How to Turn On BitLocker and Safely Back Up Your Recovery Key

A stolen laptop is bad enough. A stolen laptop that hands over your customer records, payroll files and saved logins is far worse. Drive encryption stops that from happening, and Windows includes it for free. This guide is for small business owners, office managers and everyday Windows users who want to switch encryption on and, just as importantly, keep the recovery key somewhere safe so they never lock themselves out.

Key takeaways

• Windows 11 Pro, Enterprise and Education include full BitLocker. Windows 11 Home offers a simpler Device encryption on supported hardware.
• Encryption makes the data on a lost or stolen drive unreadable without your sign-in or a 48-digit recovery key.
• Microsoft Support cannot retrieve or recreate a lost recovery key. If you lose it and Windows asks for it, you may have to reset the PC and lose your files.
• Keep at least two copies of each key, in separate places, and record which key belongs to which device.
• Recovery keys are valuable to attackers too: recent attacks on business VPN appliances included attempts to pull BitLocker keys from company directories, so protect where they are stored.

Before you start

Check your Windows edition

Go to Settings > System > About and look at Edition under Windows specifications. If it says Pro, Enterprise or Education, you have full BitLocker. If it says Home, you will use Device encryption, which works in a similar way but has fewer options and does not include BitLocker To Go for USB drives.

Check whether your PC supports Device encryption

1. Type System Information in the Start menu search, right-click it and choose Run as administrator.
2. Scroll to the bottom of the summary page and find Device Encryption Support.
3. If it says Meets prerequisites, Device encryption is available. Some laptops already have it switched on from the factory.

Prepare

• Back up important files first. Encryption rarely causes problems, but a backup is good practice before any major change.
• Plug the laptop into power. Encrypting a large drive can take a while; on an unstable power supply, a UPS is a wise addition.
• Decide where the recovery key will live (see the section below) before you begin.

Turn on Device encryption (Windows 11 Home)

1. Open Settings > Privacy & security > Device encryption. If you cannot see this option, your device probably does not support it.
2. Switch Device encryption to On.
3. If you are not signed in with a Microsoft account, Windows will ask you to sign in to finish. The recovery key is then backed up to that account automatically.
4. Make an extra copy: under Related, select BitLocker drive encryption, then Back up your recovery key, choose Save to a file, and save it to a USB drive or another safe location, not the laptop itself.

Turn on BitLocker (Windows 11 Pro and above)

1. Open Settings > System > Storage, then select Advanced storage settings > Disks & volumes.
2. Select the drive, choose the Windows (C:) volume and click Properties.
3. Click Turn on BitLocker. This opens the BitLocker Drive Encryption window, which you can also reach from Control Panel > System and Security > BitLocker Drive Encryption. Click Turn on BitLocker again.
4. Choose how to back up your recovery key: Save to your Microsoft account, Save to a file or Print the recovery key. You can repeat this step to create more than one copy.
5. Choose Encrypt used disk space only for a new PC (faster) or encrypt the entire drive for a PC that has been in use for a long time.
6. Select New encryption mode for the internal drive.
7. Tick Run BitLocker system check and click Continue, then restart when asked. Encryption continues in the background and you can keep working.

Where to keep the recovery key

The recovery key is a 48-digit number. Windows asks for it when something changes at a low level, for example after certain hardware or firmware changes, or if someone tries to start the drive in another computer. Good storage options include:

• Your Microsoft account. View saved keys from any device at aka.ms/myrecoverykey. Protect that account with a strong password and two-step verification.
• Your work account. For company PCs joined to Microsoft Entra ID, keys can be stored in the organisation’s directory and viewed at aka.ms/aadrecoverykey under Devices > View BitLocker Keys, or retrieved by your IT team.
• A printout or a USB drive kept in a locked drawer or safe, away from the laptop bag.
• A password manager vault shared only with the business owner or IT lead.

Label each copy with the device name and the first eight characters of the recovery key ID, which Windows shows on the recovery screen. This is how you match the right key to the right PC when you have several.

Check status and view keys from the command line

For IT staff, the built-in manage-bde tool is useful. Open Terminal (Admin) and run:

• manage-bde -status to see which drives are encrypted and how far encryption has progressed.
• manage-bde -protectors -get C: to list the protectors on the C: drive, including the recovery password and its ID.

Use this to audit staff laptops and confirm that every key has been backed up before handing a device to an employee.

Troubleshooting

• No Device encryption page on a Home PC: your hardware does not meet the prerequisites. Consider upgrading to Windows 11 Pro for full BitLocker, or use encrypted storage for sensitive files.
• “Save to your Microsoft account” is missing: you are signed in with a local account. Choose Save to a file or Print, or sign in with a Microsoft or work account.
• The PC is asking for a recovery key: note the key ID shown, then check aka.ms/myrecoverykey, your work account, your printouts and USB drives. If none has it, the only option may be a reset that removes your files.
• Before BIOS or firmware updates: confirm you can find the key first, because some updates can trigger a recovery prompt.

Checklist

• Edition checked and encryption turned on for every laptop and desktop.
• Each recovery key saved in at least two places, labelled with the device name and key ID.
• The Microsoft or work account holding the keys protected with two-step verification.
• Key storage limited to the people who really need it.
• A quick check with manage-bde -status added to your routine for new or returned devices.

Sources

• Find your BitLocker recovery key (Microsoft Support)
• How to configure BitLocker encryption on Windows 11 (Windows Central)
• Introduction to Device Encryption and Standard BitLocker Encryption (ASUS)
• manage-bde protectors (Microsoft Learn)

Featured image: Photo: “computer laptop keyboard HP Pavilion Entertainment PC” by GoodNCrazy, CC BY 2.0, via Openverse — source