Enable/Disable BitLocker Encryption in Windows

Your laptop holds more than files. It holds saved passwords, work documents, tax records, family photos, and often a logged-in browser session that opens your email. If the device is lost or stolen, a thief who removes the drive and plugs it into another computer can read all of it, no matter how strong your Windows password is. A login screen protects the operating system, not the data on disk.

BitLocker closes that gap. It is the full-disk encryption feature built into Windows, and it scrambles everything on a drive so that it can only be read with the right key. When the drive is unlocked through your normal sign-in, you notice nothing. When someone tries to read it from outside, they see meaningless data.

This guide explains how to turn BitLocker on and off using every common method: Settings, Control Panel, Command Prompt, PowerShell, and Group Policy. It also covers the requirements you should check first, how to protect your recovery key, and the mistakes that lock people out of their own computers.

What You Should Know Before You Start

Which Windows editions support BitLocker

Full BitLocker management is available in Windows 10 and Windows 11 Pro, Enterprise, and Education. Windows Home does not include the BitLocker control panel. Many Home devices instead offer a simplified feature called Device Encryption, which uses the same underlying technology but with fewer options. Whether you have it depends on your hardware.

Hardware requirements

BitLocker works best with a Trusted Platform Module (TPM), a security chip found on most PCs sold in the last several years. Windows 11 requires TPM 2.0, so any machine running it qualifies. You can check your own machine by pressing Windows + R, typing tpm.msc, and pressing Enter. The window shows whether a TPM is present and ready.

If you have no TPM, you can still use BitLocker on a Pro edition, but you must change a Group Policy setting and use a password or USB startup key instead. That procedure appears later in this guide.

Back up first, and keep your recovery key safe

Encryption modifies your whole drive. Power failures, interrupted processes, and user error are rare during encryption, but a backup of important files is cheap insurance. More important is the recovery key, a 48-digit number that unlocks the drive if Windows cannot verify the normal protections. This can happen after a BIOS update, a motherboard replacement, or certain hardware changes. Without the recovery key, the data is effectively gone. Windows will ask you to save it during setup, and you should store it somewhere other than the encrypted drive itself.

Methods to Enable BitLocker

Method 1: Using Settings (Windows 11 and 10)

This is the easiest route for most people.

1. Open Settings by pressing Windows + I.
2. Go to Privacy & security and select Device encryption. On Windows 10, go to Update & Security and then Device encryption.
3. Turn the toggle to On.

If you do not see a Device encryption page, your hardware or edition does not support it, and you should use one of the methods below. Note that on many devices, signing in with a Microsoft account automatically turns Device Encryption on and uploads the recovery key to that account. You can view it at account.microsoft.com/devices/recoverykey.

Method 2: Using Control Panel

This method gives you full control and works on Pro, Enterprise, and Education.

1. Press Windows + S, type Manage BitLocker, and open the result. You can also open Control Panel and go to System and Security and then BitLocker Drive Encryption.
2. Find the drive you want to protect. The operating system drive is listed first, followed by fixed data drives and removable drives.
3. Click Turn on BitLocker next to that drive.
4. Windows checks your system. If it finds a TPM, it proceeds. Otherwise it shows an error that points to the Group Policy fix described below.
5. Choose how to back up your recovery key. The options are saving it to your Microsoft account, saving it to a file, printing it, or saving it to a USB drive. Saving to a file or USB is fine, but never store it on the drive you are encrypting. Choose at least one and preferably two options.
6. Choose how much of the drive to encrypt. Encrypt used disk space only is much faster and ideal for a new PC. Encrypt entire drive is slower but safer for a drive that has been in use, because it also covers deleted data that could still be recovered.
7. Choose the encryption mode. New encryption mode (XTS-AES) is best for fixed drives in current Windows versions. Compatible mode is for removable drives you may plug into older Windows versions.
8. Leave Run BitLocker system check selected for system drives, then click Continue and restart when prompted.

Encryption continues in the background after the restart. You can keep working, although the computer may feel slightly slower until the process finishes.

Method 3: Using Command Prompt (manage-bde)

The manage-bde tool is useful for scripting, remote work, or when the graphical interface is unavailable.

1. Search for Command Prompt, right-click it, and choose Run as administrator.
2. Check the current state of all drives:

manage-bde -status

3. Add a recovery password protector to the C: drive:

manage-bde -protectors -add C: -RecoveryPassword

The command prints your 48-digit recovery key. Record it immediately.

4. Turn on BitLocker with the TPM protector and used-space-only encryption:

manage-bde -on C: -UsedSpaceOnly

5. Restart if prompted, and run manage-bde -status again to monitor the percentage encrypted.

Method 4: Using PowerShell

PowerShell offers the same capabilities with more readable commands.

1. Right-click the Start button and open Terminal (Admin) or Windows PowerShell (Admin).
2. Enable BitLocker on the C: drive with a recovery password and TPM protector:

Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -RecoveryPasswordProtector -TpmProtector

3. Display the recovery key so you can save it:

(Get-BitLockerVolume -MountPoint "C:").KeyProtector

4. Check progress:

Get-BitLockerVolume

The EncryptionPercentage field shows how far along the process is.

Method 5: Enabling BitLocker Without a TPM (Group Policy)

If Windows reports that a compatible TPM is not found, you can allow BitLocker to work with a password or USB key.

1. Press Windows + R, type gpedit.msc, and press Enter. This tool is available only on Pro, Enterprise, and Education.
2. Navigate to Computer Configuration, then Administrative Templates, Windows Components, BitLocker Drive Encryption, and finally Operating System Drives.
3. Double-click Require additional authentication at startup.
4. Select Enabled and make sure Allow BitLocker without a compatible TPM is checked.
5. Click Apply and OK, then run gpupdate /force in an elevated Command Prompt.
6. Return to Manage BitLocker and turn it on. You will now be asked to create a startup password or use a USB key.

This setup is less convenient than TPM-based protection, because you must enter the password each time the computer starts, but it is still strong encryption.

Encrypting removable drives (BitLocker To Go)

For USB sticks and external drives, open Manage BitLocker, find the drive under Removable data drives, and choose Turn on BitLocker. Pick a password or smart card to unlock it, save the recovery key, and select Compatible mode if you will use the drive on older computers. You can also right-click the drive in File Explorer and choose Turn on BitLocker.

Methods to Disable BitLocker

You might disable BitLocker when you are selling the computer, troubleshooting a hardware problem, or switching to a different encryption tool. Decryption rewrites the entire drive, so it can take from several minutes to a few hours depending on drive size and speed. Keep the laptop plugged in and avoid shutting it down in the middle.

Suspend instead of disable

Before removing encryption entirely, consider suspending it. This is the right choice before a BIOS or firmware update, because those changes can otherwise trigger a recovery prompt. Suspending leaves the data encrypted but temporarily stores the key in the clear. Open Manage BitLocker and click Suspend protection, or run manage-bde -protectors -disable C:. Protection resumes after the next restart, or when you choose Resume protection.

Method 1: Using Settings

1. Open Settings and go to Privacy & security, then Device encryption.
2. Switch the toggle to Off.
3. Confirm when asked. Decryption begins immediately.

Method 2: Using Control Panel

1. Open Manage BitLocker from the Start menu.
2. Locate the encrypted drive and click Turn off BitLocker.
3. Confirm in the dialog that appears. Windows warns that the drive will be decrypted.
4. Wait for the process to finish. You can close the window and keep using the PC, and progress continues in the background.

If the option is missing or greyed out, sign in with an administrator account. A policy set by your workplace or school may also be controlling the setting, in which case you will need to ask your IT department.

Method 3: Using Command Prompt

Open Command Prompt as administrator and run:

manage-bde -off C:

Check progress with manage-bde -status. When it reports Fully Decrypted and protection off, the process is complete.

Method 4: Using PowerShell

Open an elevated PowerShell window and run:

Disable-BitLocker -MountPoint "C:"

To decrypt every volume at once, use:

Get-BitLockerVolume | Disable-BitLocker

Monitor with Get-BitLockerVolume until the volume status reads FullyDecrypted.

Disabling through Group Policy

If an organization policy forces encryption, individual users cannot turn it off. Administrators can change the relevant settings under Computer Configuration, Administrative Templates, Windows Components, BitLocker Drive Encryption, then run gpupdate /force. Only do this when you are authorized to change the policy.

Troubleshooting Common Problems

Windows asks for a recovery key at every startup. This usually means the TPM sees a change it does not trust, such as a modified boot order or a firmware update. Enter the key, sign in, then suspend and resume protection from Manage BitLocker to re-seal the key.

The Turn on BitLocker option is missing. You are probably on Windows Home. Check Settings for Device encryption, or upgrade to Pro.

The TPM error appears. Open tpm.msc to confirm the chip is present and enabled. If it is disabled, switch it on in your computer’s firmware settings, where it may be called Intel PTT, AMD fTPM, or Security Device.

Encryption is stuck or very slow. Large drives take time, and a busy system slows the work. Leave the computer on power and idle for a while before assuming a fault.

You lost your recovery key. Check your Microsoft account, your work or school account, any printed copies, and USB drives. If none exist and the drive cannot be unlocked, the data cannot be recovered.

Best Practices

• Store the recovery key in at least two separate places, neither of which is the encrypted drive.
• Suspend protection before BIOS updates and major hardware changes.
• Keep regular backups, because encryption protects against theft, not against drive failure or ransomware.
• Use a strong sign-in method, such as a long password or Windows Hello PIN, since BitLocker relies on your Windows login once the drive is unlocked at startup.
• Do not disable BitLocker on a portable device unless you have a clear reason.

Conclusion

BitLocker is one of the most effective protections built into Windows, and turning it on takes only a few minutes of your attention. On a modern PC with a TPM, you can enable it from Settings or Control Panel, or script it with manage-bde and PowerShell. Without a TPM, a simple Group Policy change makes it possible on Pro editions. Disabling it follows the same paths in reverse, and suspending is a safer option than full decryption when you only need a temporary break for updates.

The single most important step is saving your recovery key before you do anything else. With the key stored safely and a current backup in place, BitLocker will quietly protect your data in the background and give you real peace of mind if your device ever goes missing.

Frequently Asked Questions

1. Does BitLocker slow down my computer?

On modern hardware, the effect is small. Processors include instructions that accelerate encryption, and most users on SSDs notice no difference in daily use. Older computers with mechanical hard drives and no hardware acceleration may see a modest slowdown, particularly during large file transfers.

2. Is it safe to turn BitLocker off, and will I lose data?

Disabling BitLocker does not delete your files. Windows decrypts the drive in place and your data remains intact. The risk is that the data is no longer protected if the device is lost or stolen. Interrupting the process with a power loss is the main hazard, so keep a laptop plugged in and back up important files first.

3. Can I use BitLocker on Windows Home?

Not the full version. Windows Home lacks the Manage BitLocker interface, but many Home devices support Device Encryption in Settings, which is turned on automatically when you sign in with a Microsoft account on compatible hardware. If your device lacks that feature, you can upgrade to Pro or use a third-party encryption tool.

4. Where can I find my BitLocker recovery key?

Start with your Microsoft account at account.microsoft.com/devices/recoverykey. If the PC belongs to an employer or school, the key may be stored in their directory, and your IT administrator can retrieve it. You may also have saved a copy to a file, printed it, or placed it on a USB drive during setup. You can view a current key on an unlocked system with manage-bde -protectors -get C: in an elevated Command Prompt.