PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To inventory BitLocker status in SCCM (Configuration Manager), enable hardware inventory for the applicable clients and add the Win32_EncryptableVolume WMI class to their inventory settings. The class is in RootCIMV2SecurityMicrosoftVolumeEncryption and reports protection and encryption-conversion states for each volume. Clients return those values during their scheduled hardware-inventory cycle; this is scheduled fleet inventory, not a live BitLocker monitor.
What enabling BitLocker inventory does
Configuration Manager hardware inventory can collect selected WMI classes from Windows clients and store the results in the site database. Adding Win32_EncryptableVolume gives you volume-level BitLocker information that can be viewed in Resource Explorer or used in supported inventory reporting.
The class exposes status properties such as ProtectionStatus and ConversionStatus. A computer with an operating-system volume, fixed data volumes, or other supported volumes can therefore produce multiple inventory rows. Each row describes one volume, not an aggregate state for the entire computer.
Recommended Free Tools
This configuration does not turn BitLocker on, change encryption policy, escrow recovery keys, or provide the dedicated compliance and recovery workflows in Configuration Manager’s BitLocker Management feature. It only collects the WMI data that the client reports.
#1 Best Overall
- Hardware encrypted drive
- Simple to use pin access. RPM-5400
- Administrator password feature
- Bus powered
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
Before you configure it
Confirm the intended scope
Decide whether every managed Windows client should report the class or whether only a pilot, server, workstation, or compliance collection needs it. Use Default Client Settings for broad deployment. For a limited scope, create or select a custom device client setting and assign it to the intended collection.
A pilot assignment is useful for confirming that the class appears on the Windows versions you manage, that the returned rows match your volume layout, and that your reporting logic handles unknown or transitional states. Expand the assignment only after those checks pass.
Check the inventory trade-off
Every additional inventory class and property increases the payload sent by clients and the processing work at management points and the site. Select only the class and fields required for your reports. A narrow class extension is usually preferable to enabling broad, unrelated WMI data.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesIf several client settings apply to the same device, review all of them when investigating unexpected inventory load. Inventory class selections can merge, so adding a class in one setting does not necessarily remove classes enabled by another setting.
Know the reporting expectation
Hardware inventory is asynchronous. A client must receive policy, run its next inventory cycle, send the report through a management point, and wait for processing into the site database. The result can be older than the current BitLocker state, especially when the inventory interval is long or a device is offline.
Set the schedule according to the decision you are making. A help-desk dashboard may tolerate a delayed observation, while an operational response to a protection change may require a direct, current BitLocker check or a BitLocker Management workflow.
Enable the WMI class in Client Settings
-
Open the Configuration Manager console and go to Administration > Client Settings.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Select Default Client Settings for organization-wide collection, or select a custom device client setting for targeted deployment. Open Properties.
-
Choose Hardware Inventory. Set Enable hardware inventory on clients to Yes.
-
Set the hardware-inventory schedule appropriate for your reporting need. A shorter interval improves freshness but increases client, network, and site workload; a longer interval reduces overhead but leaves a larger observation gap.
-
Select Set Classes. In the inventory-class list, locate the Windows class
Win32_EncryptableVolume. Its namespace isRootCIMV2SecurityMicrosoftVolumeEncryption.Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Enable the class and retain the status properties needed by your report, including
ProtectionStatusandConversionStatus. Apply the class selection and save the client-setting properties. -
If you used a custom setting, verify that it is assigned to the collection containing the devices you want to inventory. Clients can receive multiple client settings; Configuration Manager can merge hardware-inventory class selections from those settings. Check the effective policy rather than assuming that one setting has replaced another.
Rank #2
Apricorn 1TB Aegis Padlock USB 3.0 256-bit AES XTS Hardware Encrypted Portable External Hard Drive (A25-3PL256-1000)- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
What to verify in the class selector
Use the exact class name and namespace. A similarly named class from another namespace is not a substitute, and enabling software inventory does not collect this WMI class. The class selector determines what the client reports; it does not execute the class’s current-status methods continuously.
Get the first inventory results
-
Allow the targeted clients to retrieve the updated client policy. Until policy refresh occurs, they will continue using their previous inventory configuration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Allow the next scheduled hardware-inventory cycle to run. The class is collected when that cycle executes; selecting the class in the console does not immediately query every device.
-
The client sends inventory through its management point, where Configuration Manager processes it into the site database.
-
Open the device in Resource Explorer and inspect the collected hardware-inventory data. Look for the
Win32_EncryptableVolumeclass and its per-volume rows. -
For broader reporting, use supported Configuration Manager inventory views. Microsoft’s hardware-inventory SQL reference documents
v_InventoryClassandv_InventoryClassProperty; the exact collected views and property names depend on the classes enabled in your site.Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
If you need a result immediately for a test device, use the normal client-policy and hardware-inventory actions available in your installed Configuration Manager branch, then verify that the device has completed both policy retrieval and inventory submission. Labels and action names can vary between current-branch releases.
A practical validation sequence
Start with one known test computer whose BitLocker state you can verify locally. Confirm that the client receives the setting, then check Resource Explorer after a completed inventory submission. Compare the returned volume rows with the computer’s actual operating-system and data volumes. Only then build a collection or dashboard. This sequence separates a policy-assignment problem from a reporting-query problem.
Interpret the BitLocker status values
The Windows WMI class publishes numeric enumerations. Store the numeric value and map it to a human-readable label in your query or report. The values are per volume.
| Property | Value | Meaning |
|---|---|---|
ProtectionStatus |
0 | Protection off |
ProtectionStatus |
1 | Protection on |
ProtectionStatus |
2 | Unknown |
ConversionStatus |
0 | Fully decrypted |
ConversionStatus |
1 | Fully encrypted |
ConversionStatus |
2 | Encryption in progress |
ConversionStatus |
3 | Decryption in progress |
ConversionStatus |
4 | Encryption paused |
ConversionStatus |
5 | Decryption paused |
These are status enumerations defined by Microsoft’s Win32_EncryptableVolume reference, not deployment statistics. Treat an unknown value as unknown rather than assuming that the drive is encrypted or unencrypted.
Protection and conversion are different questions
ProtectionStatus indicates whether BitLocker protectors are currently protecting the volume. ConversionStatus indicates the encryption or decryption state of the volume itself. A volume can be fully encrypted while protection is temporarily off, so a report that checks only one property can misclassify a device.
For example, a volume with conversion status 1 and protection status 0 is encrypted but not currently protected by its protectors. Conversely, a conversion status of 2 or 4 indicates that encryption is not yet in the steady fully-encrypted state, even if protection is reported on. Define how those combinations should appear in your dashboard instead of collapsing them into a single Boolean.
Understand the snapshot limitation
Microsoft notes that status properties represent values captured when the WMI class instance is created and that they can change. The class also exposes GetProtectionStatus and GetConversionStatus methods for current method results. Configuration Manager hardware inventory does not call those methods continuously; it records what the client reports during its inventory cycle. Present the result with an inventory timestamp and describe it as the latest collected observation.
Rank #3
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
Build useful reports without treating inventory as live telemetry
Resource Explorer for device-level checks
Resource Explorer is suited to checking one device, confirming that the class is arriving, and seeing which volumes were returned. It is also useful during a pilot before you build a collection or a SQL-based report.
Inventory views for fleet reporting
Use the documented inventory metadata views to discover class and property names in your site, then build a report or query that joins the device identity to the volume rows. Include the volume identifier, both BitLocker status properties, and the inventory timestamp where available. Because one computer can have several volumes, design the report as one-to-many data rather than forcing one row per computer.
When a computer-level summary is required, define the roll-up rule explicitly. For example, decide whether any unprotected volume makes the computer noncompliant, whether only the operating-system volume counts, and how removable or data volumes are treated. A query that selects one arbitrary row can hide a noncompliant second volume.
Define the compliance rule explicitly
Decide whether your rule requires protection on, full encryption, both conditions, or a separate treatment for removable and data volumes. The WMI class supplies the values; it does not decide your organization’s compliance policy. Document how unknown, paused, and in-progress states are handled before publishing a dashboard.
Keep the raw numeric fields alongside their labels. This makes it possible to revise a rule later without recollecting the class and helps operators distinguish a genuine unknown value from a query or translation error.
Hardware inventory versus BitLocker Management
Choose the capability based on the outcome you need. They are related but not interchangeable.
| Capability | Hardware inventory of Win32_EncryptableVolume |
Configuration Manager BitLocker Management |
|---|---|---|
| Primary purpose | Collect selected WMI status data into the Configuration Manager inventory database. | Provide dedicated BitLocker compliance, recovery-audit, and administrative workflows. |
| Data freshness | Updates on the configured hardware-inventory schedule after policy and client submission. | Uses the BitLocker Management feature’s own compliance and recovery reporting mechanisms. |
| Detail | Volume-level properties such as protection and conversion status. | Enterprise compliance views and recovery-oriented administration. |
| BitLocker configuration | Does not configure BitLocker or enforce policy. | Designed for BitLocker administration in environments that have deployed and configured the feature. |
| Recovery keys | Does not escrow or recover keys. | Includes recovery-oriented reporting and workflows when the feature is configured. |
| Setup focus | Client Settings, Hardware Inventory, and the WMI class selection. | BitLocker Management deployment and installation of its reports on a reporting services point. |
Use ordinary hardware inventory when you need a WMI status field in an existing ConfigMgr inventory workflow. Use BitLocker Management when you need its dedicated enterprise compliance and recovery-audit functions. Enabling the WMI class does not automatically create BitLocker Management reports.
BitLocker Management reports and administration
Microsoft documents a separate report set for the BitLocker Management feature. The named reports include:
- BitLocker Computer Compliance
- BitLocker Enterprise Compliance Dashboard
- BitLocker Enterprise Compliance Details
- BitLocker Enterprise Compliance Summary
- Recovery Audit Report
These reports become available after the report definitions are installed on the reporting services point as part of the BitLocker Management setup. The BitLocker administration and monitoring website provides another interface for reviewing reports, recovering drives, and managing TPMs. Installing or selecting Win32_EncryptableVolume in hardware inventory is not a substitute for installing and configuring that feature.
Free tools Windows power users keep installed
One-click scans. No signup required.
If your requirement includes recovery-key escrow, audited recovery, TPM administration, or a dedicated enterprise compliance dashboard, plan the BitLocker Management deployment separately. Do not promise those capabilities merely because inventory rows are present.
Security, privacy, and trust boundaries
How inventory data is protected in transit
Microsoft’s Configuration Manager security and privacy guidance states that HTTPS encrypts client inventory in transit. In HTTP deployments, inventory encryption can be enabled through the applicable Configuration Manager security settings. Inventory data is stored in the Configuration Manager database and is not sent to Microsoft.
The database is not an encrypted evidence store
The same guidance states that inventory data is not stored encrypted in the database. Apply your normal database access controls, reporting permissions, retention rules, and privacy reviews. Avoid enabling classes that collect information you do not need.
Inventory is not authoritative proof
A local administrator can send arbitrary inventory data. Microsoft therefore cautions: “Because a user with local administrative privileges can send any information as inventory data, do not consider inventory data that is collected by Configuration Manager to be authoritative.” Use the collected values for fleet visibility and triage, not as sole cryptographic proof that a drive is protected.
Rank #4
- Separate Admin and User Modes
- Aegis Configurator Compatible
- Admin and User Forced Enrollment
- Data Reovery PIN's
- Programable Brute-Force Defense
Troubleshooting common failures
The class is missing from Set Classes
- Confirm that you are editing the Hardware Inventory properties of the intended client setting, not Software Inventory or another client-setting category.
- Search for the exact class name,
Win32_EncryptableVolume, and verify the namespaceRootCIMV2SecurityMicrosoftVolumeEncryption. - Check the installed Windows and Configuration Manager versions. Product UI and class availability can differ by supported platform and current-branch release.
Clients show no rows after the setting was saved
- Verify the custom setting is assigned to the collection containing the device.
- Confirm the device has downloaded the new policy; console changes do not alter a client until policy retrieval occurs.
- Wait for a completed hardware-inventory cycle and management-point submission.
- Check Resource Explorer on a known test device before troubleshooting a fleet report.
Values look stale
- Compare the inventory timestamp with the time the drive’s BitLocker state changed.
- Remember that inventory is schedule-based and may be delayed by an offline client or processing backlog.
- Use a current BitLocker query or the BitLocker Management workflow when an immediate operational decision or recovery action is required; do not label the inventory row as real-time.
A computer appears more than once
Multiple rows are expected when the computer has multiple encryptable volumes. Report by device and volume, and define which volumes count toward your compliance rule.
Inventory processing becomes heavier
Review the classes enabled in the affected client settings and remove unnecessary properties. Narrow the assignment to the collections that need BitLocker visibility, then monitor inventory processing and network usage after the change. Configuration Manager can merge class selections from multiple client settings, so inspect all effective settings when an unexpected class is being collected.
The report shows a single status for a multi-volume device
Check whether the query grouped rows without a documented rule. A device can have separate operating-system and data-volume observations, and each can have different protection or conversion values. Preserve the volume-level result and calculate a device-level status only after deciding which volumes are in scope.
Implementation checklist
- Choose Default Client Settings or a targeted custom device setting.
- Enable hardware inventory and set an interval appropriate to the freshness requirement.
- Add
Win32_EncryptableVolumefromRootCIMV2SecurityMicrosoftVolumeEncryption. - Retain the status properties required by the report.
- Assign the custom setting, if used, to the correct collection.
- Refresh policy on a test client and wait for its next inventory cycle.
- Verify per-volume rows in Resource Explorer.
- Build reporting that maps the numeric enumerations and includes collection time.
- Decide whether dedicated BitLocker Management reports are required for compliance or recovery workflows.
- Review transport security, database permissions, privacy requirements, and the non-authoritative nature of client-supplied inventory.
Bottom line
Enable hardware inventory, add Win32_EncryptableVolume under the Microsoft Volume Encryption namespace, assign the setting to the right clients, and wait for scheduled collection. This gives ConfigMgr volume-level BitLocker status, but it remains a periodic inventory snapshot. For policy enforcement, enterprise compliance dashboards, recovery auditing, or drive recovery, configure the separate BitLocker Management feature instead.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Frequently Asked Questions
Does enabling Win32_EncryptableVolume turn on BitLocker?
No. It only collects status data already exposed by the Windows WMI class. It does not encrypt a volume, configure protectors, enforce policy, escrow recovery keys, or recover a drive.
Where is the BitLocker class located?
The class is Win32_EncryptableVolume in the RootCIMV2SecurityMicrosoftVolumeEncryption namespace. Select that exact class in the Hardware Inventory Set Classes dialog.
How quickly will a new status appear in ConfigMgr?
Only after the client receives the updated policy, runs its next scheduled hardware-inventory cycle, submits the report through a management point, and the site processes it. The delay depends on your schedule, client connectivity, and processing state.
Why does one computer have several BitLocker rows?
The class is volume-based. An operating-system volume and one or more data volumes can each produce a row with its own ProtectionStatus and ConversionStatus values.
What is the difference between ProtectionStatus and ConversionStatus?
ProtectionStatus describes whether protectors are on, off, or unknown. ConversionStatus describes whether the volume is fully encrypted, fully decrypted, encrypting, decrypting, or paused. Evaluate both when defining compliance.
Can I use this inventory as proof that a drive is protected?
No. Inventory is a scheduled snapshot, and a local administrator can submit arbitrary inventory data. Use it for fleet visibility and triage, and apply stronger operational checks when authoritative evidence is required.
Do these settings provide recovery-key reports?
No. Hardware inventory does not escrow or recover keys. Use the separately deployed BitLocker Management feature and its reporting services point reports for dedicated compliance and recovery workflows.
How can I limit collection to a pilot group?
Create or select a custom device client setting, enable the class there, and assign that setting to the intended collection. Confirm effective settings because inventory classes from multiple client settings can merge.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What should a report do with an unknown or paused value?
Keep the numeric value, map it to its documented label, and define an explicit policy for unknown, paused, and in-progress states. Do not silently treat unknown as encrypted or compliant.
The Bottom Line
Enable hardware inventory and the Win32_EncryptableVolume class for the right clients, then validate the scheduled, per-volume results. Use BitLocker Management separately when you need enforcement, dedicated compliance reporting, recovery auditing, or key-recovery workflows.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
