Zavelix IT Practice Tip: Encrypting Company PC Drives with BitLocker

What is this practice tip about?

This is a general Zavelix IT practice tip, not a news item about a current event. It describes how to encrypt the drives of company PCs with BitLocker.

BitLocker is a Windows feature that encrypts entire volumes. It addresses data theft or exposure from lost, stolen or improperly decommissioned devices. Without encryption, someone could move the drive to another device or run attack tools against it. With BitLocker, data stays unreadable even when a device is decommissioned or recycled.

TPM, PIN and startup key

BitLocker offers the strongest protection together with a Trusted Platform Module (TPM), a hardware component that helps verify that an offline device was not tampered with. Startup can also be locked until a PIN is entered or a USB device with a startup key is inserted, which acts like multifactor authentication before boot.

Without a TPM, the system drive can still be encrypted, but only with a startup key on removable media or with a password. Microsoft says the password is not secure because there is no lockout after failed attempts, and it is disabled by default. Neither option offers the preboot integrity check.

Requirements and licensing

The integrity check needs TPM 1.2 or later and suitable BIOS or UEFI firmware. With TPM 2.0, the firmware must be in native UEFI mode with Legacy and CSM disabled. Secure Boot is recommended. Before changing the BIOS mode, use mbr2gpt.exe, otherwise the operating system may fail to boot.

The disk needs at least two partitions: an NTFS operating system drive and an unencrypted system drive, recommended at about 350 MB. Windows creates these automatically on new devices. For licensing, Windows Pro, Enterprise, Pro Education/SE and Education support enabling BitLocker. Licensing for management is separate according to the source.

Device encryption and recovery keys

Device encryption turns on BitLocker automatically on eligible devices, but only for the OS drive and fixed drives, not USB drives. On devices joined to Microsoft Entra ID or Active Directory, the recovery key is backed up there and the clear key is then removed. With local accounts only, the device stays unprotected even though data is encrypted. The default is XTS-AES 128-bit. To use a different method, an already encrypted device must first be decrypted.

What should companies do now?

Follow these steps for a structured approach:

• Review your inventory: do all PCs have a TPM, UEFI mode and Secure Boot? System Information (msinfo32.exe) helps check this.
• Clarify licensing: are your Windows editions eligible for BitLocker?
• Choose the protection: TPM, ideally with PIN or startup key; avoid password-only setups without a TPM.
• Set the encryption method by policy before rollout, so devices don't start with the default and need decrypting later.
• Back up recovery keys centrally in Entra ID or Active Directory and control access to them.
• Plan for decommissioning: encrypted devices leave data unreadable when recycled.
• Test with a pilot group, then roll out to all devices and document the status.