A lost laptop can expose far more than the device itself. Saved client files, invoices, browser sessions, tax records, and cloud-synced folders may all be accessible if the drive is not encrypted. This Windows BitLocker setup guide explains how to turn on Microsoft’s built-in drive encryption without creating a recovery problem later.
BitLocker is a practical choice for freelancers, small businesses, students, and home office users who store sensitive information locally. It encrypts the contents of a drive so the data cannot be read simply by removing the drive or starting the computer from another device. Once Windows starts normally and you sign in, day-to-day use should feel much the same.
Check whether your PC supports BitLocker
Full BitLocker management is generally available in Windows 11 Pro, Enterprise, and Education editions. Many Windows 11 Home computers offer a related feature called Device Encryption, but the available controls can be more limited. Before changing anything, open Settings, select System, then About, and check the Windows edition listed under Windows specifications.
For the easiest setup, your computer should also have a Trusted Platform Module, usually TPM 2.0. This small security component stores encryption-related information and lets BitLocker verify that the computer has not been altered before Windows starts. Most modern business and consumer PCs include one.
To check it, search Windows for “tpm.msc” and open the result. The status should state that the TPM is ready for use. If Windows cannot find a compatible TPM, BitLocker may still be configured on some Pro devices with a USB startup key, but that approach is less convenient and easier to mishandle. For most users, resolving TPM settings in the computer’s firmware is the better option.
Also confirm that you can sign in to the Microsoft account or work account used on the PC. That account may be where your recovery key is stored. If the computer is managed by an employer or school, contact its IT administrator before proceeding. Organization policies can control encryption settings and recovery key storage.
Prepare before you encrypt the drive
Encryption protects against unauthorized access to a lost or stolen drive. It does not replace a backup, remove malware, or protect files from someone already signed in to your Windows account. Make a current backup of work files before beginning, especially if the PC contains accounting records, project archives, or files that are not fully synchronized to cloud storage.
Install pending Windows updates and keep the laptop connected to power. BitLocker can encrypt in the background, but interrupting the initial process with a drained battery or forced shutdown is unnecessary risk.
The most critical preparation is choosing where to keep the recovery key. This 48-digit key is used if Windows detects a major hardware or security change, such as a motherboard replacement, certain firmware updates, or an unexpected TPM reset. Without it, you may not be able to access the encrypted drive.
Do not save the only recovery-key file on the same drive you are encrypting. A sensible approach is to store it in your Microsoft account or organization account and keep a second copy in a secure offline location. For a small business, the owner or designated administrator should be able to access recovery information if an employee is unavailable.
Windows BitLocker setup guide: encrypt the system drive
On a Windows 11 Pro PC, open Control Panel and select System and Security, then BitLocker Drive Encryption. You should see the operating system drive, usually labeled C:. Select Turn on BitLocker.
Windows will first ask how you want to back up the recovery key. Available choices vary by account and device, but commonly include saving it to a Microsoft account, saving a file, or printing it. Select a protected option that you can retrieve even if the computer itself will not start. Verify that the key was saved before continuing.
Next, choose how much of the drive to encrypt. For a new PC with little data, “Encrypt used disk space only” is faster and normally sufficient. For a computer that has been used for a while, particularly one that previously held sensitive files, “Encrypt entire drive” provides more complete coverage. It takes longer, but it encrypts unused areas that may contain remnants of deleted data.
Windows may then ask you to choose an encryption mode. Use the default option for an internal drive that will remain in the computer. The compatible mode is mainly intended for a drive that must be moved between older versions of Windows. Unless you have a specific cross-device requirement, the default selection is the right choice.
Finally, allow Windows to run the BitLocker system check and restart when prompted. After the restart, encryption begins. You can continue working, although performance may be slightly slower during the initial process on older hardware. Return to the BitLocker Drive Encryption screen to check progress and confirm that protection is on.
Should you use a startup PIN?
A standard TPM-based setup usually starts Windows without asking for an extra BitLocker PIN. The TPM checks the device state in the background, then Windows moves to its normal sign-in screen. This is convenient for personal and office computers that remain in a controlled environment.
A startup PIN adds another layer. Before Windows loads, you enter a PIN that is separate from your Windows sign-in password. This can be worthwhile for a laptop carrying highly sensitive customer, financial, legal, or research data. It reduces the chance that someone with the physical laptop can start it, even if they know or reset the Windows account password.
The trade-off is operational: every authorized user must know the PIN, and forgetting it can lead to a recovery-key request. On a shared business PC, that may create more support work than benefit. For many small teams, TPM protection plus a strong Windows sign-in method and careful recovery-key storage is the more manageable balance.
Encrypt other drives and removable storage
BitLocker can protect more than the Windows system drive. In the BitLocker control panel, fixed internal data drives can be encrypted separately. This is useful if a desktop stores files on a second drive or if a workstation has a dedicated archive drive.
For USB flash drives and external hard drives, use BitLocker To Go. This option encrypts removable media and typically requires a password when the drive is connected to another computer. It is a strong fit for portable backups, payroll exports, client deliverables, and documents carried between a home office and workplace.
Avoid using an easily guessed password for a removable drive. Store its recovery key separately from the drive, just as you would for a laptop. If the drive must be opened on Macs or other non-Windows systems, check compatibility before making it part of a regular workflow. BitLocker To Go is designed primarily for Windows access.
Everyday BitLocker practices that prevent lockouts
Most BitLocker issues are not caused by encryption itself. They happen when recovery details are misplaced or a device change is made without preparation. Keep the following habits in place:
- Confirm the recovery key location after setup, and test that the account holding it is accessible.
- Keep Windows, firmware, and security updates current, but suspend BitLocker before planned firmware or BIOS updates if the manufacturer instructs you to do so.
- Use a strong Windows password, PIN, or biometric sign-in. BitLocker protects the offline drive; account security protects an active session.
- Maintain regular backups. Encryption cannot restore files deleted by accident, damaged by a failing drive, or changed by ransomware.
- When transferring ownership of a PC, decrypt and securely reset the device instead of merely deleting user files.
Common BitLocker questions
Will BitLocker slow down my computer?
On most current PCs with solid-state storage and TPM support, the ongoing performance effect is minor. The initial encryption process can take time, especially with full-drive encryption on a large or older hard drive. Keep the machine plugged in and let the process finish rather than repeatedly stopping it.
What happens if I forget my Windows password?
A forgotten Windows password and a BitLocker recovery key are different issues. Standard account recovery may let you regain access to Windows. If BitLocker asks for its 48-digit recovery key, you must retrieve that specific key from the location selected during setup.
Can BitLocker protect cloud files?
BitLocker protects files stored on the encrypted local drive. If cloud storage synchronizes files to that drive, local copies are protected when the PC is off. The cloud account still needs its own strong password and multi-factor authentication because BitLocker does not secure the online account itself.
A properly configured BitLocker installation is quiet protection: you should rarely notice it until a lost device or attempted offline access makes it matter. Take the extra few minutes to secure the recovery key, and your work PC will be far better prepared for the problem nobody plans to have.