On a personal Windows 11 Pro computer, sign in with an administrator account, open Start and search for BitLocker, choose Manage BitLocker, then select Turn on BitLocker for the drive you want to protect. The wizard asks how the drive should unlock, where to save its recovery key, and whether to encrypt used space or the entire drive. Save and verify the recovery key before encryption begins; without it, a lockout can make the data inaccessible.
Windows remains usable while encryption progresses, although completion can take time. Work- and school-managed computers may use an organization-controlled setup and recovery process instead of the personal-computer flow below.
As an Amazon Associate I earn from qualifying purchases.
Check these requirements before you begin
Confirm that your edition supports BitLocker
Microsoft provides the BitLocker Drive Encryption management interface in Windows Pro, Enterprise, and Education editions. Windows 11 Pro is supported. The Control Panel flow described in this guide is not available in Windows Home.
To check the edition, open Settings, go to System, select About, and look under Windows specifications. If the edition is Home, the absence of Manage BitLocker is expected; do not assume the installation is broken.
#1 Best Overall
- USB-C 2-in-1 storage OTG: The Lexar JumpDrive Dual Drive D40E features USB Type-A and Type-C connectors in a slim, portable form factor for easy device compatibility
- Transfer speeds up to 100MB/s: Based on internal testing, performance may vary depending upon the host device, interface, and usage conditions. 1MB=1,000,000 bytes
- Plug and Play: Widely compatible with USB Type-C smartphones, tablets, laptops, Macs, and traditional Type-A devices, no software installation required. The 360° swivel design allows for easy switching between connectors without the hassle of losing a cap
- Durable & Compact: The Lexar D40E USB memory stick features a metal enclosure, withstands temperatures from 0° to 50° C (32°F to 122°F), and is lightweight at 26g with dimensions of 70.4 x 16.9 x 11.7mm
- Security & Warranty: Securely protects files using an advanced security software solution with 256-bit AES encryption. Backed by a Lexar 3-year limited warranty
Use an administrator account
Sign in with an account that has administrator rights. Standard-user sessions may be able to view some settings but cannot complete all encryption changes. If more than one person uses the PC, decide which authorized account will be able to retrieve the recovery information before starting.
Decide where the recovery key will live
BitLocker creates a 48-digit recovery key. It is needed when the protected drive cannot unlock automatically, including after some security events or hardware changes. Microsoft Support says it cannot retrieve, provide, or recreate a lost key.
Choose a destination that you can reach if the PC is locked:
- Account-backed storage when that option is offered.
- A USB flash drive kept away from the computer.
- A file saved somewhere other than the drive being encrypted.
- A printed copy stored in a secure location.
Do not make the encrypted drive itself the only place where the key exists. Open the saved copy and check that the complete key and its identifying information are readable before proceeding. If the wizard offers more than one backup method, using separate, approved destinations can make recovery easier, but every copy must be protected because possession of the key can enable access.
Know whether the computer has a TPM
A Trusted Platform Module (TPM) version 1.2 or later is the normal mechanism BitLocker uses to check the integrity of the Windows startup environment before releasing the operating-system drive. Most recent Windows 11 Pro systems use this arrangement.
A documented alternative can start an operating-system drive without a TPM when the firmware can read a USB startup key during boot. That arrangement does not provide the same TPM-based system-integrity verification. A startup key in this configuration is different from the 48-digit recovery key.
Prepare the PC and the drives
Disconnecting unrelated removable storage is a simple way to reduce the chance of selecting the wrong volume in the BitLocker applet. If several internal or external drives are attached, note which one contains Windows and which ones contain data. BitLocker can list the operating-system drive, fixed data drives, and removable data drives, so the button beside each drive applies to that specific volume.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Have your chosen recovery destination available before you click through the wizard. A file backup must be stored somewhere other than the volume being encrypted, and a USB backup should remain separate from the computer afterward. The wizard’s exact unlock and backup choices can vary with the account, firmware, and device policy; read each displayed prompt rather than assuming every PC will show the same sequence.
Turn on BitLocker for the Windows drive
-
Sign in to Windows 11 Pro with an administrator account.
-
Open Start, type BitLocker, and select Manage BitLocker. The Control Panel applet lists the operating-system drive, fixed data drives, and removable data drives that can be managed.
Rank #2
SANDISK 128GB Ultra Flair, USB-A Flash Drive, Up to 150MB/s Read Speeds | USB Flash Drive, Up to 15x Faster than standard 2.0, Password Protection, Durable, Sleek Metal Casing, USB 3.0, Silver/Black- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
-
Find the operating-system drive, normally the drive containing Windows, and select Turn on BitLocker. If you intend to protect a different fixed or removable drive, use that drive’s corresponding control instead.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Follow the unlock prompts shown by the wizard. On a TPM-equipped PC, BitLocker normally uses the TPM to protect the startup process; the exact prompts can vary with the device’s configuration and policy.
-
When the wizard asks how to back up the recovery key, select a destination you can access during a lockout. Account storage, a USB drive, an off-device file, or a printout may be offered. Complete the backup and verify it before continuing.
-
Choose the encryption scope: Encrypt used disk space only or Encrypt entire drive. The next section explains the distinction.
-
Start encryption and leave the computer powered as required by the wizard. Microsoft says you can continue using the device while encryption progresses, but the operation may take time.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Read the unlock prompt carefully
The startup method is tied to the selected drive and the computer’s security configuration. A TPM-equipped operating-system drive generally unlocks automatically after the integrity check succeeds. A no-TPM configuration instead requires the firmware to read its USB startup key. Neither startup behavior replaces the recovery key: the recovery key is for a situation in which normal unlocking does not succeed.
Understand the choices in the wizard
Used disk space only versus entire drive
| Wizard option | What it covers | What to consider |
|---|---|---|
| Encrypt used disk space only | Encrypts the portions of the drive currently containing data. | The wizard offers this as one of its two documented scopes. Its suitability depends on the drive’s history and how it will be used; do not treat it as a universal recommendation. |
| Encrypt entire drive | Encrypts the whole drive, including currently unused space. | This is the other documented scope. The wizard does not promise a single completion time for every drive, so allow the process to finish rather than planning around a fixed duration. |
The choice applies to the drive selected in the applet. Read the drive label carefully before confirming, especially when several internal or external disks are attached. Do not cancel the wizard simply because the operation is taking longer than expected; Microsoft states that Windows can remain usable while encryption proceeds.
Recovery-key destinations
| Destination | Practical requirement |
|---|---|
| Account-backed storage | Make sure you can sign in to the associated account from another device if the encrypted PC cannot start. |
| USB flash drive | Keep the drive separate from the PC and protect it like a credential. Anyone who obtains the recovery information may be able to use it to recover the protected drive. |
| File saved off the encrypted drive | Use another disk or a location you can reach without unlocking the protected volume. |
| Printed copy | Store the paper securely and ensure every digit remains legible. |
A USB flash drive is optional for an ordinary TPM-equipped setup. It is simply one documented place to keep a recovery-key copy. In contrast, a USB startup key is part of the special no-TPM startup configuration. Labeling these roles clearly prevents you from taking the wrong device to a recovery screen.
What the TPM does, and what happens without one
For an operating-system drive, TPM 1.2 or later supports the integrity check that helps BitLocker detect an unexpected change to the startup environment. This is why a TPM-equipped configuration is the normal Windows 11 Pro experience.
If the wizard or your device documentation indicates that no usable TPM is present, Microsoft documents a firmware-dependent setup that stores a startup key on USB. The firmware must be able to read that key before Windows starts. Because this route lacks TPM-based integrity verification, it is not equivalent to the standard TPM configuration. Follow your organization’s instructions on a managed PC, and consult Microsoft’s current BitLocker guidance for the exact policy and firmware requirements rather than improvising.
Rank #3
- What You Get - 2 pack 64GB genuine USB 2.0 flash drives, 12-month warranty and lifetime friendly customer service
- Great for All Ages and Purposes – the thumb drives are suitable for storing digital data for school, business or daily usage. Apply to data storage of music, photos, movies and other files
- Easy to Use - Plug and play USB memory stick, no need to install any software. Support Windows 7 / 8 / 10 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, compatible with USB 2.0 and 1.1 ports
- Convenient Design - 360°metal swivel cap with matt surface and ring designed zip drive can protect USB connector, avoid to leave your fingerprint and easily attach to your key chain to avoid from losing and for easy carrying
- Brand Yourself - Brand the flash drive with your company's name and provide company's overview, policies, etc. to the newly joined employees or your customers
Keep the two keys conceptually separate:
- USB startup key: used to start an operating-system drive in a no-TPM configuration.
- Recovery key: the 48-digit number used when normal automatic unlocking fails.
Finish encryption and check its state
After you start the operation, the computer can generally be used while Windows encrypts the drive. Avoid shutting down or disconnecting a removable drive in the middle of an operation unless Windows specifically permits it. The time required varies with the drive, the selected scope, and the device’s condition; Microsoft does not state one guaranteed duration.
Return to Control Panel and open BitLocker Drive Encryption to review the listed drives and their available controls. Use the status shown there to determine whether protection is still being applied or has completed. Do not remove the only recovery-key copy while the status is in progress.
When encryption finishes, review the applet again and confirm that the intended drive is the one protected. If you encrypted a removable drive, eject it through Windows before physically disconnecting it. Keep the recovery record with that drive’s identifying information so you can distinguish it from keys belonging to other volumes.
Free tools Windows power users keep installed
One-click scans. No signup required.
Store and use the recovery key safely
Why Windows may ask for it
BitLocker can request the recovery key when it cannot automatically validate or unlock the protected drive. Microsoft cites security risks and hardware changes as examples. The recovery screen may show a key identifier. Compare that identifier with the identifier on your saved records and enter the matching 48-digit key.
Prepare before a lockout
- Keep at least one copy separate from the protected computer.
- Check that the copy contains all 48 digits and that the key identifier is present when provided.
- Make sure an authorized person can reach the account, USB drive, file, or paper copy during an emergency.
- On a work or school PC, follow the organization’s rules for storing and retrieving recovery information.
Possession of the recovery information can enable access to the encrypted drive during recovery. Treat the key as sensitive security material, not as an ordinary backup document. Do not post it in an unprotected note, send it casually to other people, or leave a USB copy attached to the computer.
“Microsoft Support doesn’t have the ability to retrieve, provide, or recreate a lost BitLocker recovery key.”
What to do at a recovery screen
- Read the key identifier displayed by Windows.
- Check each approved backup destination for a record with the same identifier.
- Enter the corresponding 48-digit number exactly as recorded.
- If several keys exist, do not guess based only on the computer’s name; match the identifier.
- If no matching record exists, contact the responsible administrator on a managed device. Microsoft Support cannot recreate a missing key.
Protect additional drives
The Manage BitLocker applet can list fixed data drives as well as the operating-system drive. Select Turn on BitLocker beside the specific fixed drive you want to protect and complete the same key-backup and scope choices presented for that drive.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Removable storage uses BitLocker To Go. Select the removable drive in the applet, confirm that it is the intended device, and follow the displayed prompts. Keep its recovery information separate from the removable drive itself; losing both together defeats the purpose of having a recovery copy. When moving an encrypted removable drive between computers, retain the key record with enough identifying information to select the correct one if Windows asks for recovery.
Personal computers and managed devices follow different rules
On a personal PC, the displayed wizard normally determines the available unlock and backup choices. On a work- or school-managed computer, policy can control which recovery methods are allowed, where keys are escrowed, and whether users are permitted to start encryption themselves.
If the device belongs to an organization, contact its IT department before changing BitLocker settings. An independently saved key may not satisfy the organization’s recovery process, and disabling or reconfiguring protection can violate policy. IT may also require a particular account-backed destination or maintain a centralized recovery record, so follow that procedure even if the wizard offers other choices.
Rank #4
- GOOD VALUE PACKAGE - 1 Pack 32GB Memory Stick USB 2.0 Flash Drives with great cost performance and high quality.
- BIG CAPACITY - The available capacity: 29.10GB-29.8GB, You can save the data of movies, music, photos, designs, programs, manuals, handouts in a high speed.Good performance in digital data storing, transferring and sharing with families, friends, workmates, clients and machines.
- EASY TO USE & PLUG AND WORK - Support windows 7 / 8 / 10 / Vista / XP / 2000 / ME / NT Linux and Mac OS, Compatible with USB2.0 and below.
- TWISTTURN DESIGN & EASY CARRY - The metal clip rotates 360° round the ABS plastic body which with rubber oil skin feeling finish. The capless design can avoid lossing of cap, and providing efficient protection to the USB port.
- WARRANTY & SUPPORT - SIMMAX logo is laser printed on the USB connector surface, our products are of good quality and we promise that any problem about the product within one year since you buy.
BitLocker versus Windows Device Encryption
Windows Device Encryption is related to BitLocker but is not the same management flow. Microsoft says Device Encryption can be available on a wider range of devices, including some Windows Home PCs, and may enable automatically when eligibility checks pass.
Recommended Free Tools
Those checks can involve TPM usability, the Windows Recovery Environment, and Secure Boot-related support. If Manage BitLocker is missing, first confirm the Windows edition. A compatible device may instead expose Device Encryption in Windows Settings, but that does not change the Windows 11 Pro BitLocker procedure described here. Do not infer that a missing Control Panel applet means the drive is unprotected or that Device Encryption has identical user controls; check the feature actually shown on the PC.
Troubleshoot common setup problems
“Manage BitLocker” does not appear
- Check Settings > System > About > Windows specifications and confirm the edition is Pro, Enterprise, or Education.
- If the computer is running Home, the Control Panel BitLocker management flow is not available.
- On an organization-owned device, ask IT whether policy hides or replaces the user-facing controls.
- If the edition is supported but the option remains absent, look for a policy-controlled setup or a different Device Encryption interface rather than repeatedly reinstalling tools.
The wizard will not let you continue
Read the message for the affected drive and confirm that you selected the intended volume. A policy-controlled computer may restrict the available unlock or recovery methods. Do not bypass an organizational policy by deleting recovery records or changing firmware settings. Make sure the selected recovery destination is available and is not the same drive that is being encrypted.
The PC asks for a recovery key at startup
- Read the key identifier shown on the recovery screen.
- Locate the saved records and find the recovery key with the matching identifier.
- Enter the corresponding 48-digit number exactly.
- If no matching record exists, check every approved backup destination. Microsoft Support cannot recreate a lost key.
You planned to use a USB drive
A USB flash drive is an optional documented backup destination for the recovery key and is not required for the ordinary TPM-equipped setup. Keep it disconnected and secured after verifying the backup. In a no-TPM startup-key configuration, follow the firmware and policy requirements for that startup key; do not substitute the recovery key.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Post-setup checklist
- Confirm the intended drive appears in the BitLocker management applet.
- Verify that encryption has completed before treating the drive as fully protected.
- Open the recovery-key backup and check that it is readable and complete.
- Store another approved copy separately from the encrypted PC.
- Record which account or physical location contains the key, without exposing the digits unnecessarily.
- For managed hardware, confirm that the organization’s recovery system has received the key according to its policy.
- Keep USB recovery media disconnected when it is not needed.
- Repeat the identification and backup checks for every additional fixed or removable drive you encrypt.
Frequently asked questions
Do I need a TPM to use BitLocker in Windows 11 Pro?
No. TPM 1.2 or later is the normal mechanism for operating-system-drive integrity checks, but Microsoft documents a no-TPM option that uses a USB startup key when the firmware can read it before Windows starts. That option lacks the same TPM-based integrity verification.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Where do I find Manage BitLocker?
Open Start, type BitLocker, and select Manage BitLocker. The Control Panel applet then lists the operating-system, fixed-data, and removable drives. The interface is available in Pro, Enterprise, and Education editions, not the standard Windows Home flow.
Is a USB flash drive required?
No for the ordinary TPM-equipped setup. A USB drive is one optional place to save a recovery-key copy. It is required only in the documented no-TPM startup arrangement, where it carries a startup key rather than the 48-digit recovery key.
Can I keep using the PC while BitLocker encrypts it?
Yes. Microsoft says the device can remain usable while encryption progresses. The operation can still take time, and removable drives should not be disconnected unless Windows specifically permits it.
Which encryption scope should I choose?
The wizard offers Encrypt used disk space only and Encrypt entire drive. Choose based on the drive’s history and intended use; the documentation does not provide one universal recommendation or a guaranteed completion time.
What if I lose the recovery key?
Microsoft Support cannot retrieve, provide, or recreate a lost key. Search every approved account, off-device file, USB, and printed backup, matching the key identifier shown on the recovery screen. On a managed PC, contact IT for the organization’s recovery process.
Best Value
- 【16GB Flash Drive】USB flash drives with 16GB capacity, meet your needs of daily use on work, school, home and travelling for photos, music, videos, files storage and transfer. IMEASON thumb drives can be used to store different files, easy to data backup.
- 【Metal Swivel Cap Design】USB thumb drive is metal swivel cover provides extra protection for the usb thumbdrive connector, no usb drive cap to lose; keychain design makes it easier to carry without worrying lose it.
- 【Wide Compatibility】USB drive supports Windows 7/8/10/11 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, also Supports USB 2.0 and 1.1 ports. USB Stick support TV, desktop, notebook computer, car, audio and other device. The USB Memory Stick is your great data storage and transfer companion with traveling and working.
- 【Easy to use】usb memory stick is plug and play without any software installation. Just simply plug the Flashdrive into the port of your USB-compatible devices such as computer, laptop to start data storage or transmission.
- 【What You Get】16 GB USB Flash Drive Thumb Drive, The default format of the usb storage flash drive is FAT32.
Can I use the same key for every drive?
Do not assume that. Backups are associated with protected drives and may show identifying information. Keep each record labeled well enough to match the identifier Windows displays during recovery.
Is Device Encryption the same as BitLocker?
No. Device Encryption is a related feature that can be available on a wider range of devices and may enable automatically after checks involving TPM usability, Windows Recovery Environment, and Secure Boot-related support. This guide covers the BitLocker Drive Encryption management flow in Windows 11 Pro.
Frequently Asked Questions
How do I turn on BitLocker in Windows 11 Pro?
Sign in as an administrator, search Start for BitLocker, open Manage BitLocker, select Turn on BitLocker beside the intended drive, back up the 48-digit recovery key, choose the encryption scope, and start encryption.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhere should I save my BitLocker recovery key?
Use an account-backed destination when offered, an off-device file, a separate USB flash drive, or a secure printed copy. Verify that the backup is readable and never keep the encrypted drive as the only copy.
What happens if BitLocker asks for a recovery key?
Read the key identifier on the recovery screen, find the saved record with the matching identifier, and enter its 48-digit number. Microsoft Support cannot recreate a lost key.
Should I encrypt used space only or the entire drive?
The wizard offers both choices. Used-space-only encryption covers portions currently containing data; entire-drive encryption also covers unused space. Select according to the drive’s history and intended use rather than assuming one option fits every disk.
Can I set up BitLocker without a TPM?
Microsoft documents a firmware-dependent USB startup-key configuration. It can start the operating-system drive without a TPM, but it does not provide the same TPM-based system-integrity verification.
Why can’t I find Manage BitLocker?
Confirm the edition under Settings > System > About. The Control Panel management flow is available in Pro, Enterprise, and Education, not Windows Home. On a managed PC, policy may also control or hide the interface.
The Bottom Line
To protect a Windows 11 Pro drive, open Manage BitLocker as an administrator, select the intended drive, back up and verify its 48-digit recovery key somewhere separate, choose used-space-only or entire-drive encryption, and let the process finish. Keep the recovery information secure and follow IT instructions on managed computers.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
