How to Enable BitLocker on Windows 10/11: Methods and Tips

1. What is BitLocker?

BitLocker is a built-in drive encryption feature in Windows that helps protect your data from unauthorized access. It encrypts the data on your drive so that others cannot easily read your files if your computer is lost, stolen, or accessed without proper authorization.

With BitLocker enabled, you may use a Trusted Platform Module (TPM), a startup PIN, or other supported authentication methods to help protect access to an encrypted drive. Windows can also prompt you to save a BitLocker recovery key, which is essential for regaining access if normal unlocking methods fail.

2. How to Enable BitLocker on Windows 11 and Windows 10

Before enabling BitLocker, back up important files, connect your laptop to power, and confirm your edition under Settings > System > About.

Method 1: Turn on BitLocker through Control Panel

Control Panel is the clearest option for users deciding enabling BitLocker without writing commands. It guides you through recovery-key storage and encryption choices.

• Open Start, search for Manage BitLocker, and open it. Alternatively, go to Control Panel > System and Security > BitLocker Drive Encryption.

  

• Locate the Windows drive and select Turn on BitLocker. Complete the hardware checks and follow any startup-unlock prompts.

  

• Save the recovery key to an available account, a separate USB drive, a secure location outside this computer, or a printed copy.

• Choose how much of the drive to encrypt:

  • Encrypt used disk space only: Recommended for new PCs or drives that have never stored sensitive data (faster).
  • Encrypt entire drive: Recommended for used drives that previously contained files (more thorough, including deleted data).

• Select the encryption mode:

  • New encryption mode: Best if the drive will only be used on this Windows 10/11 computer.
  • Compatible mode: Choose this if the drive needs to work with older Windows versions.

• Check the box Run BitLocker system check (recommended), then click Continue and restart your computer when prompted.

After restart, BitLocker will begin encrypting the drive in the background. You can check the progress anytime in Manage BitLocker.

Method 2: Enable BitLocker Using PowerShell

• Open Windows PowerShell as administrator. Check the starting state:

  $ Get-BitLockerVolume -MountPoint "C:"

• If the drive is unencrypted and has no recovery password protector, create one:

  $ Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector

• Display the recovery information and securely save the generated 48-digit password outside this computer:

  $ (Get-BitLockerVolume -MountPoint "C:").KeyProtector

• After verifying the backup, start encryption with TPM protection:

  $ Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes128 -TpmProtector

• Restart if prompted. Run Get-BitLockerVolume again to monitor EncryptionPercentage and ProtectionStatus.

  $ Get-BitLockerVolume

  Do not add -SkipHardwareTest merely to avoid restarting; the startup test helps identify problems before encryption proceeds.

Method 3: Enable BitLocker via Command Line

Command Prompt is useful when you prefer manage-bde or need to inspect an existing configuration. Run these commands in an elevated Command Prompt on a TPM-equipped PC.

• Check whether C: is already encrypted:

  $ manage-bde -status C:

• For an unencrypted drive, create a recovery password protector:

  $ manage-bde -protectors -add C: -RecoveryPassword

• Securely record the displayed recovery password and its identifier outside the PC. Confirm that the backup is readable before continuing.

• Start encryption:

  $ manage-bde -on C:

• Complete any restart request, then run manage-bde -status C: again. Confirm that encryption finishes and protection is on.

  $ manage-bde -status C:

If BitLocker could not be enabled, record the complete error and code. Check the Windows edition, administrator privileges, TPM readiness, and conflicting organizational policies before retrying. Do not clear the TPM as a routine fix.

⚡ Forgot Your BitLocker Recovery Key Find It and Remove Encryption with 4DDiG Partition Manager

First check the Microsoft account used to set up the PC at https://aka.ms/myrecoverykey. Also check printed copies, USB backups, and your work or school IT department.

If failed to find, 4DDiG Partition Manager can help you find the recovery key, unlock the selected partition, and optionally decrypt it. This can simplify handling a partition you want to access or stop encrypting. .

• Install and open 4DDiG Partition Manager on a Windows computer you can access. Open Toolkit > Remove BitLocker.

  FREE DOWNLOAD

  Secure Download

  BUY NOW
  

• Identify the encrypted partition by its disk, drive letter, and capacity, then select Unlock.

  

• Confirm the recovery-key search. If the program finds a key and unlocks the partition, copy the key to a secure location.

  

• Back up accessible files. If you intentionally want permanent decryption, choose Disable BitLocker and wait for completion before disconnecting the drive.

You may also like:

[7 Tips] How to Get BitLocker Recovery Key with Key ID in 2026

3. How to Enable BitLocker Without TPM on Windows 11?

To enable BitLocker without TPM on Windows 11, configure the startup-authentication policy on an edition supporting full BitLocker. This does not remove Windows 11’s separate TPM installation requirement.

• Press Windows + R, enter gpedit.msc, and press Enter.

• Open Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.

• Open Require additional authentication at startup. Select Enabled and check Allow BitLocker without a compatible TPM. Apply the change.

  

• Open Manage BitLocker and start the Windows-drive encryption wizard. Choose a USB startup key, or a startup password if policy permits it. For USB unlocking, the firmware must support reading the USB drive before Windows starts.

• Back up the recovery key separately, complete the encryption settings, and restart to test startup authentication. Keep the startup USB available for future boots.

For a TPM-related BitLocker could not be enabled error on a machine that has TPM hardware, first run tpm.msc and check readiness. Enabling an existing firmware TPM may be more appropriate than configuring non-TPM startup.

You may also like:

Fix "This Device Can't Use a Trusted Platform Module" (BitLocker Error) on Windows 11/10

More FAQs About Enabling BitLocker

1. How to Check If BitLocker is Enabled?

Run manage-bde -status C: as administrator. To confirm BitLocker Drive Encryption is enabled on the selected partition, check Protection Status as well as encryption progress. An encrypted drive with suspended protection is not equivalent to active protection.

2. Is BitLocker Enabled by Default?

Not universally. Eligible PCs can enable Device Encryption automatically during setup with a Microsoft or work/school account. Hardware, Windows configuration, account type, and organizational policies affect this behavior. Check the actual drive status.

3. Does Windows 10 Have BitLocker Automatic Device Encryption?

Yes. Compatible Windows 10 devices, including supported Home devices, can offer automatic Device Encryption. Full manual BitLocker management requires a qualifying edition. Device Encryption is a simplified experience using BitLocker technology; its availability should be checked on the individual PC.

Conclusion

Knowing how to enable BitLocker means choosing an appropriate unlock method and keeping recovery information accessible before encryption begins. Control Panel suits most individual users, while PowerShell and Command Prompt offer more direct administrative control. Check protection status after the process finishes, and use the non-TPM policy only when it fits your hardware and security needs.

For an existing encrypted partition, locate the recovery key first. If you prefer a guided workflow, consider 4DDiG Partition Manager’s documented key-search and removal feature, while keeping a backup and remembering that successful access still depends on available recovery information.