How to Enable or Disable BitLocker with TPM in Windows

Table of Contents:

1. Enabling the TPM
2. Enabling BitLocker in the operating system
3. Checking BitLocker status (Manage BitLocker Console)
4. Checking BitLocker Status (Command Line)
5. Suspending BitLocker
6. Disabling BitLocker
7. BitLocker Encryption Videos

Enabling and Disabling BitLocker in Windows 7, Windows 8, Windows 10 and Windows 11

Windows BitLocker has become a solution for users to secure their data. The following is how to enable and disable BitLocker using the standard methods.

This article does not discuss the utilization of a USB as a TPM replacement and does not discuss Group Policy changes for advanced features. Domain level Group Policy changes and network-managed BitLocker setups are Best Effort and are out of the scope of support. Supported configurations are limited to single computers and locally managed BitLocker setups.

• All Operating Systems that are configured in Legacy Boot Mode must use TPM 1.2. It is recommended that the BIOS be updated to the latest revision.
• All Operating Systems that are configured in UEFI Boot Mode can use either TPM 1.2, or TPM 2.0. It is recommended that the BIOS be updated to the latest revision.
• If a Windows 7 computer is configured for UEFI Boot Mode, this patch must be applied in order to use TPM 2.0: Microsoft TPM 2.0 Patch
• Exceptions to this are the Latitude 5175 and Latitude 7275, both of which only have TPM 2.0 and cannot downgrade to 1.2.

NOTE: For full, up-to-date requirements, see Microsoft's BitLocker requirements

1. Enabling the TPM

1. Turn the computer on.
2. As the computer performs POST, press the hotkey (usually F2, or Delete) to enter the BIOS.
3. Once in the BIOS, locate the section that configures Security.
4. In the Security section, locate the TPM option.
5. Select the TPM 2.0 or 1.2 section on the left.

   
   Figure 1: (English Only) Select the TPM 2.0 or 1.2

6. Check the TPM box on the right to turn on the TPM.
7. After switching the TPM on, select the option to Activate or Enable the TPM

   
   Figure 2: (English Only) Select the option to Activate or Enable the TPM

8. After the TPM has been activated and enabled, click Save changes and Exit the BIOS.

Back to Top

2. Enabling BitLocker in the operating system

1. Turn the computer on.
2. Sign into the operating system as normal.
3. Get to the BitLocker management section in one of the following ways:

   Windows 7

   Windows 8

   Windows 10 and Windows 11

   1. Start Menu path.
      1. Click the Windows Start Menu button.
      2. In the search box, Manage BitLocker.
      3. Press Enter or click the Manage BitLocker icon in the list.
   2. Control Panel path
      1. Click the Windows Start Menu button.
      2. Click the Control Panel.
      3. Click System and Security.
      4. Click any option under BitLocker Drive Encryption.
   3. Hard drive path
      1. Open Computer or My Computer
         • Alternatively, click the File Explorer icon and select your computer.
      2. Select the Encryption:\ (or Windows computer) drive.
      3. Right-click the drive that you selected.
      4. Click Turn on BitLocker.
         Note: This skips the initial BitLocker screen.
   4. App Screen path
      1. Click the Windows Start Menu button.
      2. Open the search box, Manage BitLocker.
      3. Press Enter or click the Manage BitLocker icon in the list.
   5. Control Panel path
      1. Click the Windows Start Menu button.
      2. Open the search box, type Control Panel.
      3. Click System and Security or search BitLocker in the Control Panel window.
      4. Click any option under BitLocker Drive Encryption.
   6. Hard drive path
      1. Open Computer or My Computer
         • Alternatively, click the File Explorer icon and select your computer.
      2. Select the C:\ (or Windows computer) drive.
      3. Right-click the drive that you selected.
      4. Click Turn on BitLocker.
         Note: This skips the initial BitLocker screen.
   7. Start Menu path.
      1. Click the Windows Start Menu button.
      2. Windows 10: In the search box, type Manage BitLocker.
         Windows 11: In the search box, type Device Encryption.
      3. Press Enter or click the Manage BitLocker icon in the list.
   8. Control Panel path
      1. Right-Click on the Windows Start Menu button.
      2. Click the Control Panel.
      3. Click System and Security.
      4. Click any option under BitLocker Drive Encryption.
   9. Settings path
      1. Click the Windows Start Menu button.
      2. Click the Settings icon.
      3. In the search box, type Manage BitLocker.
      4. Press Enter or click the Manage BitLocker icon in the list.
   10. Hard drive path
       1. Open Computer or My Computer
       2. Select the C:\ (or Windows computer) drive.
       3. Right-click the drive that you selected.
       4. Click Turn on BitLocker.
          Note: This skips the initial BitLocker screen.
4. In the BitLocker Management screen, click Turn on BitLocker.

   
   Figure 3: (English Only) Click Turn on BitLocker

5. BitLocker goes through a short initialization process.

   
   Figure 4: (English Only) Starting BitLocker

6. Choose one of three options for saving the recovery key.

   
   Figure 5: (English Only) Save the recovery key

Figure 6: (English Only) Save key in a safe location

1. After saving the password file, click Next.
2. Select one of the volume encryption options.
   1. Encrypt entire hard drive.
      • This encrypts all space on the hard drive regardless of whether it is used. This takes longer to process the encryption.
   2. Encrypt on used space.
      • This only encrypts space on the hard drive as it is filled with data and leave free space unencrypted. This is preferred for basic encryption as it is faster.
         

        
        Figure 7: (English Only) Choose how much of your drive to encrypt

3. After selecting encryption option, click Next.
4. Choose the type of encryption to use if you get the encryption type selection.
    
   • New mode is the preferred method of encryption for new computers.
      

     
     Figure 8: (English Only) Choose the type of encryption to use

5. Click Next
6. Check that the box labeled "Run BitLocker system check."

   
   Figure 9: (English Only) Check Run BitLocker system check

7. Click Continue
8. Restart the computer after verifying the settings to begin the encryption.
    
   NOTE: Encryption can take anywhere from 20 minutes to a couple hours depending on the amount of data that has been encrypted, the speed of the computer, and whether the process is interrupted by the computer being turned off or going to sleep. The BitLocker encryption does not start until the computer is restarted. If work must be completed, it is safe to complete work and save it before restarting.

   
   Figure 10: (English Only) Restart computer to begin encryption

Back to Top

3. Checking BitLocker status (Manage BitLocker Console)

1. Open the Manage BitLocker console with one of the methods previously described.
2. View the status that is reported in the console.
    
   • If encrypting, the status shows that BitLocker is encrypting.
   • If encrypted, the status shows that BitLocker is on and show a lock icon.

     
     Figure 11: (English Only) Checking BitLocker status using BitLocker Console

Back to Top

4. Checking BitLocker Status (Command Line)

1. Open a command prompt window.
2. Click the Windows Start button, type cmd and press Enter.
3. Press and hold the Windows button on the keyboard and R, type cmd and press Enter.
4. Right-click Command Prompt and select "Run as Administrator."
5. In the command prompt, type manage-bde -status and press Enter.
6. View the status of BitLocker on the drives in the computer.

   
   Figure 12: (English Only) Checking BitLocker Status using Command Line

Back to Top

5. Suspending BitLocker

1. Start the computer.
2. Boot into the Windows operating system.
3. Open the Manage BitLocker windows with one of the above methods.
4. Click Suspend Protection for the wanted drive.

   
   Figure 13: (English Only) Suspending BitLocker

5. Review the warning prompt and click Yes to suspend BitLocker.

   
   Figure 14: (English Only) Review the warning and click Yes to suspend BitLocker

6. Return to the Manage BitLocker window to Resume Protection.

   
   Figure 15: (English Only) Click Resume protection to Resume BitLocker protection

Back to Top

6. Disabling BitLocker

1. Start the computer.
2. Boot into the Windows operating system
3. Open the Manage BitLocker windows with one of the above methods.
4. Click Turn off BitLocker.

   
   Figure 16: (English Only) Click turn off BitLocker to disable BitLocker

5. Confirm the decision to turn off BitLocker.

   
   Figure 17: (English Only) Confirm the decision to turn off BitLocker

6. Allow the computer to decrypt.

Back to Top

7. BitLocker Encryption Videos

Back to Top

Recommended Articles

Here are some recommended articles related to this topic that might be of interest to you.

• How to Retrieve a BitLocker Recovery Password or Key Package Using the Dell Data Security Recovery Portal
• Updating the BIOS on Dell Systems With BitLocker Enabled
• BitLocker fails to turn on or prompts for the Recovery Key rebooting with Windows 10, UEFI, and the TPM 1.2 Firmware
• How to Use BitLocker with PIN
• How to Locate the BitLocker Key Identifier for a BitLocker Protected Drive
• Resolving a TPM Error Seen During BitLocker Encryption on a Dell PC
• How to Troubleshoot and Resolve Common Issues with Trusted Platform Module (TPM) and BitLocker
• BitLocker is Prompting for a Recovery Key, and You Cannot Locate the Key
• BitLocker Asks for a Recovery Key Every Boot on USB-C/Thunderbolt Computers When Docked or Undocked
• Automatic Windows Device Encryption or BitLocker on Dell Computers
• Dell BIOS Updates

Out of warranty? No problem. Browse to the Dell.com/support website and enter your Dell Service Tag and view our offers.