Enable BitLocker in Windows 11

Check Your Windows Edition First

Full BitLocker — with the control panel, drive-by-drive control and every option — lives in Windows 11 Pro, Enterprise and Education. Before looking for any setting, confirm your edition under Settings → System → About. If you are on Pro or above, continue to Step 2.

Check the TPM Is Ready

BitLocker guards the drive's key with the TPM chip in your PC. Press Windows + R, run the command below, and check that the TPM Management screen says the TPM is ready for use.

tpm.msc

Most PCs from the last several years have TPM 2.0 built in. If the screen says no compatible TPM was found, the chip may simply need switching on in the BIOS/UEFI settings.

Turn On BitLocker for the C: Drive

Open Control Panel → System and Security → BitLocker Drive Encryption (or search Start for Manage BitLocker). Next to the C: drive, click Turn on BitLocker. The wizard's very first question is where to back up your recovery key — and that screen is the most important one in the whole setup, which is why it gets its own step next.

Save the Recovery Key Before Anything Restarts

During setup, Windows offers to back up the 48-digit recovery key. This key is the only way back into your data if the TPM ever refuses to unlock the drive — after a BIOS update, a motherboard change, or a change to boot settings. Save it in two places: your Microsoft account, and a printed copy or a file on a USB drive kept away from the laptop itself. A key saved to your Microsoft account can be viewed later, from any device, at this address:

account.microsoft.com/devices/recoverykey

Choose How Much of the Drive to Encrypt

On a new or freshly installed PC, choose Encrypt used disk space only — it is much faster. On a PC that has held your files for a long time, choose Encrypt entire drive, so that deleted-but-still-recoverable data is covered too. On the encryption mode screen, keep the new encryption mode (XTS-AES) — it is the default and the right choice for the fixed drive inside the PC.

Run the System Check and Restart

Tick Run BitLocker system check and restart when the wizard asks. The check confirms the PC can unlock the drive correctly before encryption begins — it exists to protect you, not to slow you down. After you sign back in, encryption runs in the background and you can keep working while the percentage climbs; a large, nearly full drive can take hours. Keep a laptop plugged in, and do not force a shutdown mid-way.

Verify Protection with manage-bde

Do not take the wizard's word for it — verify. Open Terminal or Command Prompt as administrator and run:

manage-bde -status C:

You want to see Conversion Status: Fully Encrypted, Percentage Encrypted: 100.0% and Protection Status: Protection On. If protection shows Off while the drive shows as encrypted, the protectors were suspended at some point — turn protection back on from the BitLocker control panel.