- 26
Mar
Complete Guide to Deploying BitLocker Drive Encryption
Encrypting laptops and PCs is now a baseline expectation for most businesses: the UK GDPR names encryption as an example of an appropriate security measure for personal data, and a lost or stolen unencrypted laptop is a problem you do not want to explain. We wrote this guide in 2019 after spending around 18 months rolling out BitLocker for our clients, and it has been updated for Windows 11. It covers the common issues and foibles we have run across, and hopefully it will help your own rollout.
1. Which version of Windows?
Full BitLocker management is available on Windows 11 Pro, Enterprise and Education (and on Windows 10 Pro and above). Windows 11 Home does not include full BitLocker; on supported hardware it has a simpler “device encryption” feature instead, which gives you much less control over how and where recovery keys are kept. For a business rollout we recommend Pro or above.
Windows 10 reached the end of Microsoft support in October 2025, so if you are still running it, moving to Windows 11 is worth doing alongside the encryption project. The original version of this guide also covered Windows 7, where BitLocker needed the Ultimate edition and, without a TPM, a USB key to unlock the machine. Windows 7 has been out of support since January 2020 and should not be part of any new rollout.
2. TPM or not to TPM
BitLocker is designed to work with a TPM chip. Windows 11 requires TPM 2.0, so almost every current PC has one, but you will still meet machines without a usable TPM: older Windows 10 hardware, some consumer PCs and virtual machines. It is still possible to encrypt these, but you need to edit the Group Policy on the machine or domain to allow BitLocker without a compatible TPM:
Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives > Require additional authentication at startup
Tick Allow BitLocker without a compatible TPM. You will then have to unlock with a PIN/password or a USB key at every start.
If the PC does have a TPM, it needs to be enabled and ready before you turn on BitLocker. The TPM management console (run tpm.msc) shows its status. In some cases you will have to go into the BIOS/UEFI settings to enable the TPM, but never clear the TPM on a machine whose drive is already encrypted. We have also had to update the firmware of the TPM before BitLocker would enable, so if you have trouble, check the manufacturer’s support page for BIOS and TPM firmware updates.
3. IMPORTANT: before you begin
Before you start, we strongly recommend that you install any pending Windows updates and fully reboot the machine.
We have had a handful of machines where the drive thought it was encrypted but neither the password nor the recovery key would unlock it. The data was usually still recoverable from the disk, but what should be a 5-minute job became a 5-hour job to recover the data and rebuild the machine. When you have 50 machines to encrypt it is tempting to skip this step, but taking the extra time to update and reboot is worth it.
Also decide where recovery keys will be stored before you start (see step 5), and remember that BIOS/UEFI or firmware updates and hardware changes can trigger a BitLocker recovery prompt. Suspend BitLocker before applying a BIOS update, and make sure you can get at the recovery key if you do not.
4. Enabling BitLocker, step one: system check and preparation
You can use the manage-bde command-line tool to enable BitLocker, but we recommend sticking to the GUI wizard where possible to avoid mistakes. manage-bde must be run from an elevated command prompt and gives more control, but unless you are putting a deployment script together it is not worth the hassle.
Always run the BitLocker system check. There is never a reason not to, and you want to know it will all work. This first stage scans and prepares the computer, and it is where you will meet most of your problems.
TPM-related errors
If the computer has a TPM that has not been properly enabled or cleared, you will often get a TPM-related error. Go back to step 2: check the BIOS/UEFI, try to update the firmware, use the TPM management console, then try again. If all else fails you can use Group Policy to explicitly disable the use of the TPM.
“Drive could not be configured” and partition errors
The size and layout of the partitions can make this step fail. We see this most where manufacturers have done odd things with recovery partitions, or where the partitions use up the whole disk and leave no free space. BitLocker needs a separate unencrypted system partition to boot from (the EFI system partition on a UEFI machine), and the wizard will try to adjust the partitions for you; where it cannot, you will have to move, shrink or create partitions manually with a partition manager. Be very careful here, as deleting or damaging a partition can cause data loss and leave the PC unable to start. Back up first.
Unknown errors and “could not enable BitLocker”
Boot entries and the boot mode can cause problems. If you use a third-party boot loader, or an application has added its own boot entries, these can conflict with BitLocker, which needs the Windows boot loader to be the default entry. BitLocker is also much happier with UEFI boot than legacy BIOS boot. Windows 11 requires UEFI, but an older Windows 10 machine installed in legacy mode may need converting (Microsoft’s mbr2gpt tool does this) and its boot entries checking with msconfig. Be very careful: mistakes here can damage the boot records so that you cannot get into the PC.
The boot order in the BIOS/UEFI can also play a part. BitLocker can fail if the primary operating system drive is not first in the boot order. This is a particular issue on servers with network booting and RAID controllers, so you may need to disable devices that try to boot ahead of the main drive.
5. Enabling BitLocker, step two: settings
The first choice is how to secure the drive: TPM only, TPM with a PIN, or a USB key. If the option you want is missing, you will usually need to go back and change the Group Policy or prepare the TPM as in step 2. If you cannot enter a PIN whatever you do, just enable BitLocker with the TPM and add the PIN afterwards with manage-bde (see step 7).
After the system check you will need to configure the following:
- Either enter your PIN, or load a blank USB key, depending on the protection you chose. With TPM only you do not need to do either.
- Save your recovery key somewhere safe. If you lose it and something goes wrong, you will not be able to unlock the drive. Depending on how your PCs are managed, the key can be saved to the user’s Microsoft account, to your organisation’s Microsoft Entra ID or Active Directory, to a file or to paper. For a business we recommend keeping recovery keys centrally, in a place the IT team can reach, with a secure offline backup too. Never save the key to a drive you are planning to encrypt.
- Use the newer encryption mode (XTS-AES, shown as “new encryption mode” in the wizard). It is stronger, and there are only a handful of niche situations, such as removable drives that must work on older versions of Windows, where you would choose the compatible mode.
- Choose whether to encrypt used disk space only or the entire drive. We prefer to encrypt the whole drive, including empty space, but there are arguments for both, so choose what suits you.
6. Has it worked?
When the wizard finishes, BitLocker will ask you to reboot. Do it straight away: the system is in an unstable state until you do.
If you chose a PIN, you should be asked for it after the reboot. If you are not, that is the first sign that something has gone wrong. If you chose a USB key, it must stay plugged in for the first reboot; if you unplug it after the wizard, BitLocker assumes something is wrong and aborts. Once the first reboot has happened and encryption is under way, you can remove it. The TPM-only option gives no warning either way, so you will just have to see where you end up when Windows loads.
To see progress, open BitLocker Drive Encryption in the Control Panel, or run manage-bde -status from an elevated command prompt, which shows the percentage encrypted and the protection status. You need administrator rights to see this.
If things have not gone well, go back to step 2 and work through the list of possible problems:
- TPM issues?
- Group Policy issues?
- Pending Windows updates?
- Partition or drive issues?
- Boot issues?
- UEFI not enabled?
- Took out the USB key too soon?
Remember that the data is not fully protected until the encryption reaches 100%, so be patient and leave the PC on until it is done. Sometimes BitLocker stalls or fails before then, which we cover next.
7. Post-setup problems
In a handful of cases the encryption stalls before it reaches 100%. This can usually be fixed by booting into the Windows Recovery Environment (from Windows recovery or installation media) and letting BitLocker finish from there. You can use manage-bde -status at the command prompt to check progress. We suspect the cause is the operating system or a core application, such as antivirus, locking sectors on the disk while Windows is running.
Sometimes, because of oddness with the TPM or Group Policy, Windows refuses to let you enter a PIN. Once BitLocker has finished encrypting the drive you can usually add one with manage-bde, for example:
manage-bde -protectors -add C: -TPMAndPINIf something is preventing the PIN, you will usually get a more useful error message from this command, which helps with troubleshooting.
Finally, there will be occasions where BitLocker stalls at 99%. We have seen this on a couple of servers, and it seems to be related to one of the points above, most likely the boot order or the partitions. Work through the steps again and try to find where it is stalling.
We hope this guide helps you get up and running with BitLocker. If you have any other points to add, please mention them in the comments below.
If your business needs help rolling out BitLocker, or you would like a consultation, please get in touch.
Need a hand? Lennox IT provides IT support for businesses in Derby, Nottingham and across the East Midlands. Get in touch or see our IT support plans.
Last reviewed: October 2026.