Zavelix IT Practice Tip: Using BitLocker on Company PCs
A practical tip on encrypting the drives of company PCs with BitLocker. It covers requirements, the role of the TPM and safe storage of recovery keys. This is not a news item about a current event.
Zavelix IT tip – practical guidance, not breaking news.
Why encrypt drives?
If a laptop is lost or stolen, data can be read, for example by moving the hard drive to another machine. BitLocker encrypts entire volumes and protects against data exposure from lost, stolen or improperly decommissioned devices. Data also stays unreadable when devices are recycled.
This is a general practice tip and does not relate to a current event.
The role of the TPM
BitLocker offers the strongest protection with a Trusted Platform Module (TPM), a common hardware component. It helps ensure the device was not tampered with while offline. Startup can also be locked until a PIN is entered or a USB startup key is inserted, which gives multifactor authentication.
Without a TPM, the OS drive can be encrypted using a startup key on removable media or a password. The password option is considered insecure because there is no lockout after failed attempts, and it is disabled by default. Neither option offers integrity verification before startup.
Requirements at a glance
The TPM integrity check needs TPM 1.2 or later and TCG-compliant BIOS or UEFI firmware. TPM 2.0 is not supported in Legacy or CSM mode; native UEFI is required, and Secure Boot is recommended. According to Microsoft, BitLocker is available in Windows Pro, Enterprise, Pro Education/SE and Education. Licensing for enabling and for central management differs.
Device encryption and recovery keys
Device encryption turns on BitLocker automatically on eligible devices and covers the OS drive and fixed drives, but not USB drives. On devices joined to Microsoft Entra ID or Active Directory, the recovery key is backed up there and the temporary clear key is then removed. With local accounts only, the device remains unprotected even though data is encrypted. The default is XTS-AES 128-bit; a different method must be set by policy before encryption begins, otherwise the drive must first be decrypted.
What should companies do now?
Plan the rollout in advance and check hardware and licenses.
- Check per device that TPM and UEFI mode fit (System Information, msinfo32.exe).
- Enable Secure Boot where possible.
- Consider a startup PIN for stronger protection.
- Define encryption method and policies before devices encrypt.
- Back up recovery keys centrally in Entra ID or Active Directory.
- Avoid local-only accounts on company devices.
- Test recovery on a pilot device.
Zavelix assessment
🟢 Information
This article was created with AI assistance and editorially reviewed by Zavelix before publication. The linked original sources are authoritative.