BitLocker basics: check encryption status and protect recovery keys

What full-disk encryption protects

BitLocker encrypts whole volumes so a lost or stolen laptop does not hand its data to whoever finds it. It protects data at rest when the device is off or locked at boot. It does not protect against malware running on a logged-in, unlocked system.

With only a TPM protector, the disk unlocks automatically at boot if the boot chain is unchanged. Adding a startup PIN protects against attacks that need the system to boot to Windows, at the cost of a prompt.

Check status

manage-bde -status shows each volume’s conversion status, encryption method, and protection status. Get-BitLockerVolume returns the same as objects, including KeyProtector types. Protection Status Off with Fully Encrypted means encryption is suspended, often after a firmware update, and the key is stored in the clear on disk until resumed.

XTS-AES 128 or 256 is the method on modern Windows.

Snippet

manage-bde -status C:
Get-BitLockerVolume | Select MountPoint, VolumeStatus, ProtectionStatus, EncryptionMethod, @{n="Protectors";e={$_.KeyProtector.KeyProtectorType -join ","}}

Lab: encrypt and back up the key

On a lab VM with a virtual TPM, enable BitLocker on the OS drive with a TPM protector and a recovery password protector. In a lab domain, back the recovery password up to AD with Backup-BitLockerKeyProtector; for Entra-joined devices, BackupToAAD-BitLockerKeyProtector. Confirm the key is visible in the directory.

Test recovery: suspend and resume protection, and practice entering the recovery key once so helpdesk knows the process.

Snippet

Enable-BitLocker -MountPoint C: -EncryptionMethod XtsAes256 -TpmProtector
Add-BitLockerKeyProtector -MountPoint C: -RecoveryPasswordProtector
$kp = (Get-BitLockerVolume C:).KeyProtector | Where KeyProtectorType -eq RecoveryPassword
Backup-BitLockerKeyProtector -MountPoint C: -KeyProtectorId $kp.KeyProtectorId
manage-bde -status C:

Manage recovery keys

Recovery keys are as sensitive as the data. Store them only in the directory, restrict who can read them, and audit access. Do not keep exported key files on the same laptop or in a shared spreadsheet.

Report devices whose protection is off or whose recovery key is missing in the directory. Those are the devices that fail when someone actually needs recovery.

Diagram

TPM-only versus TPM plus PIN

Convenience against pre-boot protection.

TPM only

Boot. Unlocks automatically if the boot chain is trusted.

Protects. Removed disk, offline attacks.

Weaker against. Attacks on a booting device.

TPM + PIN

Boot. User enters a PIN before Windows starts.

Protects. Also attacks that need the device to boot.

Cost. A prompt at every boot.

Check yourself

1. What does BitLocker primarily protect against?

2. A volume shows Fully Encrypted but Protection Off. What does it mean?

3. Where should recovery keys be stored?