How to Enable BitLocker in Windows 10 and 11 (Step by Step)
BitLocker encrypts an entire drive, so a lost laptop or a stolen external disk is just scrambled data to whoever finds it. Turning it on takes a few minutes. The part that catches people out is not the encryption, it is the recovery key: lose it at the wrong moment and the data is gone for good. This guide walks through enabling BitLocker on a data drive step by step with real screenshots, then covers the operating system drive, the PowerShell equivalents, and the mistakes worth avoiding.
The screenshots come from Windows 11, encrypting a spare volume (E:). The steps are the same on Windows 10, which reached end of support on 14 October 2025, so if you are still on it, encrypting your drives matters even more.
What BitLocker protects, and what it does not
BitLocker protects data at rest. If someone removes the drive, or boots the machine from another operating system, they cannot read the files without a key. It does nothing about malware running while you are logged in, and it does not stop someone who knows your password or holds your unlocked laptop. Think of it as the lock on the door of a house, not an alarm system.
Microsoft’s documentation also notes that BitLocker works best together with a TPM (Trusted Platform Module), which checks that the device has not been tampered with while it was switched off. A PIN or a startup key can be added on top for multifactor protection of the operating system drive.
Before you start: a short checklist
- Windows edition. Full BitLocker can be enabled on Windows Pro, Enterprise and Education. Windows Home has a simpler feature called device encryption that turns on automatically on supported hardware; it encrypts the system drive and fixed drives, but not external USB drives.
- Administrator rights. You need to be a local administrator to turn BitLocker on for the operating system drive or a fixed data drive. Standard users can manage it on removable drives.
- A safe place for the recovery key. Decide where it will live before you click anything. A copy in your Microsoft account plus a printed or offline copy is a sensible pair.
- A backup of anything irreplaceable. Encryption is reliable, but a power cut or a failing disk halfway through is not the moment to discover you have no backup.
- The right file system. The Windows drive itself must be NTFS. Removable drives formatted as NTFS, FAT16, FAT32 or exFAT can all be encrypted with BitLocker To Go, so you do not need to reformat a USB stick first.
You do not need free space equal to the size of your data. BitLocker encrypts in place, in the background, and the computer stays usable while it works.
Step 1: Turn on BitLocker for a drive
Open File Explorer, go to This PC, right-click the drive you want to encrypt and choose Turn on BitLocker. On Windows 11 the option sits in the top part of the context menu; if it is missing, see the troubleshooting section below.
Step 2: Choose how you will unlock the drive
Tick Use a password to unlock the drive and type a password twice. Use a long passphrase with a mix of characters, and store it in a password manager. A smart card is the alternative if you have one.
Step 3: Back up the recovery key
This is the most important screen. The recovery key is a 48-digit number that unlocks the drive if you forget the password. The wizard offers four places to keep it: your Microsoft account, a USB flash drive, a file, or a printout.
If you save it to a file, do not store it on the drive you are encrypting, because then it is locked away with everything else. Save it to a different drive or a USB stick, and keep a second copy somewhere separate.
The file name contains a key ID (a GUID). It identifies which recovery key belongs to which drive, which matters later if you have several. It is not the key itself.
Step 4: Choose how much of the drive to encrypt
Windows offers two options. Encrypt used disk space only is much faster and is meant for new drives and new PCs, because any data written afterwards is encrypted automatically. Encrypt entire drive is slower but is the right choice for a drive that has already been in use, because deleted files can still leave recoverable remnants in the free space, and a full encryption covers those too. Microsoft describes used-space-only as faster but not the most secure option for that reason.
Step 5: Choose the encryption mode
New encryption mode (XTS-AES) is the right pick for fixed drives that will stay in this PC. Compatible mode is only needed for a drive that must also work on Windows versions older than Windows 10 version 1511 (for example Windows 7 or 8.1), which cannot read the newer mode.
Click Start encrypting. The drive stays usable while it encrypts. If the computer is shut down or loses power, encryption resumes where it stopped.
Step 6: Check that it worked
When encryption finishes, the drive shows a padlock icon in File Explorer.
The next time the drive is locked (after a restart, or when a removable drive is plugged in again), you are asked for the password before you can open it.
The same thing from PowerShell
Everything above can be done from an elevated PowerShell window, which is handy for scripting or for machines without much of a graphical setup. The order matters: create the recovery password first, so the drive is never encrypted without a way back in.
Enable-BitLocker -MountPoint "E:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -RecoveryPasswordProtector
Add-BitLockerKeyProtector -MountPoint "E:" -PasswordProtector
(Get-BitLockerVolume -MountPoint "E:").KeyProtectorEnable-BitLocker -MountPoint "E:"starts encryption of drive E:.-EncryptionMethod XtsAes256picks the cipher (XtsAes128is the default on most systems).-UsedSpaceOnlyencrypts only the used part, as in step 4; leave it out to encrypt the whole drive.-RecoveryPasswordProtectorcreates the 48-digit recovery password as the first protector. It is stored on the volume’s key protector list, so read it from the third command and save it somewhere safe straight away, before you do anything else.Add-BitLockerKeyProtector ... -PasswordProtectoradds the password you will type to unlock the drive; PowerShell asks you to enter it as a secure string.Get-BitLockerVolumeshows the encryption percentage and protection status, and itsKeyProtectorlist shows each protector with its ID.
The classic command-line tool works too. manage-bde -status E: shows the state, manage-bde -protectors -get E: lists the key protectors and their IDs, manage-bde E: -lock locks a data drive on demand, and manage-bde -off E: decrypts it.
Encrypting the Windows (C:) drive
The operating system drive follows the same wizard, with a few extra conditions. Microsoft’s requirements are a TPM version 1.2 or later (Windows 11 machines have TPM 2.0 anyway), firmware that supports it, and a small separate system partition that Windows creates itself on a normal installation. Without a TPM, BitLocker can still protect the OS drive if you use a startup key on a USB stick. You first have to allow this in Group Policy (Computer Configuration, Administrative Templates, Windows Components, BitLocker Drive Encryption, Operating System Drives, Require additional authentication at startup, then tick Allow BitLocker without a compatible TPM). A startup password is discouraged and disabled by default because it is weak against brute force.
Two habits will save you trouble. First, suspend BitLocker before changing firmware or BIOS settings, updating the TPM firmware, or installing non-Microsoft software that modifies the boot configuration; otherwise the next boot may demand the recovery key. Suspend keeps the data encrypted but temporarily stores a clear key, and protection resumes afterwards. Second, keep the hard drive first in the boot order, since a changed boot order can also trigger recovery mode.
Troubleshooting
“Turn on BitLocker” is not in the menu
The usual causes are the Windows Home edition (use device encryption in Settings instead, or upgrade to Pro), a drive that is too small, an unsupported file system, a dynamic disk, or the hidden system partition. Check the edition under Settings, System, About.
Windows says there is no compatible TPM
Check that the TPM is enabled in the BIOS or UEFI settings (it may be called PTT on Intel or fTPM on AMD). If the machine genuinely has none, allow BitLocker without a TPM in Group Policy as described above and use a startup key on a USB drive for the OS drive, or encrypt a data drive, which does not need a TPM at all.
BitLocker keeps asking for the recovery key after a restart
That means something in the boot chain changed: a BIOS update, a changed boot order, a new hardware component, or a TPM reset. Enter the recovery key once, then suspend and resume protection so BitLocker re-learns the current state. If you have lost the key, see how to recover or regenerate a lost BitLocker recovery key.
Common questions
Does BitLocker slow the computer down?
Microsoft describes the overhead as small, typically single-digit percentages of storage throughput, and modern CPUs accelerate AES in hardware. Most people never notice it.
How long does encryption take?
It depends on the drive size and speed, and on whether you chose used space only. A mostly empty new drive finishes in minutes with used space only; a large, full hard disk can take hours, during which you can carry on working.
What if I lose both the password and the recovery key?
If no unlock method works, the data cannot be recovered. That is by design, and it is why the recovery key deserves as much care as the data itself.
Keep reading
- How to Regenerate Lost BitLocker Recovery Key — What to do if you lose the recovery key.
- Top 5 Windows Security Tips to Protect Your PC From Malware — More Windows protection basics.
- Windows Boot Process Step by Step (and How to Fix Each Stage) — How boot and encryption interact.
Sources
- Microsoft Learn: BitLocker overview (editions, TPM, requirements, device encryption)
- Microsoft Learn: BitLocker FAQ (BitLocker To Go file systems, used-space-only encryption, recovery keys, suspend, performance)
- Microsoft Learn: Enable-BitLocker cmdlet
- Microsoft Learn: manage-bde command reference
