A laptop's whole risk profile is that it leaves the building. The BitLocker policy for laptops should be written for the day one is left in a taxi — not for the convenience of the day it is issued.
✍️ Technical Anshu🪟 Windows 10 / 11⏱️ Policy ek baar, fayda hamesha
🎥 Watch the full walkthrough in the video — ManageEngine BitLocker management, step by step
Desktops and laptops should not share one BitLocker policy. A desktop's threat is someone opening the case after hours; a laptop's threat is the machine itself walking away, powered off, with everything on it. Endpoint Central lets you define the policy centrally — protector type, algorithm, encryption scope, key storage — and apply it to the laptop group as one decision. This guide walks through the four decisions that matter, with the honest trade-offs, including the places where the "stronger" setting is not automatically the right one.
BitLocker Policy — Laptop Group (illustration)
ProtectorTPM + PIN
AlgorithmXTS-AES 256
Encryption typeFull disk (used machines)
Key backupServer + Active Directory
Applies toAll laptops group
Illustration: a sensible travelling-laptop policy. Your compliance rules may demand different values — the structure is the point.
1
Decision 1 — the Protector: TPM Only vs TPM with PIN
This is the decision that actually changes security:
TPM only — the machine unlocks its drive automatically at boot if the hardware and boot path look unchanged. The user notices nothing. It stops a thief who pulls the drive or boots another OS — but a stolen laptop that boots normally reaches the Windows login screen, where the fight becomes about passwords and login attacks.
TPM + PIN — the user types a short PIN before Windows even starts. A stolen laptop now cannot reach the login screen at all without the PIN. This is the setting that converts "encrypted" into "genuinely hard to get into".
Enhanced PIN / passphrase options — the console also supports enhanced PINs and, for machines without a TPM, a passphrase protector. Longer secrets, more typing, more helpdesk resets — a real trade, not a free upgrade.
Honest verdict: for laptops that travel, TPM + PIN is worth the small daily friction. For fixed desktops, TPM only is a defensible, sane choice. The video walkthrough shows where these options sit in the policy screen.
2
Decision 2 — Algorithm: XTS-AES 128 or 256
The console offers the standard BitLocker algorithm choices. The honest version of this debate:
XTS-AES 128 is Windows' traditional default and is not "weak" in any practical sense — no attacker is brute-forcing either option.
XTS-AES 256 is what most compliance frameworks and auditors like to see written down, and modern hardware handles it without a noticeable cost.
Choose 256 if your compliance or clients ask for it; do not lose sleep either way. This is the least important decision on this page — the protector and the key escrow matter far more.
3
Decision 3 — Used Space Only vs Full Disk
Used space only — encrypts just the parts of the drive holding data. Much faster on big drives, and completely sound for a brand-new machine that has never held anything else.
Full disk — encrypts every sector, including the "empty" space where deleted files actually still sit. Slower, and the correct choice for any machine that has been in service — which is most laptops in a real fleet.
The rule is simple: new machine, used-space is honest; lived-in machine, go full disk. A used-space pass over a two-year-old laptop leaves yesterday's deleted files readable to anyone with the raw disk.
4
Decision 4 — Key Storage and Scope
Set key backup to server plus Active Directory (or Azure AD) — the escrow guide in this series explains why both, and remember encryption will not start until the key is stored.
Apply the policy to the laptop group, not to individuals — group membership is what makes new laptops inherit the policy automatically.
Include fixed data drives if users keep work on a D: partition; an encrypted C: beside a wide-open D: is a half-locked door.
Pilot on two or three laptops, live with the PIN for a week, then roll out. PIN complaints are cheapest before the fleet has them.
5
What to Tell Users Before Rollout
Half of policy failure is surprise. Tell laptop users three things, in writing:
You will type a PIN before Windows starts — pick one you will not forget, and never share it; IT will never ask for it.
If the machine ever shows a blue recovery screen, do not keep guessing — call IT, read out the key ID, and they will give you the recovery key (that call is its own guide in this series).
After BIOS or hardware repairs, the recovery screen may appear once — that is the protection working, not breaking.
Users who expect these moments treat them as routine. Users who do not, treat them as disasters — and disasters generate workarounds, which generate real risk.
🟡 Do not copy a policy from a checklist blindly. The values above are a sensible default for travelling laptops, not a compliance certificate. If your industry or client contract names specific settings, those win — write the policy to them.
🎥 See It Done Live in the Video
The complete walkthrough — policies, key backup and the console — is shown step by step in the video.
It adds a few seconds at power-on, before Windows starts. Most offices find users adapt within a week, and the protection gain for a lost laptop is large: the machine cannot even reach the Windows login screen without the PIN.
A laptop has no TPM. Can it still be encrypted by policy?
Yes — the console supports a passphrase protector for non-TPM devices. It is a deliberate choice to configure, and it suits older hardware that still has to travel.
Used space only or full disk for a new laptop?
Used space only is fine and much faster for a genuinely new machine. For any machine that has already held data, choose full disk — deleted files survive in "free" space and used-space encryption leaves them readable.
This guide is based on the Technical Anshu video on managing BitLocker • Stuck on a step? Ask in the video comments — answers happen there 🙏