How to Check BitLocker Encryption Status and Protection Keys in Windows 11 Using PowerShell Get-BitLockerVolume

Verifying full-disk encryption across enterprise endpoints and personal laptops is a core security compliance requirement. On Windows 11, BitLocker Drive Encryption safeguards data at rest by rendering physical storage unreadable without proper cryptographic authentication. While the Control Panel displays high-level encryption status badges, system administrators and security engineers require granular telemetry—including exact encryption percentage progress, underlying cipher algorithms (e.g. XTS-AES 128-bit versus XTS-AES 256-bit), active key protectors (TPM, PIN, Recovery Password), and auto-unlock states. The native Get-BitLockerVolume cmdlet in Windows PowerShell provides direct, scriptable access to BitLocker subsystem metrics.

Understanding BitLocker Metrics and Get-BitLockerVolume

The Get-BitLockerVolume cmdlet belongs to the native Windows BitLocker PowerShell module. Interrogating the Windows Management Instrumentation (WMI) BitLocker classes, it returns rich .NET objects with critical properties:

• MountPoint: The drive letter of the volume being queried (e.g. C:, D:).
• VolumeType: Classifies whether the volume is an OperatingSystem, FixedData, or RemovableData (BitLocker To Go) drive.
• VolumeStatus: Indicates the operational state (such as FullyEncrypted, FullyDecrypted, or EncryptionInProgress).
• EncryptionPercentage: Reports real-time encryption or decryption progress from 0% to 100%.
• EncryptionMethod: Identifies the specific cipher suite used to encrypt drive sectors (e.g. XtsAes128, XtsAes256, or AesCbc128).
• ProtectionStatus: Confirms whether BitLocker encryption keys are currently protected (On) or temporarily suspended (Off), which is critical when applying BIOS or firmware updates.
• KeyProtector: Lists active authentication mechanisms bound to the volume (such as Trusted Platform Module (TPM), Numerical Password, Startup Key, or Recovery Password).

Running Get-BitLockerVolume in an Elevated PowerShell Window

Because querying low-level disk encryption structures requires administrative privileges, launch PowerShell as an Administrator: press Win + X and select Terminal (Admin) or PowerShell (Admin).

To inspect all storage volumes present on your system, execute:

Get-BitLockerVolume

The terminal returns a comprehensive overview for every detected drive letter. If you have multiple partitions or external storage devices attached, you can target a specific drive using the -MountPoint parameter:

Get-BitLockerVolume -MountPoint "C:"

Inspecting Active Key Protectors and Recovery Password IDs

Understanding which key protectors safeguard your operating system drive is vital for disaster recovery planning. If BitLocker is enforced solely via TPM without a secondary PIN or if a recovery password has not been backed up, a motherboard failure could lead to permanent data loss.

To extract the key protector details for your system drive:

(Get-BitLockerVolume -MountPoint "C:").KeyProtector

The output enumerates each protector object:

• Tpm: Confirms that the drive automatically unlocks at boot via the hardware Trusted Platform Module security chip.
• RecoveryPassword: Displays the unique KeyProtectorId GUID alongside the 48-digit numerical recovery password. (Note: in domain environments with active Group Policies, recovery passwords can also be escrowed to Microsoft Entra ID or Active Directory).

To display solely the KeyProtector Type and its associated Recovery Password, execute:

(Get-BitLockerVolume -MountPoint "C:").KeyProtector | Select-Object KeyProtectorType, RecoveryPassword

Filtering and Formatting BitLocker Auditing Tables

For quick fleet assessments or security audits, you can condense the output into an aligned table isolating volume types and cipher strengths:

Get-BitLockerVolume | Format-Table MountPoint, VolumeStatus, EncryptionPercentage, EncryptionMethod, ProtectionStatus -AutoSize

This tabular view allows administrators to immediately identify whether secondary data partitions (such as D: or E:) remain unencrypted or if a laptop drive is currently undergoing background encryption.

Checking for Suspended BitLocker Protection

During system maintenance, driver updates, or UEFI firmware flashing, BitLocker protection is often temporarily suspended. While suspended, drive data remains encrypted on disk, but the decryption key is written in plain text to the volume header, rendering the drive vulnerable to physical extraction.

To verify whether any volume on your computer has protection suspended, run:

Get-BitLockerVolume | Where-Object { $_.ProtectionStatus -eq "Off" -and $_.VolumeStatus -eq "FullyEncrypted" }

If any drives appear in this filter, you can immediately re-enable hardware key protection using the companion cmdlet:

Resume-BitLocker -MountPoint "C:"

Exporting Encryption Compliance Reports to CSV

To record BitLocker configuration for compliance audits or remote inventory logging, export the structured data directly to a CSV document:

Get-BitLockerVolume | Select-Object MountPoint, VolumeType, VolumeStatus, EncryptionMethod, ProtectionStatus | Export-Csv -Path "$env:USERPROFILE\Desktop\BitLocker_Report.csv" -NoTypeInformation

This automated command-line workflow eliminates manual GUI navigation, providing clear, verified proof of enterprise storage encryption standards.