Losing a corporate laptop or having a desktop hard drive stolen exposes sensitive personal information, proprietary enterprise assets, and cached credentials to physical extraction. If a drive is not encrypted, an attacker can simply remove the NVMe or SATA SSD, connect it to another PC, and read all files without knowing the Windows login password. BitLocker Drive Encryption in Windows 11 provides hardware-backed XTS-AES 128-bit or 256-bit full-disk encryption integrated with the motherboard’s Trusted Platform Module (TPM 2.0), ensuring that data cannot be accessed if hardware integrity is compromised.
Verifying TPM 2.0 Status and Hardware Readiness
Windows 11 requires TPM 2.0 by default, which BitLocker uses to securely seal encryption keys. Before enabling BitLocker, verify that your TPM is ready:
- Press Windows Key + R, type
tpm.msc, and press Enter. - Under Status, verify that it reads: “The TPM is ready for use”.
- Under TPM Manufacturer Information, verify the Specification Version is 2.0.
| BitLocker Protector | Operational Mechanism | Security Level |
|---|---|---|
| TPM Only (Default) | Transparent hardware boot if system firmware is untampered. | High (Seamless user experience). |
| TPM + Startup PIN | Requires entering a PIN at boot before Windows loads. | Maximum (Protects against DMA and cold-boot physical attacks). |
| 48-Digit Recovery Key | Emergency numeric unlock key for motherboard changes or BIOS updates. | Mandatory backup required for all installations. |
Enabling BitLocker from Windows 11 Settings
- Open Settings (press Windows Key + I) and navigate to Privacy & security > Device encryption (or search for BitLocker in Control Panel).
- Click Turn on BitLocker next to your Operating System drive (
C:). - Choose where to back up your 48-digit recovery key:
- Save to your Microsoft account: Uploads the recovery key securely to account.microsoft.com/devices/recoverykey.
- Save to a file: Saves a text file (must be saved to a USB drive or secondary non-encrypted location).
- Print the recovery key: Produces a physical hard copy for safe storage.
- Choose whether to encrypt Used disk space only (faster for new PCs) or Entire drive (recommended for existing computers).
- Select New encryption mode (XTS-AES) for fixed internal drives.
- Check Run BitLocker system check and click Continue.
- Restart your PC when prompted to verify seamless hardware key unlocking.
Enforcing an Enhanced Pre-Boot Startup PIN
To defend against sophisticated physical attacks where an attacker bypasses Windows using cold-boot memory dumps, enforce a mandatory pre-boot PIN via Local Group Policy:
- Press Windows Key + R, type
gpedit.msc, and press Enter. - Navigate to:
Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. - Double-click Require additional authentication at startup.
- Set the policy to Enabled. Under Configure TPM startup PIN, select Require startup PIN with TPM.
- Click Apply and OK.
- Open an elevated PowerShell prompt and set your startup PIN:
manage-bde -protectors -add C: -TPMAndPIN
Checking Encryption Status with manage-bde
To audit active encryption progress and verify encryption algorithms from the command line:
manage-bde -status C:Configuring BitLocker ensures that your Windows 11 workstation adheres to enterprise security standards, safeguarding credentials and personal files from hardware theft.