# Comprehensive Guide to BitLocker Management Last Updated On: 22 Jul 2026 6 minutes read Best practices for rolling out BitLocker encryption across your endpoints and keeping it recoverable. ## Preparing before you deploy Check readiness first, then encrypt every device — not just the ones with a TPM. ### Clear every encryption prerequisite first [Encryption prerequisites](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/bitlocker-pre-requisites.html) are the conditions a computer has to meet before it's ready for BitLocker. **Prerequisites** Confirm every device meets all encryption prerequisites before you plan the rollout of an encryption policy. ### Encrypt every endpoint, TPM or not An unencrypted device puts its data at risk — if it's lost, stolen, or compromised, whatever's on it can be read or misused. Encrypt the whole network, including machines without a TPM chip. See the [encryption settings in Endpoint Central MSP](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/bitlocker-policy-creation.html#settings) for how to configure this. - **With a TPM** — enable Enhanced PIN on top of TPM. - **Without a TPM** — a passphrase is the only option. **Enhanced PIN with TPM** is the best choice on TPM-equipped machines, though it means users have to type the PIN in at every boot. **TPM alone** is an easier alternative, but it's not recommended since it gives up some security resilience. **Tip** Favor Enhanced PIN with TPM over TPM alone whenever you can accept the small extra step at boot — the security trade-off is worth it. ## Choosing what and how to encrypt Default to the safest, broadest settings unless performance forces a trade-off. ### Default to full disk encryption **Full disk encryption** covers the entire drive, including unused space where traces of deleted data can still be recovered — making it the safest option, at some cost to performance. If that performance cost is a problem, **Used Disk Space Only** encryption is the alternative. See [configuring encryption policies](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/bitlocker-policy-creation.html) for setup details. **Tip** Encrypt every drive on a device, not just the operating system drive — other volumes can hold valuable data too. ### Stick with the default encryption method Use the default encryption method Microsoft recommends for the Windows version in question. A manual policy can configure a stronger method for compliance or audit needs, but stronger methods cost more performance, so they aren't recommended as a default. More on the available [encryption algorithms](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/bitlocker-policy-creation.html#algorithm). ## Protecting the recovery key The recovery key is the only way back in — treat it accordingly. ### Always back up the recovery key Windows asks for the [BitLocker recovery key](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/recovery-key.html) whenever it detects unauthorized access. Microsoft can't recover a lost key, so a secure backup is essential. **Warning** There's no recovery path if this key is lost — enable **Update recovery key to domain controller** to store it in Active Directory rather than relying on a local copy alone. ### Rotate the recovery key periodically Changing the recovery key on a regular schedule adds another layer of security. Endpoint Central MSP can automate this: turn on [periodic rotation of the recovery key](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/bitlocker-policy-creation.html#rotation) when you set up a BitLocker policy. ## Applying policy the right way BitLocker is tied to the machine, not the person using it. ### Assign policies to computers, not users BitLocker is a hardware-level feature that's specific to the computer, so encryption policies should be associated with computers rather than users. **Note** Deploy only one policy — either encryption or decryption — to a given computer at a time. ## Related - [BitLocker Encryption Prerequisites](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/bitlocker-pre-requisites.html) - [BitLocker Policy Configuration](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/bitlocker-policy-creation.html) - [Recovery Key Management](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/recovery-key.html)