Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Short answer: If you mean Microsoft BitLocker and Windows native boot, no: Microsoft says BitLocker cannot encrypt either the host volume containing the native-boot VHDX or volumes inside that VHD. A VHDX is not BitLocker-protected simply because Windows starts from it. Secure Boot and a TPM can help protect the boot process and control key release for supported BitLocker volumes, but they do not remove this limitation.
First, distinguish a VHDX from the disk and boot files around it
In Microsoft’s native-boot setup, Windows runs directly from a virtual hard disk on the computer—without a parent operating system, virtual machine, or hypervisor. For native boot on Windows 10 and later, Microsoft specifies the newer VHDX format, not the older VHD format. The boot environment files and Boot Configuration Data (BCD) store reside on a system partition, while the VHDX is stored on another partition. Those are separate components, and the presence of Windows inside the VHDX does not mean the boot files or the storage holding the VHDX are encrypted. Microsoft’s native-boot deployment documentation describes this layout and its restrictions.
As an Amazon Associate I earn from qualifying purchases.
Can BitLocker encrypt a native-boot VHDX?
No. Microsoft explicitly states that BitLocker Drive Encryption cannot encrypt the host volume containing VHDX files used for native VHDX boot, and that BitLocker cannot be used on volumes inside a VHD. This is a specific BitLocker support restriction for the documented native-boot arrangement; it is not a claim about every third-party encryption product. Do not describe the VHDX or its containing volume as BitLocker-protected in this configuration.
Recommended Free Tools
If “encrypted VHD” refers to a product other than BitLocker, compatibility and recovery depend on that product and its exact version and configuration. Microsoft’s BitLocker documentation does not establish whether an unspecified third-party tool can securely encrypt a native-boot image. Check that product’s own documentation for native-boot support, which boot components remain outside the encrypted image, how keys are released, and how recovery works.
#1 Best Overall
What Secure Boot and a TPM do—and do not do
Secure Boot and Trusted Boot check startup integrity
Secure Boot verifies boot software signatures according to the computer’s platform policy. Trusted Boot continues checks through Windows startup components. These protections can help detect untrusted or changed boot software, but they are integrity controls, not encryption of the VHDX or the partition storing it. Microsoft’s overview of the Windows boot process explains the distinction.
A TPM can gate key release on supported BitLocker volumes
For a protected drive, BitLocker can use TPM measurements to release a key only when startup measurements match the expected configuration. A changed or different boot environment can prevent normal unlocking and require recovery information. That mechanism helps control access to a supported encrypted volume; it does not make Microsoft’s native-boot VHDX arrangement eligible for BitLocker encryption. Microsoft’s TPM documentation describes this key-release role.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Plan recovery before changing boot settings
For a BitLocker-protected drive, recovery is the alternative way to unlock it when normal unlocking fails. Depending on how the device and policy are configured, recovery material may be a 48-digit recovery password, a .bek recovery-key file on removable media, or information backed up to Microsoft Entra ID or Active Directory in a managed environment. Do not assume a key was backed up: verify the actual recovery route and that you or the responsible administrator can retrieve it. Microsoft’s recovery overview outlines the options.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Before making a change: Confirm access to the recovery information for each BitLocker-protected volume that may be affected.
- Record the recovery screen’s key ID if prompted: Use it to identify the matching recovery information in the relevant account or with the organization’s administrator.
- Use the recovery material for the affected volume: A recovery prompt is an access-control event, not by itself proof that data has been lost.
Changes to BCD settings, Secure Boot state, firmware settings, or boot order can affect BitLocker validation and lead to a recovery prompt. Microsoft recommends planning how an organization stores recovery information and who is authorized to retrieve it. Starting with Windows 11 version 24H2, the preboot recovery screen can show a Microsoft account hint when the recovery password is saved to that account; the hint does not establish that a key exists or replace verifying access to it. See Microsoft’s recovery planning guidance and its recovery guide.
Quick Recap
Best Value
Rank #3
What to check before relying on an encrypted boot image
- Identify the boot design: Confirm whether this is Microsoft native boot from VHDX or a virtual machine with a parent operating system.
- Name the encryption product: The BitLocker limitation does not establish the behavior of a third-party product. Verify native-boot compatibility and recovery with that vendor.
- Map the protected storage: Find out whether encryption covers the host volume, the image, other data volumes, and any boot files outside the image.
- Verify key access: Confirm where recovery information is stored, who can retrieve it, and how to match it to a recovery prompt.
- Protect recovery access before boot changes: Check keys before changing BCD, firmware settings, Secure Boot state, or boot order.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
