How to Enable and Configure BitLocker Using CMD

Check requirements and back up recovery information

BitLocker encrypts Windows volumes to help protect data if a device is lost or stolen. Full BitLocker enablement is supported in Windows Pro, Enterprise and Education editions. Eligible devices in other editions can offer the separate Device encryption feature. Check Microsoft‘s BitLocker requirements for your system.

Before changing encryption, back up important files and make sure your recovery information is stored somewhere you can access if the computer will not start. If you have just reinstalled Windows, complete the checklist for a fresh Windows installation before continuing.

The operating-system examples below assume the system drive is C:, its TPM is ready, and the computer’s policy permits the chosen protector. For a work or school PC, follow the administrator’s encryption and recovery-backup policy. Do not clear the TPM or delete existing protectors to get around an error.

For a new SSD or a planned reinstall, settle the MBR or GPT partition layout before encrypting it. Changing the boot configuration later can require recovery information.

1. Open an administrator Command Prompt and check the drive

Search Windows for Command Prompt, select Run as administrator, and accept the elevation prompt. The same executable can run from a command shell in Windows Terminal. Installing PowerShell 7 is not required for these commands. If you also use scripts, our PowerShell installation guide explains the separate versions.

manage-bde -status
manage-bde -status C:
manage-bde -protectors -get C:

Read the volume type, conversion status, encryption percentage, protection status and listed protectors. A volume can be encrypted while its protection is suspended. Protection On and the intended protectors matter as well as the encryption percentage. If protection is already correctly configured, you do not need to enable BitLocker again.

2. Understand OS-drive and data-drive protectors

Protector	Typical role
TPM, or TPM with a startup PIN	Unlocks the Windows operating-system volume at startup, subject to device capability and policy.
Data-drive password	Unlocks a separate fixed or removable data volume. The -password example below is for a data drive.
Numerical recovery password	A 48-digit recovery credential, often called a recovery key in the Windows interface.
External recovery or startup key	A key stored in a .bek file. A USB startup key and a numerical recovery password are different credentials.

You do not universally need a data-drive password plus a USB recovery-key file. Choose a primary unlock method and keep an independent recovery method. Microsoft’s protector reference documents the supported types.

3. Enable BitLocker on a TPM-equipped Windows drive

If C: has no numerical recovery-password protector, add one:

manage-bde -protectors -add C: -recoverypassword
manage-bde -protectors -get C:

Save the generated 48-digit recovery password and its identifier in an approved location separate from this PC. If that protector already exists, back up its existing recovery information instead. In Manage BitLocker, the recovery-backup options provide a guided way to make additional copies. Do not keep the only copy on the volume you are encrypting.

Once recovery information is accessible, enable encryption:

manage-bde -on C:

On a suitable TPM-equipped system, the default OS-drive flow uses the TPM. Follow any hardware-check and restart prompts. If policy requires a PIN or another startup method, use the approved configuration rather than assuming TPM-only unlock is suitable. Do not add -skiphardwaretest merely to bypass a failed check.

4. Enable BitLocker on a separate data drive

In this example, E: is a data volume. Confirm its letter and contents first, then add a normal unlock password and a recovery password:

manage-bde -protectors -add E: -password
manage-bde -protectors -add E: -recoverypassword
manage-bde -protectors -get E:

Enter the data-drive password when prompted and back up the generated recovery information before starting encryption:

manage-bde -on E:

The command’s encryption options include whole-volume and used-space-only encryption. Used-space-only encryption does not protect previously deleted plaintext in free space. For a drive that already held confidential files, consider whole-volume encryption and follow your organization’s policy. See Microsoft’s BitLocker operations guide for the decision and configuration options.

5. Verify encryption and use the drive

manage-bde -status C:
manage-bde -status E:
manage-bde -protectors -get E:

Check that conversion has finished, protection is on, and the expected primary and recovery protectors are present. For a locked data drive protected with a password, use:

manage-bde -unlock E: -password

Use your own password at the prompt. Other recovery methods use different parameters in Microsoft’s unlock reference. Avoid putting recovery secrets in shared scripts, screenshots or support messages.

What if a command fails?

Record the actual error, check the Windows edition and drive type, and inspect the existing protectors. A policy restriction, unavailable TPM or unsupported drive configuration calls for a specific fix. manage-bde -on /? shows the enable-command help. Encryption does not replace file backups, and an unlocked Windows session can still access the files normally.