iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
On a personal Windows 11 Pro PC, sign in with an administrator account, open Start, type BitLocker, choose Manage BitLocker, and select Turn on BitLocker beside the drive you want to protect. The wizard asks how to unlock the drive, where to save its recovery key, and whether to encrypt used space only or the entire drive.
Plan the recovery-key backup before starting. It is a 48-digit credential, and Microsoft says Support cannot retrieve, provide, or recreate a lost key. Save it somewhere you can reach during a lockout and keep that copy separate from the encrypted PC.
Check that your Windows edition and account qualify
The Control Panel applet called BitLocker Drive Encryption is available in Windows Pro, Enterprise, and Education editions. Windows 11 Pro is supported. Windows Home does not provide this same manual management flow, so Manage BitLocker may not appear there.
| Windows edition | Manual BitLocker Drive Encryption management | What to do |
|---|---|---|
| Windows 11 Pro | Supported | Use Manage BitLocker from Start. |
| Windows Enterprise | Supported | Use the organization’s prescribed setup if the PC is managed. |
| Windows Education | Supported | Use the displayed BitLocker controls or school IT policy. |
| Windows Home | The BitLocker Drive Encryption Control Panel flow is unavailable | Check whether the device offers the separate Windows Device Encryption feature. |
You also need an administrator account to start the personal-PC setup. If the computer belongs to an employer or school, do not assume the consumer wizard is the correct procedure. Administrative policy can select the permitted unlock methods, require recovery-key escrow, and determine where recovery information is stored.
#1 Best Overall
- USB-C 2-in-1 storage OTG: The Lexar JumpDrive Dual Drive D40E features USB Type-A and Type-C connectors in a slim, portable form factor for easy device compatibility
- Transfer speeds up to 100MB/s: Based on internal testing, performance may vary depending upon the host device, interface, and usage conditions. 1MB=1,000,000 bytes
- Plug and Play: Widely compatible with USB Type-C smartphones, tablets, laptops, Macs, and traditional Type-A devices, no software installation required. The 360° swivel design allows for easy switching between connectors without the hassle of losing a cap
- Durable & Compact: The Lexar D40E USB memory stick features a metal enclosure, withstands temperatures from 0° to 50° C (32°F to 122°F), and is lightweight at 26g with dimensions of 70.4 x 16.9 x 11.7mm
- Security & Warranty: Securely protects files using an advanced security software solution with 256-bit AES encryption. Backed by a Lexar 3-year limited warranty
Open Manage BitLocker
- Sign in to Windows 11 with an administrator account.
- Open Start and type BitLocker.
- Select Manage BitLocker. Windows opens the BitLocker Drive Encryption Control Panel page.
The page can list the operating-system drive, other fixed data drives, and removable data drives. The Windows installation is normally identified as the operating-system drive. Removable media uses the BitLocker To Go portion of the feature.
Turn on encryption for the intended drive
- Find the drive you want to protect.
- Select Turn on BitLocker beside that drive.
- Read each prompt and choose the unlock and recovery settings shown for your account and hardware.
- Back up the recovery key before relying on the encryption. Confirm that the saved copy can actually be opened or read.
- Choose the encryption scope offered by the wizard: used disk space only or the entire drive.
- Start the encryption operation and leave the PC available until Windows reports that it has completed.
Microsoft notes that encryption can take time, but the computer remains usable while the process progresses. The duration is not a universal fixed value; it depends on the drive and its current contents.
Encrypting the Windows operating-system drive
Select the entry representing the Windows installation when your goal is to protect the system drive. The wizard may request additional startup or unlock choices based on the TPM, firmware, account, and any policy applied to the device. Use only the choices it presents; an organization can restrict them.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsEncrypting another fixed drive
Additional internal drives can be enabled from the same page. Verify the drive letter and contents before selecting Turn on BitLocker, because the recovery information and encryption scope apply to that specific volume.
Encrypting a removable drive
USB storage and other removable media appear under the BitLocker To Go controls. Select the removable drive’s own Turn on BitLocker command, then keep its recovery information with the same care as an operating-system drive key. A key for one volume does not automatically unlock a different encrypted volume.
Choose and protect the recovery key
The recovery key is a 48-digit number. Windows uses it when a protected drive cannot unlock normally, including after a security-risk detection or certain hardware changes. The recovery screen can show a key ID; match that ID to the stored key rather than trying keys at random.
Microsoft documents several backup destinations. Which choices appear depends on the account and device configuration.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Backup destination | Use it when | Important handling rule |
|---|---|---|
| Account-backed storage | You can sign in to the associated account from another device during recovery. | Confirm the key is visible in the account before starting encryption. |
| USB flash drive | You want a removable copy that can be kept away from the PC. | Protect the USB drive like a credential. Anyone who obtains the recovery information may be able to use it to bypass normal unlocking. |
| File saved off the encrypted device | You have a trusted second computer, network location, or other storage that will remain available. | Do not save the only copy on the drive being encrypted. |
| Printed copy | You need an offline record that does not depend on a device or account. | Store the printout securely and make sure all 48 digits remain legible. |
Use at least one destination that remains reachable if the PC is locked, lost, or damaged. If you use more than one copy, make sure every copy is protected; the recovery key is not harmless setup paperwork.
Rank #2
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
Verify a backup before you need it
Do not treat a wizard confirmation as proof that a usable backup exists. Open the account location from another device when possible, check that an off-device file can be read, or inspect the printed record for all 48 digits. Record the associated key ID with the copy if Windows displays one. For a USB backup, label it clearly without exposing the digits on the outside and store it away from the encrypted computer.
A backup must be both separate and reachable. A second file on the same internal drive can become inaccessible in the exact situation in which it is needed. Conversely, leaving an unprotected USB or printout where anyone can take it gives that person the recovery credential. Balance availability with physical and account security.
Understand TPM requirements before choosing an alternative
For operating-system-drive integrity checking, Microsoft identifies TPM 1.2 or later as the normal hardware mechanism. TPM helps Windows verify the startup environment before releasing the drive’s normal unlock path.
Microsoft also documents a firmware-dependent route for enabling an operating-system drive without a TPM. In that configuration, the firmware must be able to read a USB startup key during boot. It does not provide the same TPM-based system-integrity verification, so it should not be presented as equivalent protection.
| Item | Purpose | When it is used |
|---|---|---|
| TPM | Supports system-integrity checks for the operating-system drive. | Normal TPM-equipped setup. |
| USB startup key | Lets firmware start the operating-system drive when the no-TPM configuration is used. | Only when the firmware and policy support that documented alternative. |
| 48-digit recovery key | Restores access when automatic unlocking fails. | Recovery prompts after a security event or hardware change. |
Do not confuse a USB startup key with a recovery-key backup. The startup key is part of the boot method in the no-TPM arrangement; the recovery key is the emergency credential used when normal unlocking cannot proceed.
When the no-TPM option is appropriate
Use the no-TPM path only when the firmware and the displayed BitLocker policy explicitly support reading a startup key from USB. Confirm that the startup key will remain available every time the computer boots. Losing that key can prevent normal startup, while possessing it may provide a way to start the protected system. Keep it separate from the 48-digit recovery-key record and document which physical drive belongs to which PC.
Choose “used space only” or “entire drive”
The setup wizard presents two encryption-scope choices:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Used disk space only: encrypts the portion of the drive that currently contains data.
- Entire drive: encrypts the full volume, including currently unused space.
Read the wizard’s explanation for the specific drive before deciding. The documentation establishes these two scopes but does not give one duration, speed, or universal recommendation that applies to every new, reused, or previously populated disk. Treat the choice as a decision about the drive’s history and intended use rather than as a promise of a particular completion time.
Rank #3
- What You Get - 2 pack 64GB genuine USB 2.0 flash drives, 12-month warranty and lifetime friendly customer service
- Great for All Ages and Purposes – the thumb drives are suitable for storing digital data for school, business or daily usage. Apply to data storage of music, photos, movies and other files
- Easy to Use - Plug and play USB memory stick, no need to install any software. Support Windows 7 / 8 / 10 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, compatible with USB 2.0 and 1.1 ports
- Convenient Design - 360°metal swivel cap with matt surface and ring designed zip drive can protect USB connector, avoid to leave your fingerprint and easily attach to your key chain to avoid from losing and for easy carrying
- Brand Yourself - Brand the flash drive with your company's name and provide company's overview, policies, etc. to the newly joined employees or your customers
For a drive that has never held sensitive information, the used-space choice may be the option the wizard presents for a quicker initial conversion. A previously used drive can contain remnants in currently unused areas, so review the wizard’s explanation carefully before selecting that scope. The important point is to understand what is and is not included instead of assuming that every free sector receives the same treatment.
What to expect while encryption runs
After you confirm the scope, Windows begins the conversion in the background. Microsoft says the computer can continue to be used while encryption progresses, although the operation can take time. Keep the device available and follow the status shown in the BitLocker control panel.
Do not assume that closing the wizard means the work is complete. Return to Manage BitLocker and check the drive’s displayed state before disconnecting removable media or treating a partially processed drive as protected. For a portable computer, keep it connected to power when practical and avoid removing a removable drive while its status indicates that encryption is still running.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Recover a drive when Windows asks for the key
- Read the recovery screen and note the displayed key ID, if one is shown.
- From another device, account, printed record, or USB backup, locate the 48-digit key whose ID matches.
- Enter the digits exactly as recorded.
- After Windows unlocks the drive, investigate the event that caused the prompt, especially if it followed a hardware or firmware change.
A recovery prompt does not mean that a different key will work. Matching the key ID prevents selecting a valid key belonging to another drive or PC.
Microsoft Support explicitly states: “Microsoft Support doesn’t have the ability to retrieve, provide, or recreate a lost BitLocker recovery key.” If no copy exists, there is no Microsoft Support procedure that can regenerate it. That is why verifying the backup before encryption is part of setup, not an optional cleanup step.
Common reasons for a recovery prompt
BitLocker can request the recovery credential when it detects a security risk or after certain hardware changes. A firmware update, changed boot configuration, or replaced component can alter the startup measurements that the TPM checks. The prompt itself is not proof that the drive is damaged; it means Windows needs the stored recovery credential to confirm access. Once the correct key is entered, review recent changes and confirm that your backup remains current.
Personal PCs and managed PCs follow different rules
Personal computer
On a personal Windows 11 Pro device, follow the options shown by the wizard and choose a recovery destination you control. Keep the key separate from the PC and test that you can retrieve it.
Recommended Free Tools
Work or school computer
An organization may enforce a different setup. Policy can control which unlock methods are allowed, require that recovery information be escrowed centrally, and specify where users must obtain a key. Contact IT before changing BitLocker settings or replacing a drive. A personal USB or printed copy may not satisfy the organization’s recovery process.
Rank #4
- GOOD VALUE PACKAGE - 1 Pack 32GB Memory Stick USB 2.0 Flash Drives with great cost performance and high quality.
- BIG CAPACITY - The available capacity: 29.10GB-29.8GB, You can save the data of movies, music, photos, designs, programs, manuals, handouts in a high speed.Good performance in digital data storing, transferring and sharing with families, friends, workmates, clients and machines.
- EASY TO USE & PLUG AND WORK - Support windows 7 / 8 / 10 / Vista / XP / 2000 / ME / NT Linux and Mac OS, Compatible with USB2.0 and below.
- TWISTTURN DESIGN & EASY CARRY - The metal clip rotates 360° round the ABS plastic body which with rubber oil skin feeling finish. The capless design can avoid lossing of cap, and providing efficient protection to the USB port.
- WARRANTY & SUPPORT - SIMMAX logo is laser printed on the USB connector surface, our products are of good quality and we promise that any problem about the product within one year since you buy.
Managed devices can also display controls that differ from a personal installation. If a command is unavailable, a key destination is locked, or the wizard asks for credentials you do not have, stop rather than trying to work around policy. IT may need to record the volume identifier, place the key in an approved escrow system, or perform the encryption during a maintenance window.
BitLocker Drive Encryption versus Windows Device Encryption
Windows Device Encryption is related but distinct. Microsoft describes it as available on a wider range of devices, including some Windows Home PCs, and says eligibility and automatic enablement can involve TPM usability, the Windows Recovery Environment, and Secure Boot-related support.
This article’s procedure is specifically for manually enabling BitLocker Drive Encryption in Windows 11 Pro. If Manage BitLocker is missing, first confirm the Windows edition. On a supported device that still lacks the applet, check whether Device Encryption is the feature your edition and hardware provide rather than assuming BitLocker has silently failed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do not use the two names interchangeably when asking for help. Device Encryption may be enabled automatically after eligibility checks, while the BitLocker Control Panel flow lets an administrator select a particular operating-system, fixed-data, or removable volume. The recovery process and management location can therefore differ.
Troubleshoot the most common setup problems
“Manage BitLocker” does not appear
- Open Windows Settings and verify that the installed edition is Windows 11 Pro, Enterprise, or Education. The manual BitLocker Drive Encryption flow is not available in Windows Home.
- Make sure you searched for Manage BitLocker, not merely a similarly named security setting.
- If the PC is managed, ask IT which encryption feature and management path the organization uses.
The wizard shows no “Turn on BitLocker” command
- Confirm that you selected the intended volume in the BitLocker Control Panel list.
- Check whether organization policy controls that drive or requires IT to initiate encryption.
- For an operating-system drive, review whether the device’s TPM and firmware meet the displayed requirements.
You cannot find the saved recovery key
- Use the key ID from the recovery screen to distinguish this drive’s key from other records.
- Check every documented destination you selected: account storage, the external USB drive, the off-device file location, or the printed copy.
- If the only copy was on the encrypted PC, stop looking for a Microsoft-generated replacement; Support cannot recreate a lost key.
A USB copy is being treated as a normal startup accessory
Separate the two cases. A USB drive may hold a backup of the 48-digit recovery key, while a no-TPM setup may require a USB startup key read by firmware. The first is an emergency recovery record; the second is part of the boot configuration. Label and secure them so they are not mistaken for one another.
Encryption appears stuck
Check the status in the BitLocker Control Panel rather than inferring progress from a closed wizard. Microsoft says the process can take time and that the computer remains usable while it runs. Keep the drive connected and available, and do not remove removable media until Windows indicates that the operation has finished.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use this pre-encryption checklist
- Windows is an eligible Pro, Enterprise, or Education edition.
- You are signed in with administrator rights, or your organization’s IT department is performing the setup.
- You selected the correct operating-system, fixed-data, or removable drive.
- You know whether the PC uses a TPM-based setup or an explicitly supported no-TPM USB-startup arrangement.
- You selected an encryption scope after reading the wizard’s explanation.
- You backed up the 48-digit recovery key to a location separate from the drive.
- You verified that the backup is accessible and matches the recovery key ID if one is displayed.
- You understand who controls recovery on a managed device.
After setup: keep recovery possible
Store the recovery information where it can be reached without the encrypted PC, protect every copy from unauthorized access, and update your records if a drive is replaced or re-encrypted. If Windows later requests the key, use the matching key ID and the original 48-digit value rather than deleting the volume or repeatedly guessing credentials.
Review the recovery record after major hardware or firmware work. A new drive or a re-encryption creates a different recovery relationship, so do not assume an old printout or USB record applies to the replacement volume. For managed equipment, follow the organization’s process for updating escrowed information.
Best Value
- 【16GB Flash Drive】USB flash drives with 16GB capacity, meet your needs of daily use on work, school, home and travelling for photos, music, videos, files storage and transfer. IMEASON thumb drives can be used to store different files, easy to data backup.
- 【Metal Swivel Cap Design】USB thumb drive is metal swivel cover provides extra protection for the usb thumbdrive connector, no usb drive cap to lose; keychain design makes it easier to carry without worrying lose it.
- 【Wide Compatibility】USB drive supports Windows 7/8/10/11 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, also Supports USB 2.0 and 1.1 ports. USB Stick support TV, desktop, notebook computer, car, audio and other device. The USB Memory Stick is your great data storage and transfer companion with traveling and working.
- 【Easy to use】usb memory stick is plug and play without any software installation. Just simply plug the Flashdrive into the port of your USB-compatible devices such as computer, laptop to start data storage or transmission.
- 【What You Get】16 GB USB Flash Drive Thumb Drive, The default format of the usb storage flash drive is FAT32.
Frequently Asked Questions
Where do I find Manage BitLocker in Windows 11 Pro?
Open Start, type BitLocker, and select Manage BitLocker. The BitLocker Drive Encryption Control Panel page lists the operating-system, fixed-data, and removable drives that can be managed.
Do I need a TPM to use BitLocker on the Windows drive?
TPM 1.2 or later is the normal mechanism for operating-system-drive integrity checks. Microsoft also documents a no-TPM configuration that uses a USB startup key if firmware supports it, but that option lacks the same TPM-based integrity verification.
Where should I save the BitLocker recovery key?
Use a destination you can reach when the PC is locked: account-backed storage, an off-device file, a protected USB drive, or a secure printed copy. Keep the only copy off the encrypted drive and protect it because possession of the key can enable recovery access.
Free tools Windows power users keep installed
One-click scans. No signup required.
How long does BitLocker encryption take?
Microsoft says the operation can take time but that the computer remains usable while it progresses. There is no single duration that applies to every drive; check the status in Manage BitLocker.
What is the difference between used-space-only and entire-drive encryption?
Used-space-only encryption covers the portion currently containing data. Entire-drive encryption covers the full volume, including unused space. Read the wizard’s explanation and consider the drive’s history before choosing.
What should I do if BitLocker asks for a recovery key?
Note the key ID shown on the recovery screen, find the matching 48-digit record in your account, off-device file, USB backup, or printout, and enter it exactly. Investigate recent hardware or firmware changes afterward.
Can Microsoft Support recover a lost BitLocker key?
No. Microsoft states that Support cannot retrieve, provide, or recreate a lost BitLocker recovery key. Verify your backup before encryption instead of relying on later recovery.
Is Windows Device Encryption the same as BitLocker Drive Encryption?
They are related but distinct. Device Encryption can be available on more devices, including some Windows Home PCs, while this guide covers the manual BitLocker Drive Encryption controls in Windows 11 Pro.
Should I encrypt a work or school PC myself?
Check with IT first. Organization policy may control the unlock method, require central recovery-key escrow, and specify where recovery information must be stored.
The Bottom Line
On Windows 11 Pro, open Manage BitLocker, select the correct volume, choose the displayed settings, and back up the 48-digit recovery key somewhere separate and reachable. Confirm the backup before encryption finishes, understand whether the system uses TPM or an explicitly supported USB-startup alternative, and follow IT policy on managed PCs.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors
