How to Enable BitLocker | Step-by-Step for Windows 10/11

Guides / By

Turning on BitLocker in Windows 10 or 11 Pro requires an admin account, a compatible TPM chip, and saving a recovery key to avoid losing your data.

The biggest mistake people make when turning on BitLocker isn’t picking a complex password — it’s skipping the recovery key and getting locked out of their drive for good. The setup itself is straightforward once you know what your hardware and Windows edition actually support.

What You Need Before Enabling BitLocker

BitLocker is Microsoft’s built-in full-disk encryption tool. It only runs on specific Windows versions and requires a piece of security hardware called a Trusted Platform Module (TPM).

Windows 10 (version 1809 or later) and Windows 11 support BitLocker, but only on Pro, Enterprise, and Education editions. Home editions can’t use it — though many modern laptops ship with a lighter version called Device Encryption instead.

The table below breaks down exactly what you need.

Requirement Details Notes
Windows Edition Pro, Enterprise, or Education Windows 10 v1809+ or Windows 11
TPM Chip Version 1.2 or 2.0 Most PCs made after 2016 have this
Admin Account Required to enable the feature The account that starts encryption
Recovery Key Must be saved before encryption starts Saved to Microsoft Account, file, or print
Drive Status Drive must not be encrypted by another tool An already-encrypted drive will block setup
Optional: No TPM Requires Group Policy edit + USB key or password Method works, but needs manual boot unlock

Standard Method: Enable BitLocker With a TPM

This is the quickest route for most users. The TPM handles unlocking the drive automatically at startup, so you only need a recovery key for emergencies.

  1. Sign in with an administrator account.
  2. Open Start, search for Manage BitLocker, and select it.
  3. Alternatively, go to Control Panel > System and Security > BitLocker Drive Encryption.
  4. Next to Operating System Drive, click Turn on BitLocker.
  5. Save your recovery key. Choose to save it to your Microsoft account, a file on a USB drive (create a folder like C:\BitLockerKeys — saving to the root directory will throw an error), or print it.
  6. Select Encrypt used disk space only (faster for new PCs) or Encrypt entire drive (more thorough for existing PCs).
  7. Select New encryption mode (for fixed drives) or Compatible mode (for external drives).
  8. Check Run BitLocker system check and click Continue.
  9. Restart your computer. Encryption begins after the restart and runs in the background.

What success looks like: A lock icon on the drive in File Explorer means BitLocker is active. You can keep working normally during encryption — it runs silently in the background.

How to Enable BitLocker Without a TPM

If your device lacks a TPM, you can still enable BitLocker by changing a local group policy and unlocking the drive manually with a USB key or password at startup.

  1. Open Start, type gpedit.msc, and run it as Administrator.
  2. Navigate to: Local Computer Policy > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
  3. Double-click Require additional authentication at startup.
  4. Select Enabled, then check Allow BitLocker without a compatible TPM.
  5. Click OK to save the policy change.
  6. Open Control Panel > BitLocker Drive Encryption and click Turn on BitLocker.
  7. Choose to unlock the drive using a USB flash drive or a password.
  8. Follow the encryption scope, mode, and system check steps from the standard method, then restart.

What success looks like: After the restart, Windows will pause and ask for your USB key or password before it boots. Once entered, the drive encrypts exactly as it would with a TPM.

Does Windows Home Support BitLocker?

No. Windows 10 and 11 Home editions do not include BitLocker. If you try to search for it in the Control Panel, you won’t find the option.

Many modern laptops sold with Windows Home do include a related feature called Device Encryption. It provides similar protection but is managed differently — it ties the encryption key to your Microsoft Account rather than a local policy. To check if your device has it, go to Settings > Privacy & Security > Device Encryption. If the toggle isn’t there, your hardware doesn’t support it.

Common Mistakes Made During BitLocker Setup

A few simple missteps can lock you out of your data permanently. These are the ones to watch for.*

Mistake Why It Hurts How to Avoid It
Skipping the recovery key No key = no access to the drive if the TPM fails or the password is forgotten Always save it to a Microsoft Account and a separate file
Trying to enable BitLocker on Windows Home The option simply doesn’t exist Check for Device Encryption instead
Ignoring the TPM requirement The setup will stall or fail Enable TPM in BIOS or use the No-TPM method above
Saving the recovery key to a root folder Windows rejects the location Create a folder first, like C:\BitLockerKeys

*Using a managed work or school device? Enterprise policies pushed through tools like Google Admin Console or Scalefusion may override local BitLocker settings. If the Turn on BitLocker option is grayed out, check with your IT department rather than forcing a local policy change.

References & Sources

Please use a real email you check. If it's fake or mistyped, your message won't reach us and we can't reply — wrong addresses are rejected automatically.