# BitLocker on Windows 11: when to enable it, and how not to lock yourself out

> BitLocker protects data at rest, not a running PC. Learn the TPM requirements, recovery key, suspend procedure and the mistakes that cause lockouts.

**Tested on**

- Build: 26300.9457
- Edition: Pro / Enterprise
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-28

## The short answer

BitLocker encrypts the disk so that someone who removes it or boots another OS cannot read your files. It does **not** stop malware running inside your logged-in session, and it does **not** replace a backup.

Enable it when the device leaves your control (laptop, portable drive, shared office), after you have a recovery-key plan. The most common failure is not a broken algorithm; it is a lost key after a firmware update, motherboard swap or TPM reset.

## What it protects

| Threat | BitLocker helps? | Why |
|---|---|---|
| Stolen laptop, disk removed | Yes | Data at rest is encrypted |
| Someone boots Linux/USB and reads files | Yes, if the volume is locked | The key is not available |
| Malware in your session | No | The OS is already unlocked |
| Ransomware | No | It encrypts files after you log in |
| Accidental deletion | No | Encryption is not backup |
| Lost recovery key + failed TPM | Makes it worse | You cannot decrypt |

## Before you enable

1. **Back up files.** A BitLocker conversion is usually safe, but power loss/firmware bugs happen.
2. **Save the recovery key** to your Microsoft account (if used), a password manager and a printed/offline copy.
3. **Check TPM and Secure Boot.** `tpm.msc`, `msinfo32`. TPM 2.0 + UEFI + Secure Boot is the modern baseline.
4. **Know the firmware update procedure.** Some BIOS/TPM updates require suspending BitLocker first.
5. **Plan dual boot.** Linux cannot read a locked BitLocker volume; sharing it read-write is a bad idea.

> **Danger: No key, no data**
>
> If the TPM is cleared, the motherboard is replaced or the recovery key is lost, the data is gone. There is no “Microsoft can unlock it” support path for a personal device.

## TPM-only or TPM+PIN?

| Protector | Unlock | Best for | Trade-off |
|---|---|---|---|
| TPM only | TPM releases the key at boot | Fixed desktop, low theft risk | A cold-boot/evil-maid attack is easier than with a PIN |
| TPM + PIN | TPM + a pre-boot PIN | Laptop that leaves the office | PIN can be forgotten; more support calls |
| TPM + PIN + USB | TPM + PIN + startup key | High-risk portable device | Losing the USB is another lockout path |
| Password only | Pre-boot password | Legacy/no TPM | Weaker; not the modern default |

Pick the weakest protector you will actually operate. A PIN nobody can remember becomes a recovery event.

### Device encryption vs BitLocker management

“Device encryption” is the automatic, limited experience on supported modern devices. “Manage BitLocker” exposes TPM/PIN, recovery-key export and additional drives. Do not assume the Settings page and `manage-bde` show the same options on every edition.

## Enable it

### Settings (device encryption)

On a supported modern device: **Settings → Privacy & security → Device encryption**. If the device supports it, this may be automatic. Confirm that the recovery key is saved.

### BitLocker management

For Pro/Enterprise: **Manage BitLocker** or:

```powershell
Get-BitLockerVolume
manage-bde -status C:
```

Enable with the wizard, choose **TPM** or **TPM + PIN**. A PIN adds a pre-boot secret; it also adds a lockout/recovery path. For a laptop at risk of theft, TPM + PIN is stronger against a powered-off attack; for a fixed desktop, TPM-only is simpler.

## Verify, do not assume

- `manage-bde -status C:` shows **Percentage Encrypted: 100%** and **Protection Status: On**.
- `manage-bde -protectors -get C:` lists the TPM/PIN/password/recovery key.
- Open the recovery key URL/account and confirm the key is there.
- Reboot once. A machine that has never rebooted after encryption is not verified.

## Suspend for firmware updates

Before a BIOS/UEFI/TPM update, suspend protection for one reboot:

```powershell
manage-bde -protectors -disable C: -RebootCount 1
```

Update the firmware, boot Windows, then confirm protection is back on. Do not leave BitLocker suspended indefinitely.

## Recovery

At the recovery prompt, enter the 48-digit recovery key. If you only have a key ID, you still need the key itself. After recovery, re-enable protection and investigate why it triggered (TPM change, boot order, firmware, hardware).

## What not to do

- Do not store the only key on the encrypted disk.
- Do not enable BitLocker and skip the backup in the same ten minutes.
- Do not disable Secure Boot or change boot order casually after encryption.
- Do not clone an encrypted disk to dissimilar hardware and expect it to boot.
- Do not use a “BitLocker cracker” from a random site. It is either malware or a recovery-key guessing tool.

## Sources

- [Microsoft — BitLocker overview](https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/)
- [Microsoft — BitLocker recovery](https://support.microsoft.com/en-us/windows/security/encryption/find-your-bitlocker-recovery-key)
- [Microsoft — Device encryption](https://support.microsoft.com/en-us/windows/security/encryption/device-encryption-in-windows)

---

Source: https://windows.homes/en/windows/security/bitlocker/