# BitLocker Audit & Reports **Last Updated On**: 24 Jul 2026 **6 minutes read** Where to check per-device encryption status, and what the BitLocker and TPM reports actually show. ## Managed Computers One view summarizes every device's encryption state, policy, and prerequisite status. ### What the Managed Computers view shows The **Managed Computers** section under Insights lists, for each device: its name, domain, operating system, storage capacity, encryption status, applied policy, BitLocker and TPM availability, and BitLocker component and prerequisite statuses. ![Managed Computers view listing devices with their BitLocker details.](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/reports/bitlocker-managed-computers.webp) *The Managed Computers list.* ### Reading the Encryption Status icon **Encryption Status** is a machine-level summary across all of a computer's drives. The color of the icon next to the status matters as much as the status text itself: | Status | Icon | What it means | |---|---|---| | Unknown | Green | BitLocker prerequisites are met, but the BitLocker module isn't enabled. | | Unknown | Orange | BitLocker prerequisites are not met, and the drive isn't encrypted. | | Fully Decrypted | Green | BitLocker prerequisites are met, but the drive hasn't been encrypted. | | Fully Decrypted | Orange | BitLocker prerequisites are not met, and the drive isn't encrypted. | | Fully Encrypted | Green | BitLocker prerequisites are met, and BitLocker has been enabled successfully. | | Fully Encrypted | Orange | BitLocker prerequisites are not met, but BitLocker has been enabled. | ![Per-device view showing the Encryption Status icon.](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/reports/bitlocker-device-view.webp) *Per-device encryption status.* ## BitLocker Reports Every computer is scanned for its BitLocker and drive details, starting right after agent installation. ![BitLocker status report showing volume, encryption, and protector details.](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/reports/bitlocker-reports.webp) *The BitLocker status report.* ### What's in the status report All computers are scanned to assess their BitLocker encryption status and drive details. The initial scan runs right after agent installation, and later scans detect new computers and track changes in drive status and encryption progress. | Field | What it shows | |---|---| | Volume details | The computer's volume name and identification number. | | Protection Status | Whether the drive is protected through BitLocker encryption. | | Encryption status | 'Fully Encrypted' means the drive is completely encrypted; 'Fully Decrypted' means it isn't. | | Encryption method | The method BitLocker selected by default, such as AES-CBC 128-bit, AES-CBC 256-bit, or XTS-AES 128. | | Lock Status | Whether the drive is locked or unlocked. | | Drive Type | Whether the encrypted drive is an OS drive, a data drive, or both. | | Protector | The current protection method — TPM alone, TPM and Passphrase, or Passphrase/Numerical password alone. The OS drive (C:) is protected by TPM; an external key protects data drives. | | Auto lock | Whether the drive auto-locks; for extra safety this only applies once the OS volume is encrypted. | | Auto Unlock | Whether Auto Unlock is enabled or disabled. | | Percentage Converted | The encryption progress so far. | | Volume Status | Categorizes volumes as Fully Encrypted, Fully Decrypted, or Partially Encrypted. | | Drive Size | The size of the selected drive. | | BitLocker Version | The version of the BitLocker feature in use. | ## TPM Reports TPM handles the hardware side of encryption, and its own report tracks whether it's available, enabled, and owned. ![TPM report showing availability, enablement, and ownership per computer.](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/reports/bitlocker-tpm-reports.webp) *The TPM report.* ### How TPM protects the drive The **Trusted Platform Module (TPM)** is a hardware security chip on the motherboard that provides hardware-level drive encryption. It generates a set of cryptographic keys unique to the host system, storing part of the key in the TPM and the rest on the hard drive — the drive is only accessible when both halves match, so if the drive is moved to another computer, the data stays encrypted. ### What's in the TPM report | Field | What it shows | |---|---| | TPM Availability of computers | Which system requirements each computer meets for a TPM chip, and how many computers do or don't have one installed. | | Enabling TPM | Whether TPM is enabled or disabled at the hardware/BIOS level — required to use TPM's benefits. | | Activating TPM | Whether TPM, once enabled, is also activated at the OS level. | | Owned | Whether IT admins hold ownership privileges to manage TPM operations. | | Manufacturer details | The name of the TPM chip's manufacturer. | ## Related - [BitLocker Encryption Prerequisites](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/bitlocker-pre-requisites.html) - [BitLocker FAQ](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/bitlocker-faq.html)