Most offices believe their PCs are encrypted. Belief is not a list. This page turns "we think so" into names — the specific machines that are pending or not encrypted, and the reason for each.
✍️ Technical Anshu🪟 Windows 10 / 11⏱️ 15 minute ka check
🎥 Watch the full walkthrough in the video — ManageEngine BitLocker management, step by step
A BitLocker rollout almost never fails loudly. The policy goes out, most machines quietly encrypt, and a stubborn minority — a laptop that was on leave, a desktop with a TPM problem, a PC that was rebuilt and never re-enrolled — stays unencrypted for months while everyone assumes the job is done. The gap is only dangerous because it is invisible. The Managed Computers view in Endpoint Central exists to make it visible: every managed machine carries one of three states — Encrypted, Pending encryption or Non-compliant. This guide is the working method: pull the list, read the reasons, fix in the right order, and be honest about the machines the console cannot see at all.
Managed Computers — Encryption Status (illustration)
ACC-LAP-014 (Accounts laptop)NOT ENCRYPTED
HR-PC-003PENDING
OPS-DESK-021ENCRYPTED
Travel laptop pool — 6 machinesCheck first
Illustration: the gap list is always a list of names, never a percentage. Machine names are examples.
1
Step 1 — Pull the Three-State List
Open the BitLocker Managed Computers view in the console.
Sort or filter by status so Non-compliant and Pending encryption sit at the top.
Export or note the list — names, owners and current state. This list, not a percentage, is your work queue.
A percentage like "92% encrypted" sounds like success and hides everything that matters. The 8% has names, owners and data on it.
2
Step 2 — Read the Reason, Not Just the State
"Pending" and "Non-compliant" are symptoms, not diagnoses. The usual causes, roughly in order of frequency:
The machine has not checked in — it is off, on leave, or its agent stopped reporting. The policy may be applied and simply waiting.
A prerequisite failed — Endpoint Central's pre-deployment checks flag the classic ones, such as BIOS mode incompatibility and TPM ownership errors, before or during rollout.
No TPM and no fallback planned — older hardware needs a passphrase protector, which has to be a deliberate policy choice.
The OS edition cannot do BitLocker — a Windows Home machine will sit in the gap forever until it is upgraded or replaced.
Encryption started but the key never reached the server — the console deliberately holds encryption until the key is stored, so treat this state as urgent, not cosmetic.
Fix order follows the cause. Chasing a switched-off laptop with policy pushes wastes everyone's time.
3
Step 3 — Work the Gaps in Risk Order
Not all unencrypted PCs carry the same risk. Clear the list in this order:
Laptops that leave the building — they are the ones that get lost and stolen. First, always.
Machines holding sensitive data — accounts, HR, leadership, anything with customer records.
Desktops in shared or public areas — reception, training rooms, branch counters.
Fixed desktops in controlled rooms — still encrypt them, but they can honestly wait their turn.
For each machine, verify the finish properly: status shows Encryptedand you can retrieve its recovery key from escrow. Both, not one — the checks in this series return to that pair again and again because they fail independently.
4
Step 4 — Keep the List Honest Over Time
The gap list is a living thing:
New machines — confirm the policy applies automatically to newly added devices, as the console supports, instead of relying on someone remembering.
Rebuilt machines — a re-imaged PC is a new machine to the policy. Check it re-encrypts and that a fresh key lands in escrow; old keys for a wiped drive are clutter that confuses recovery day.
Departed machines — when a PC leaves management, know the key retention position: with retention on, ManageEngine keeps the key on the server for up to a year after removal. (The leavers guide in this series covers the full offboarding.)
Re-run this inventory monthly. Ten minutes, same view, same order.
5
The Blind Spot Nobody Mentions
This inventory counts managed machines — PCs with the agent installed and reporting. A PC that was never enrolled does not appear as non-compliant; it does not appear at all. That is the one dishonest-looking number in every encryption dashboard, and it is yours to manage:
Periodically compare the console's machine list against an independent source — AD computer accounts, DHCP leases, or your purchase register.
Any machine in the building that is not in the console goes on a different list: the unmanaged list. Clear that one too.
An honest inventory has two lists. If yours has one, it is only half an inventory.
🟡 Do not report a percentage upward. "164 of 200 encrypted" invites the reply "good enough". A named list of 14 unencrypted machines — with owners and reasons — gets fixed. Report names and dates.
🎥 See It Done Live in the Video
The complete walkthrough — policies, key backup and the console — is shown step by step in the video.
What do Encrypted, Pending and Non-compliant actually mean?
Encrypted means the drive reports full BitLocker protection with its key stored. Pending means the policy has reached the machine but encryption has not finished or the machine has not reported back. Non-compliant means something is blocking it — a failed prerequisite, a missing TPM, or an edition that cannot run BitLocker.
A PC does not appear in the list at all. Is it encrypted?
Unknown — and unknown is the correct worry. The console only reports on machines with its agent installed. A PC missing from the list is unmanaged, not compliant; enrol it or retire it.
How often should this check run?
Monthly is a sane rhythm for most offices, plus a check whenever machines join or get rebuilt. The check takes minutes; the expensive failures are the gaps nobody looked for.
This guide is based on the Technical Anshu video on managing BitLocker • Stuck on a step? Ask in the video comments — answers happen there 🙏