Turn on full-disk encryption (BitLocker)

Steps

1. 01

   See what you already have

   • Settings›Privacy & security›Device encryption. If it reads On, the drive is already encrypted — skip to saving the key
   • No Device encryption entry at all? Search Start for 'Manage BitLocker' — that is the fuller tool on Pro and Enterprise editions
   • Neither present means your edition or your hardware doesn't support it, which is not something you did wrong

   ✓You should see: Device encryption On, or Manage BitLocker listing your system drive.

   Why?

   Device encryption and BitLocker are the same underlying protection with different amounts of control. Many laptops ship with it already on.

2. 02

   Decide where the recovery key will live — before you encrypt

   • Signed in with a Microsoft account, Windows can save the key to that account automatically — that is the default and the easiest to recover from
   • On a local account there is no account to save it into, so Windows asks you to put it somewhere yourself — and will not finish turning encryption on until you have
   • Microsoft's options are: save to your Microsoft account, save to a USB flash drive, save to a file, or print it

   !Careful: Save it somewhere that is not this PC. A recovery key stored only on the encrypted drive is no key at all. Microsoft is explicit that it cannot retrieve, provide or recreate a lost BitLocker recovery key — lose it and the data is gone.

   Why?

   The recovery key is a 48-digit number. Windows asks for it when it can't unlock the drive automatically.

3. 03

   Turn it on

   • Device encryption: switch it on and carry on working — Windows encrypts in the background
   • Manage BitLocker: choose 'Turn on BitLocker' for the system drive and follow the prompts, choosing where to save the recovery key when asked
   • Leave the PC plugged in until the first pass finishes

   ✓You should see: The drive shows as encrypted, and the machine behaves exactly as it did before.

4. 04

   Save the key, then prove the copy works

   • From Start, search for BitLocker and open Manage BitLocker, then choose 'Back up your recovery key' next to your drive and pick a destination
   • Keys saved to a Microsoft account can be read back at aka.ms/myrecoverykey from another device; work or school accounts use aka.ms/aadrecoverykey
   • Open the key from a different device now and check it is really there

   ✓You should see: The 48-digit key displayed on another device — your phone counts.

   !Careful: Do this today, not when you need it. Every lockout story is someone who assumed the key had been saved.

5. 05

   Avoid the lockout that catches people out

   • Before a planned BIOS or firmware update, suspend protection:Manage BitLocker›Suspend protection. It resumes itself after the next restart
   • Expect a key prompt after a firmware update, a boot-order change, or moving the drive to another machine — the TPM stops trusting the boot and asks you to confirm

   Why?

   This is far and away the most common way people lock themselves out, and it is entirely avoidable: suspend first, or just have the key to hand.

   Also see: Convert your disk from MBR to GPT for Secure Boot