Recommended Free Tools
To inventory BitLocker status in Microsoft System Center Configuration Manager (SCCM, now Configuration Manager), enable hardware inventory for the applicable clients and add the Windows WMI class Win32_EncryptableVolume. The class is in RootCIMV2SecurityMicrosoftVolumeEncryption and exposes per-volume properties such as ProtectionStatus and ConversionStatus. Clients report those values during their normal hardware-inventory cycle, so the result is scheduled fleet inventory rather than a live BitLocker check.
This method is appropriate when you need BitLocker fields in ordinary ConfigMgr inventory. It does not configure encryption, escrow recovery keys, or provide the dedicated compliance and recovery-audit workflow supplied by the separate BitLocker Management feature.
As an Amazon Associate I earn from qualifying purchases.
What enabling BitLocker inventory actually does
Configuration Manager hardware inventory reads selected WMI classes on managed Windows devices, sends the collected instances through the management point, and stores the data in the site database. Enabling Win32_EncryptableVolume adds one or more records for each volume that exposes the class. A device with an operating-system volume, fixed data volumes, and removable volumes can therefore return several rows rather than one computer-level status.
The inventory reflects the client’s state when the inventory provider ran. BitLocker can start, pause, resume, or finish encryption after that collection, so a console view may be older than the device’s current state. Use the configured hardware-inventory schedule and the client’s policy and inventory logs to establish when a value was collected.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Adding the class is read-only from BitLocker’s perspective. It does not turn encryption on or off, set an encryption method, require a TPM, rotate protectors, escrow a recovery password, or remediate a noncompliant computer.
Choose the right ConfigMgr capability first
There are two different administrative goals that are often called “BitLocker inventory.” Select the one that matches the question your operations team must answer.
| Need | Ordinary hardware inventory | BitLocker Management |
|---|---|---|
| Primary purpose | Collect selected WMI properties into the ConfigMgr inventory database. | Provide BitLocker-specific compliance, recovery-audit, and administrative workflows. |
| Configuration | Enable hardware inventory and select Win32_EncryptableVolume in client settings. |
Install and configure the BitLocker Management feature and its reporting components. |
| Refresh behavior | Runs on the hardware-inventory schedule; not real time. | Uses the feature’s compliance and recovery reporting architecture. |
| Detail available | Volume-level WMI instances and the properties selected for inventory. | Dedicated enterprise compliance and recovery-audit reports, plus management interfaces. |
| Recovery-key workflow | Not provided by selecting the WMI class. | Designed to support recovery and audit operations when the feature is deployed and configured. |
Use hardware inventory when a collection query, dashboard, or internal report only needs the WMI status fields. Use BitLocker Management when the requirement is its dedicated enterprise compliance reporting, recovery audit, or administrative recovery workflow. Enabling one does not automatically enable the other.
Prerequisites and planning
- Managed Windows clients must have a functioning Configuration Manager client and be able to retrieve client settings and submit inventory through their management point.
- The client setting that applies to the target devices must have hardware inventory enabled. If hardware inventory is disabled, selecting a class alone produces no data.
- Decide whether the setting should apply to every managed device or only to a collection. Default Client Settings are broad; a custom device client setting is safer for a pilot or a narrowly scoped deployment.
- Choose an inventory interval that gives useful freshness without creating unnecessary network and site-database load. Inventory is a recurring payload, and adding classes or properties increases what clients send.
- Confirm that your administrative role can edit client settings and hardware-inventory classes, and that you can inspect inventory in Resource Explorer or an approved reporting method.
Client settings can be layered. Microsoft’s current-branch behavior allows inventory classes from multiple client settings to merge. When the intention is to target only selected machines, assign a custom device setting to the intended collection and check the resulting policy on a pilot device before expanding it.
Enable the BitLocker WMI class step by step
- Open client settings. In the Configuration Manager console, go to Administration > Client Settings.
- Select the scope. Open Default Client Settings for a broad deployment, or create/select a custom device client setting for a pilot or targeted collection. Open Properties.
- Turn on hardware inventory. Select Hardware Inventory. Set Enable hardware inventory on clients to Yes. Set the hardware-inventory schedule to the interval your reporting requirement can support. A short interval gives fresher data but increases client, network, management-point, and database activity.
- Edit the class list. In the same Hardware Inventory page, select Set Classes. The class browser lists the WMI providers and classes available to the inventory extension mechanism.
- Locate the BitLocker class. Find and enable
Win32_EncryptableVolumein the namespaceRootCIMV2SecurityMicrosoftVolumeEncryption. Select the properties your reports actually need. At minimum,ProtectionStatusandConversionStatusare the key status fields; adding every available property is unnecessary if your use case does not require it. - Save and deploy the setting. Accept the class selection and close the client-setting properties. If you used a custom setting, assign it to the collection containing the pilot or production devices.
- Wait for policy retrieval. Clients must download the revised client policy before they can use the new class list. You can trigger the machine policy retrieval action from the Configuration Manager control-panel applet or your organization’s approved client-management process.
- Run or await hardware inventory. After policy is current, allow the next scheduled hardware-inventory cycle, or trigger the hardware-inventory action on a test client. The client forwards the inventory through its management point, and the site processes it into the inventory database.
- Verify collection. Use Resource Explorer for a test device to confirm that the
Win32_EncryptableVolumeclass and its selected properties appear. Then check a report or inventory view that your site supports before broad deployment.
Labels and console placement can vary slightly between Configuration Manager current-branch releases. The functional sequence remains client settings, Hardware Inventory, Set Classes, the BitLocker namespace, policy retrieval, and an inventory cycle.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Verify that clients are returning data
Check a known pilot device first
Choose a device whose BitLocker state you can confirm locally. After the device receives policy and completes an inventory cycle, open Resource Explorer for that resource and look for the Win32_EncryptableVolume inventory class. Confirm that the namespace and selected properties are represented and that the collection timestamp is newer than the policy change.
Use inventory views and reports carefully
Configuration Manager exposes metadata about enabled inventory classes through views such as v_InventoryClass and v_InventoryClassProperty. The exact collected-data views depend on the classes and properties enabled in your site, so do not assume a column exists until you verify it in your own environment. Prefer supported console and reporting interfaces, and follow your organization’s rules for direct database access.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Separate policy, collection, and display failures
- If the class is absent from the client’s policy, the setting was not assigned, another setting has not merged as expected, or policy retrieval has not completed.
- If the class is present in policy but no instances appear, check whether the WMI provider exists and whether the device has volumes that expose the class.
- If Resource Explorer shows data but a report does not, validate the report’s data source, refresh timing, joins, and property selection rather than changing the client setting immediately.
- If values appear old, compare the collection timestamp with the hardware-inventory schedule and the client’s inventory-action history.
Interpret the BitLocker status values
Win32_EncryptableVolume reports status per volume. The following enumerations are defined by Microsoft for the class.
| Property | Value | Meaning |
|---|---|---|
ProtectionStatus |
0 | Protection is off. |
| 1 | Protection is on. | |
| 2 | Protection status is unknown. | |
ConversionStatus |
0 | Fully decrypted. |
| 1 | Fully encrypted. | |
| 2 | Encryption in progress. | |
| 3 | Decryption in progress. | |
| 4 | Encryption paused. | |
| 5 | Decryption paused. |
Do not reduce these two fields to one “encrypted/not encrypted” label without defining your rule. For example, a volume can be fully encrypted while protection is temporarily off, or it can be in an encryption-in-progress state. A useful compliance rule normally evaluates both properties and identifies the volume type and collection age.
The values are snapshots associated with class instantiation. Microsoft documents methods named GetProtectionStatus and GetConversionStatus for obtaining current method results on the device. ConfigMgr hardware inventory does not call those methods continuously; it reports what was collected during its scheduled cycle.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Account for multiple volumes and stale snapshots
Because the class is volume-level, reports should include a stable resource identifier plus the volume identity. Grouping only by computer can hide a data volume that is unencrypted while the operating-system volume is protected. Decide whether your policy applies to every fixed volume, only the operating-system volume, or a defined set of volumes, and express that rule in the report or collection logic.
Include an inventory-age condition in operational dashboards. A device that has not submitted hardware inventory recently should be classified as “stale” or “unknown,” not automatically as compliant. This prevents an old “ProtectionStatus 1” record from being treated as proof of the device’s present condition.
What BitLocker Management adds
Organizations that need a dedicated compliance and recovery process can deploy the separate BitLocker Management feature. Microsoft documents reports named BitLocker Computer Compliance, BitLocker Enterprise Compliance Dashboard, BitLocker Enterprise Compliance Details, BitLocker Enterprise Compliance Summary, and Recovery Audit Report. These reports become available after the reports are installed on the reporting services point and the feature is configured for the environment.
The BitLocker management administration and monitoring website provides another interface for reviewing reports, recovering drives, and managing TPM-related operations. Its prerequisites, role configuration, and deployment steps are separate from selecting a hardware-inventory class. Do not promise recovery-key escrow or audit data merely because Win32_EncryptableVolume appears in Resource Explorer.
Security, privacy, and trust limitations
Configuration Manager stores inventory in the site database and does not send this inventory data to Microsoft. HTTPS encrypts client inventory in transit. In HTTP deployments, inventory encryption can be enabled, but the data is not stored encrypted in the Configuration Manager database. Apply your organization’s database-access, retention, and privacy controls to the collected properties.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Inventory is also not authoritative security proof. Microsoft warns: “Because a user with local administrative privileges can send any information as inventory data, do not consider inventory data that is collected by Configuration Manager to be authoritative.” A local administrator can tamper with the client or submit arbitrary inventory values. Use inventory for fleet visibility and triage; use a trusted compliance or attestation control when a security decision requires independently verifiable state.
Limit the class and properties to what the reporting requirement needs. This reduces payload size and avoids collecting unrelated device information. Review who can view volume status and any associated identifiers, especially in delegated administration and multi-tenant environments.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot common failures
The class does not appear in Set Classes
Confirm that you are editing Hardware Inventory in a client setting rather than a different inventory or compliance page. Verify that the Windows device supports the RootCIMV2SecurityMicrosoftVolumeEncryption namespace and that the Configuration Manager console is connected to the intended site. If the class browser still does not list it, validate WMI health and the client’s supported operating-system scope before assigning the setting broadly.
The class is selected, but clients show no data
Check that hardware inventory is enabled, the custom setting is assigned to the device’s collection, and the client has retrieved policy after the change. Trigger policy retrieval, then trigger hardware inventory on one pilot device. Inspect the client’s policy and inventory logs for policy download, WMI-provider, communication, or processing errors. A device without a corresponding encryptable volume may legitimately return no instance.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Only some volumes are reported
Review the report’s volume filtering and the properties selected in Set Classes. The class returns instances per volume, and your query may be filtering out data volumes, removable media, or volumes whose identifiers are null in the chosen view. Test the same resource in Resource Explorer to distinguish collection from reporting logic.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Status is unexpectedly unknown or contradictory
Check the inventory timestamp first. Then compare both status properties and the local BitLocker state on the device. “Unknown” is an explicit ProtectionStatus value, while an in-progress or paused ConversionStatus is not equivalent to a completed encryption state. If a current answer is required, use a device-side check or the BitLocker Management workflow rather than waiting for ordinary inventory.
Reports remain empty after Resource Explorer is populated
Allow for site processing and reporting-service refresh time. Confirm that the report uses the same resource and inventory class names enabled in your site, and that its data source points to the correct site database. A report built against a property that was not selected will remain empty even though the class itself is present.
Inventory traffic or database growth is higher than expected
Review the schedule and the number of selected classes and properties. Remove fields that no report or collection uses, lengthen the interval where business requirements allow, and scope the setting with a custom device client setting. Pilot changes and monitor management-point, site-processing, and database performance before expanding the assignment.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRecommended operating pattern
- Define the compliance question in terms of volumes, required statuses, and acceptable data age.
- Enable the class in a custom client setting assigned to a small pilot collection.
- Verify policy retrieval, inventory timestamps, Resource Explorer output, and report interpretation on devices with known BitLocker states.
- Document how your report treats protection off, encryption or decryption in progress, paused conversion, unknown values, missing volumes, and stale inventory.
- Expand the assignment only after payload and processing behavior are acceptable.
- For recovery-key, audit, or enterprise compliance workflows, deploy and configure BitLocker Management instead of trying to reconstruct those functions from hardware inventory.
This approach gives ConfigMgr a useful, volume-aware BitLocker signal while keeping its freshness and trust limitations visible to everyone who consumes the data.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
