Description:

BitLocker Drive Encryption encrypts the Windows operating system drive, so the data can't be read if the laptop is lost, stolen or has its disk removed. It uses the TPM to check the boot process for tampering and creates a 48-digit recovery key for emergency access. 


Rationale:

  • Protects data on lost or stolen devices

  • Blocks offline attacks, such as removing the disk or booting another OS

  • Meets encryption-at-rest requirements (ISO 27001, SOC 2, HIPAA, PCI DSS, GDPR)

  • Gives auditors proof of encryption for device compliance checks


Impact:

  • Strong protection of data at rest with no change to how users log in

  • The first encryption can take from minutes to hours and may slightly slow the device

  • If the recovery key is lost and the TPM check fails, the data can't be recovered

  • Recovery keys must be stored and managed securely over time


Default Value:

BitLocker is turned off by default on Windows 10/11 Pro, Enterprise and Education. On new Windows 11 (24H2 and later) installs, device encryption may turn on automatically when the user signs in with a Microsoft or work account.


Pre-requisites:

  • Local Administrator rights

  • Windows 10/11 Pro, Enterprise or Education

  • TPM 1.2 or later (2.0 recommended) turned on in BIOS/UEFI

  • A safe place to store the recovery key (Microsoft/Entra ID account, AD, USB or password vault)

  • Laptop connected to AC power during encryption


Test Plan:

UI

  1. Click Start, search for Settings and open it (or press Windows + I).

  2. In the left pane, click Privacy & security.

  3. Under Security, click Device encryption.

  4. Check that the Device encryption toggle is On.

  5. Under Related settings, click BitLocker drive encryption. This opens the BitLocker Drive Encryption page.

  6. Confirm drive C: shows BitLocker on.

  1. If it shows BitLocker off, follow the Implementation Plan.

Note: If Device encryption isn't listed, search Manage BitLocker from Start to open the same BitLocker page.


PowerShell (Run as administrator)

  1. Click Start and search for PowerShell.

  2. Right-click Windows PowerShell and select Run as administrator.

  3. Click Yes on the User Account Control prompt. The window title should start with Administrator:.

  4. Check the BitLocker status of drive C:


            manage-bde -status

          

  1. Expected result: FullyEncrypted, On, 100. If not, follow the Implementation Plan.


Implementation Plan

UI

  1. Click Start, search for Settings, and open it (or press Windows + I).

  2. In the left pane, click Privacy & security and select Device encryption under Security.



  1. Under Related settings, click BitLocker drive encryption.



  1. Next to drive C:, click Turn on BitLocker.

  1. Back up the recovery key (Microsoft/Entra ID account, USB, file or print). Click Next.

  2. Select Encrypt used disk space only (new device) or Encrypt entire drive (device in use). Click Next.

  3. Select New encryption mode. Click Next.

  4. Tick Run BitLocker system check, click Continue and restart when asked.

  5. Encryption runs in the background. When it's done, drive C: shows BitLocker on.


PowerShell (Run as administrator)

  1. Click Start and search for PowerShell.

  2. Right-click Windows PowerShell and select Run as administrator.

  3. Click Yes on the User Account Control prompt. The window title should start with Administrator:.

  4. Add a recovery key protector:

       Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector

  1. Turn on BitLocker with the TPM:

       Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmProtector

  1. Show the recovery key and save it somewhere safe:

      (Get-BitLockerVolume -MountPoint "C:").KeyProtector | Where-Object KeyProtectorType 
       -eq   'RecoveryPassword'

  1. Restart the laptop to start encryption:

         Restart-Computer

Backout Plan

UI

  1. Open Start → search Manage BitLocker.

  2. Next to drive C:, click Turn off BitLocker and confirm.

  3. Decryption runs in the background. When it's done, drive C: shows BitLocker off.

  4. For temporary maintenance (such as a BIOS update), click Suspend protection instead.

PowerShell (Run as administrator)

# Turn off BitLocker and decrypt the drive

Disable-BitLocker -MountPoint "C:"

# Or suspend protection for one restart only

Suspend-BitLocker -MountPoint "C:" -RebootCount 1

Reference