Manage BitLocker with PowerShell in Windows 11

Before You Start: Editions, TPM and Permissions

A few conditions decide whether these commands work. Check them first, because most failures trace back to one of them.

Which 🪟 Windows 11 editions support BitLocker

Full BitLocker management is available on Windows 11 Pro, Enterprise and Education. Windows 11 Home does not include the BitLocker Drive Encryption control panel.

Some Home PCs have a lighter feature called device encryption instead, which you find in Settings › Privacy & security › Device encryption. If that page is missing, your hardware does not support it. This guide does not confirm that the BitLocker cmdlets can turn on encryption on Home, so use the Settings page there.

What a TPM is and why it matters

A TPM (Trusted Platform Module, a security chip that stores encryption keys) lets BitLocker start your PC without asking for a password at every boot. Windows 11 requires TPM 2.0, so most PCs that run it have one. You check its state in the steps below.

Why you need administrator rights

BitLocker commands change protected system settings. In a normal PowerShell window, most of them fail with an access denied error. Open PowerShell as administrator before you run anything in this guide.

Key terms used in this guide

A mount point is the drive letter, such as C: or D:. A key protector is a method BitLocker uses to guard the encryption key, such as the TPM, a password, or a recovery password. A recovery password is a 48-digit number that opens the drive if normal methods fail. You need it if you change hardware, reset the TPM, or forget a password.

Turn On BitLocker and Back Up the Recovery Password with PowerShell

To manage BitLocker from the start, these steps check your PC, encrypt the system drive, and save a recovery password. Run them in order.

1. Open the Start menu⊞. Type PowerShell in the search🔍 box. Windows PowerShell appears at the top of the results.
2. Run PowerShell as administrator. Right-click Windows PowerShell and choose Run as administrator. (Requires administrator privileges.)
3. Select Yes at the User Account Control prompt. The window title now starts with Administrator: Windows PowerShell. If it does not, close it and repeat the previous step.
4. Check the TPM. Type the command below and press Enter.
   

   ⬛PowerShell

   Copy

   Get-Tpm

   Look for TpmPresent and TpmReady. Both should read True. If TpmPresent is False, the PC has no usable TPM, or it is turned off in the firmware settings (UEFI, the low-level software that starts your PC).

5. Check the current BitLocker status. Run the command below.
   

   ⬛PowerShell

   Copy

   Get-BitLockerVolume

   PowerShell lists every drive with its VolumeStatus and ProtectionStatus. A drive that is not encrypted shows FullyDecrypted and Off. If C: already shows FullyEncrypted and On, skip to the recovery password step.

6. Turn on BitLocker for the system drive. Run the command below.
   

   💻Code

   Copy

   Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmProtector

   XtsAes256 is the encryption method, and -TpmProtector ties the key to the TPM. The -UsedSpaceOnly switch encrypts only the space that holds data, which is faster on a new PC. On a PC you have used for a while, remove that switch so Windows encrypts the whole drive, including deleted file remnants. Full encryption takes longer.

7. Add a recovery password. Run the command below.
   

   💻Code

   Copy

   Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector

   PowerShell prints the drive details, including a RecoveryPassword line with 48 digits in groups of six, and a KeyProtectorId inside curly braces.

8. Save the recovery password off this PC. Copy the 48 digits to a password manager, print them, or save them to a USB drive that you store elsewhere. Do not keep the only copy on the encrypted drive.
9. Restart the🔄 PC if Windows asks. On a system drive, Windows may run a hardware test at the next start before encryption begins. Save your work first.
10. Check encryption progress. After the restart, open an administrator PowerShell window and run the command below.
    

    ⬛PowerShell

    Copy

    Get-BitLockerVolume -MountPoint "C:"

    EncryptionPercentage climbs toward 100. When VolumeStatus reads FullyEncrypted and ProtectionStatus reads On, the drive is protected. You can use the PC normally while encryption runs.

To see the same information in a window, follow the guide to open BitLocker settings in Windows 11.

Check BitLocker Status and Key Protectors

Checking status is the command you will use most. It tells you whether a drive is protected and how.

Read the status of every drive

Run Get-BitLockerVolume in an administrator PowerShell window. The fields that matter most are:

• MountPointthe drive letter.
• EncryptionMethodthe algorithm in use, for example XtsAes256.
• VolumeStatusFullyEncrypted, EncryptionInProgress, DecryptionInProgress or FullyDecrypted.
• ProtectionStatusOn or Off. Suspending BitLocker leaves the drive encrypted, but protection stays Off until you resume it.
• LockStatusLocked or Unlocked. This applies to data drives.

List key protectors and recovery passwords

To see every key protector on a drive, including recovery passwords, run this command:

(Get-BitLockerVolume -MountPoint "C:").KeyProtector

Each entry shows a KeyProtectorId, a KeyProtectorType such as Tpm or RecoveryPassword, and the recovery password itself where one exists. You need the ID when you remove or back up a specific protector.

Back up the key to your organization

On a PC joined to Active Directory (the directory a company uses to manage its computers and users), run Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId "{00000000-0000-0000-0000-000000000000}", replacing the example ID with your own. On a PC joined to Microsoft Entra ID (the Microsoft directory that manages work and school accounts), the matching cmdlet is BackupToAAD-BitLockerKeyProtector, with the same two parameters. Both only work if your organization allows key backup.

Suspend and Resume BitLocker Protection

Suspending BitLocker keeps the drive encrypted but pauses protection, so Windows reads it without checking the TPM. Suspend before a BIOS or firmware update, or any change that would otherwise trigger the recovery screen.

1. Open PowerShell as administrator. Use the same method as before. (Requires administrator privileges.)
2. Suspend protection for one restart. Run the command below.
   

   💻Code

   Copy

   Suspend-BitLocker -MountPoint "C:" -RebootCount 1

   Protection resumes on its own after one restart. A higher number keeps protection off for more restarts before it resumes. A value of 0 suspends it until you resume it by hand.

3. Resume protection. Run the command below when you finish.
   

   💻Code

   Copy

   Resume-BitLocker -MountPoint "C:"

4. Confirm the result. Run Get-BitLockerVolume -MountPoint "C:". ProtectionStatus should read On.

The Settings and Control Panel versions of this task are covered in how to suspend and resume BitLocker in Windows 11 and how to pause and restart BitLocker on Windows 11.

Lock and Unlock a BitLocker Data Drive

Locking a data drive makes it unreadable until someone supplies the password or recovery password. This works on fixed data drives and removable drives. Windows does not let you lock the drive it is running from.

Lock a data drive

1. Close any files open on the drive. Windows cannot lock a drive that apps are still using.
2. Lock the drive. In an administrator PowerShell window, run the command below.
   

   💻Code

   Copy

   Lock-BitLocker -MountPoint "D:" -ForceDismount

   The -ForceDismount switch disconnects the drive from Windows first. The drive then shows a padlock icon in File Explorer📁.

The File Explorer method is in how to lock a BitLocker drive in Windows 11.

Open a locked drive

The cmdlet that opens a locked drive is Unlock-BitLocker. To use a password, first store it as a secure string (an encrypted text object that keeps the password off the screen), then pass it in:

$pw = Read-Host -AsSecureString
Unlock-BitLocker -MountPoint "D:" -Password $pw

PowerShell prompts for the password and hides the characters as you type. To use a recovery password instead, run:

Unlock-BitLocker -MountPoint "D:" -RecoveryPassword "000000-000000-000000-000000-000000-000000-000000-000000"

Replace the example digits with your own 48-digit recovery password. If the password is wrong, PowerShell returns an error and the drive stays locked. Retype it carefully, because the recovery password needs the hyphens between groups.

Open a data drive automatically at sign-in

Automatic drive opening tells Windows to open a data drive without a prompt whenever you sign in to this PC. It requires the system drive to be encrypted, because Windows stores the key there. Run:

Enable-BitLockerAutoUnlock -MountPoint "D:"

To turn it off, run Disable-BitLockerAutoUnlock -MountPoint "D:". The Settings method is in how to set BitLocker to open your Windows 11 drive automatically.

Encrypt a Data Drive with a Password

Data drives do not need a TPM. A password protector is the usual choice for a second internal drive or a USB drive.

1. Open PowerShell as administrator. (Requires administrator privileges.)
2. Store the password you want to use. Run the command below, then type the password when prompted.
   

   ⬛PowerShell

   Copy

   $pw = Read-Host -AsSecureString

   Nothing appears as you type. Press Enter when done.

3. Turn on BitLocker for the drive. Run the command below, replacing D: with your drive letter.
   

   💻Code

   Copy

   Enable-BitLocker -MountPoint "D:" -EncryptionMethod XtsAes256 -PasswordProtector -Password $pw

   For a USB drive you will use on older versions of Windows, choose a different encryption method. XTS-AES is the newer method, and older Windows versions may not open it. Use Aes256 instead for that case.

4. Add a recovery password. Run the command below.
   

   💻Code

   Copy

   Add-BitLockerKeyProtector -MountPoint "D:" -RecoveryPasswordProtector

   Save the 48-digit number that appears, as you did for the system drive.

5. Check progress. Run Get-BitLockerVolume -MountPoint "D:" until VolumeStatus reads FullyEncrypted.

Change a BitLocker Password or Remove a Key Protector

PowerShell has no single command that changes a password. Instead, you add a new password protector and remove the old one. This applies to data drives that use a password.

Removing the wrong protector can leave you with no way to open the drive. Add the new protector first, and check that it exists before you remove the old one.

1. Open PowerShell as administrator. (Requires administrator privileges.)
2. List the current protectors. Run the command below.
   

   💻Code

   Copy

   (Get-BitLockerVolume -MountPoint "D:").KeyProtector

   Note the KeyProtectorId of the entry whose type is Password.

3. Enter the new password. Run the command below and type it when prompted.
   

   ⬛PowerShell

   Copy

   $pw = Read-Host -AsSecureString

4. Add the new password protector. Run the command below.
   

   💻Code

   Copy

   Add-BitLockerKeyProtector -MountPoint "D:" -PasswordProtector -Password $pw

5. Remove the old password protector. Run the command below, using the ID you noted.
   

   💻Code

   Copy

   Remove-BitLockerKeyProtector -MountPoint "D:" -KeyProtectorId "{00000000-0000-0000-0000-000000000000}"

   Replace the example ID with the real one, braces included.

6. Confirm the change. List the protectors again. Only the new Password entry should remain, with your recovery password.

For the graphical route, see how to change the BitLocker password in Windows 11.

Turn Off BitLocker with PowerShell

Turning off BitLocker decrypts the drive and removes all its key protectors. This can take a long time on a large drive, and the drive stays usable while it runs.

1. Open PowerShell as administrator. (Requires administrator privileges.)
2. Start decryption. Run the command below, changing the drive letter if needed.
   

   💻Code

   Copy

   Disable-BitLocker -MountPoint "D:"

3. Watch the progress. Run Get-BitLockerVolume -MountPoint "D:". VolumeStatus shows DecryptionInProgress, then FullyDecrypted when done.

To turn encryption back on, follow the turn-on steps earlier in this guide, because running the Enable-BitLocker command a second time does not re-encrypt the drive. [Verification Required: the source says to run the same command again, which would not re-encrypt the drive. Confirm the correct command.] Encryption restarts from the beginning. The same applies when you want a different encryption method: BitLocker cannot change a drive’s method in place, so decrypt first, then encrypt again. The process is explained in how to change BitLocker encryption in Windows 11.

Why a BitLocker Command Fails

Most errors come from a short list of causes. Match what you see to the entries below.

The command is not recognized

If PowerShell says a BitLocker cmdlet is not recognized, you are probably on an edition that does not include the feature. Another cause is a window that is not Windows PowerShell or Windows Terminal. Run Get-Command -Module BitLocker to see whether the BitLocker commands exist on your PC. An empty result or an error means they are not available.

Access is denied

This error means the window is not elevated. Close it, then open PowerShell again with Run as administrator. Check that the title bar starts with Administrator.

BitLocker cannot find a compatible TPM

Run Get-Tpm. If TpmPresent or TpmReady is False, turn the TPM on in your PC’s firmware settings. It may be called Intel PTT, AMD fTPM or Security Device Support. Menu names vary by manufacturer, so check your PC’s documentation.

The command is blocked by policy

On a work or school PC, administrators can force a specific encryption method or block changes. If your command fails with a policy message, or the setting reverts after a restart, your organization manages it. Ask your IT department. This guide does not give a policy path, because none is confirmed here.

What to Do Next

Store your recovery password in a second place, then run Get-BitLockerVolume once a month to confirm ProtectionStatus still reads On. A firmware or hardware change can trigger the recovery screen, so suspend protection first, as shown above. If you are also hardening your PC against malware, the next step is to manage ransomware protection settings in Windows 11.