files. It does not stop malware running inside your logged-in session, and it does not replace a backup.
Enable it when the device leaves your control (laptop, portable drive, shared office), after you have a recovery-key plan. The most common failure is not a broken algorithm; it is a lost key after a firmware update, motherboard swap or TPM reset.
What it protects
Section titled “What it protects”| Threat | BitLocker helps? | Why |
|---|---|---|
| Stolen laptop, disk removed | Yes | Data at rest is encrypted |
| Someone boots Linux/USB and reads files | Yes, if the volume is locked | The key is not available |
| Malware in your session | No | The OS is already unlocked |
| Ransomware | No | It encrypts files after you log in |
| Accidental deletion | No | Encryption is not backup |
| Lost recovery key + failed TPM | Makes it worse | You cannot decrypt |
Before you enable
Section titled “Before you enable”- Back up files. A BitLocker conversion is usually safe, but power loss/firmware bugs happen.
- Save the recovery key to your Microsoft account (if used), a password manager and a printed/offline copy.
- Check TPM and Secure Boot.
tpm.msc,msinfo32. TPM 2.0 + UEFI + Secure Boot is the modern baseline. - Know the firmware update procedure. Some BIOS/TPM updates require suspending BitLocker first.
- Plan dual boot. Linux cannot read a locked BitLocker volume; sharing it read-write is a bad idea.
TPM-only or TPM+PIN?
Section titled “TPM-only or TPM+PIN?”| Protector | Unlock | Best for | Trade-off |
|---|---|---|---|
| TPM only | TPM releases the key at boot | Fixed desktop, low theft risk | A cold-boot/evil-maid attack is easier than with a PIN |
| TPM + PIN | TPM + a pre-boot PIN | Laptop that leaves the office | PIN can be forgotten; more support calls |
| TPM + PIN + USB | TPM + PIN + startup key | High-risk portable device | Losing the USB is another lockout path |
| Password only | Pre-boot password | Legacy/no TPM | Weaker; not the modern default |
Pick the weakest protector you will actually operate. A PIN nobody can remember becomes a recovery event.
Device encryption vs BitLocker management
Section titled “Device encryption vs BitLocker management”“Device encryption” is the automatic, limited experience on supported modern devices. “Manage BitLocker” exposes TPM/PIN, recovery-key export and additional drives. Do not assume the Settings page and manage-bde show the same options on every edition.
Enable it
Section titled “Enable it”Settings (device encryption)
Section titled “Settings (device encryption)”On a supported modern device: Settings → Privacy & security → Device encryption. If the device supports it, this may be automatic. Confirm that the recovery key is saved.
BitLocker management
Section titled “BitLocker management”For Pro/Enterprise: Manage BitLocker or:
Get-BitLockerVolumemanage-bde -status C:Enable with the wizard, choose TPM or TPM + PIN. A PIN adds a pre-boot secret; it also adds a lockout/recovery path. For a laptop at risk of theft, TPM + PIN is stronger against a powered-off attack; for a fixed desktop, TPM-only is simpler.
Verify, do not assume
Section titled “Verify, do not assume”manage-bde -status C:shows Percentage Encrypted: 100% and Protection Status: On.manage-bde -protectors -get C:lists the TPM/PIN/password/recovery key.- Open the recovery key URL/account and confirm the key is there.
- Reboot once. A machine that has never rebooted after encryption is not verified.
Suspend for firmware updates
Section titled “Suspend for firmware updates”Before a BIOS/UEFI/TPM update, suspend protection for one reboot:
manage-bde -protectors -disable C: -RebootCount 1Update the firmware, boot Windows, then confirm protection is back on. Do not leave BitLocker suspended indefinitely.
Recovery
Section titled “Recovery”At the recovery prompt, enter the 48-digit recovery key. If you only have a key ID, you still need the key itself. After recovery, re-enable protection and investigate why it triggered (TPM change, boot order, firmware, hardware).
What not to do
Section titled “What not to do”- Do not store the only key on the encrypted disk.
- Do not enable BitLocker and skip the backup in the same ten minutes.
- Do not disable Secure Boot or change boot order casually after encryption.
- Do not clone an encrypted disk to dissimilar hardware and expect it to boot.
- Do not use a “BitLocker cracker” from a random site. It is either malware or a recovery-key guessing tool.