A stolen or lost laptop is a routine event; a stolen laptop with an unencrypted drive is a data breach. BitLocker has shipped with Windows Pro and Enterprise since Vista, and there’s little reason not to have it enabled on any machine that leaves the building.
Prerequisites
- Windows 11 Pro, Enterprise, or Education (Home edition has a limited “Device Encryption” variant instead)
- A TPM 2.0 chip (required for Windows 11 anyway, and used to seal the encryption key)
Enabling BitLocker
# Enable BitLocker on the system drive, backing the key with the TPM Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 <code> -UsedSpaceOnly -TpmProtector # Add a recovery password as a backup unlock method Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector # Check status and encryption progress Get-BitLockerVolume -MountPoint "C:"
Don’t Skip the Recovery Key Backup
Save the recovery key somewhere other than the encrypted drive itself — a Microsoft account, Azure AD, or a printed copy in a safe. Losing both the TPM-sealed key (say, after a motherboard replacement) and the recovery key means the data is unrecoverable, by design.
# Back up the recovery key to Azure AD (for domain/Entra-joined machines) BackupToAAD-BitLockerKeyProtector -MountPoint "C:" </code> -KeyProtectorId (Get-BitLockerVolume -MountPoint "C:").KeyProtector[1].KeyProtectorId
Performance Impact
On any machine from the last decade, modern CPUs include AES-NI instructions that make BitLocker’s encryption overhead essentially unmeasurable in everyday use — there’s no longer a meaningful performance trade-off to weigh against the security benefit.