# Understanding BitLocker Management Last Updated On: 23 Jul 2026 12 minutes read How the BitLocker agent, policy deployment, recovery key storage, and report fields actually work under the hood. ## Specifications of agent processes Resource usage for each BitLocker-related agent process. ### Agent process footprint | Agent process | Running application | Bandwidth (approx.) | CPU (approx.) | Memory (approx.) | |---|---|---|---|---| | BitLocker Policy Deployment | dcconfig.exe | 3 KB | 0—1% | 5 MB | | BitLocker Policy Process | BitlockerMgmt.exe | NA | 0—1% | 10 MB | | Component Upgrade | dcconfig.exe | 1.65 MB | 0—1% | 1 MB | ## Initial status and device data collection The agent scans drives right after installation, with a few coverage limits worth knowing. ### What gets scanned The BitLocker component installs immediately after agent installation, containing the binaries for the module's functions. The Endpoint Central agent then scans internal drives and displays their encryption status in **[Managed Computers](https://www.manageengine.com/products/desktop-central/help/reports/bitlocker-audit-reports.html#managed-computers)** under the BitLocker Management module's Insights section. ### Coverage limitations - **External drives** — encryption of external drives isn't currently supported by Endpoint Central. - **Drives locked by other tools** — drives locked by Windows Native BitLocker or third-party encryption tools are reported as decrypted and can't be managed by Endpoint Central until unlocked with the recovery key. **Note** To manage a device's encryption through Endpoint Central, you have to create and deploy an Endpoint Central BitLocker policy on it. ## How policy deployment actually rolls out The two deployment options move at different speeds, especially at scale. ### Deploy Immediately vs. Deploy ![Diagram comparing Deploy Immediately and Deploy options.](https://www.manageengine.com/products/desktop-central/help/images/ac-policy-deploy-hw.png) *How the two deployment options roll out.* - **Deploy Immediately** — pushes the policy right away to agent machines currently online. For groups over 200 machines, it applies to the first 200 immediately, with the rest following in the next refresh cycle. - **Deploy** — schedules the policy for the next 90-minute refresh cycle. Devices then encrypt or decrypt according to the policy that was implemented. Deployment status is visible by drilling into the applied policy. ## How the agent enforces policy Timing, non-TPM handling, edits, deletions, and conflicts each behave a bit differently. ### When encryption actually starts The agent starts BitLocker processes during its refresh cycle; how long it takes depends on the individual machine's performance. Drive encryption only begins once the recovery key is stored successfully on the server. If encryption fails, check whether all [encryption prerequisites](https://www.manageengine.com/products/desktop-central/help/bitlocker-management/bitlocker-pre-requisites.html) are met. ### Effect on non-TPM machines Non-TPM machines can only encrypt by way of a passphrase — end users see a password prompt, and encryption starts only once that password is provided. A single policy is enough to configure encryption for both TPM and non-TPM machines together. **Tip** To list devices without a TPM, go to **BitLocker Management → Insights → Managed Computers** and filter **TPM Availability** to Unavailable. ### Effect of modifying a policy Editing encryption settings creates a difference between the edited and old policy, which causes every machine under that policy to decrypt and then re-encrypt with the new settings. If the change only touches advanced settings — like recovery key rotation or domain controller backup — those settings apply on their own, with no decrypt/re-encrypt cycle. ### Effect of deleting a policy If a policy is deleted, dissociated, or the machine is removed from the Scope of Management (SoM), existing encryption on the drives stays intact. A decryption policy has to be deployed to actually decrypt the drives. ### Policy conflict precedence When multiple BitLocker policies are deployed to the same endpoint, the most recently deployed one takes effect. Check which policy is currently active by drilling into the system's view under **Managed Systems**. ## How recovery keys are stored The key is stored before encryption ever starts, and retained for a while even after a device leaves management. ### Storage and retention The recovery key is created and updated on the server before encryption starts — encryption begins only after the server confirms the key was updated safely. Endpoint Central also supports updating the key to both Active Directory and Azure AD. **Note** With **Recovery Key Retention** enabled under Retrieve Recovery Key, the key stays on the server for up to one year after a computer is removed from SoM or becomes unmanaged under a limited license. With it disabled, removed computers' keys are discarded after 30 days. Because of how sensitive the key is, any technician who accesses a recovery key has that action captured in the **Action Log Viewer**. With **Periodic Rotation of the Recovery Keys** enabled in a policy, the key updates on the agent after the set period and uploads to the server on the next refresh cycle, repeating at that interval. A key also changes on the agent at the machine's next reboot if it's ever been accessed. ### Resetting the BitLocker password The encryption key — PIN, password, or passphrase — can be reset by logging in with the recovery key. If an end user forgets their encryption key, giving them the recovery key is the way through: logging in with it prompts them to reconfigure their password or PIN. ## Keywords in BitLocker reports What each report field actually means, including a few states that look alarming but aren't. ### Report field reference ![Annotated BitLocker report showing each keyword field.](https://www.manageengine.com/products/desktop-central/help/images/bitlocker-keywords.png) *BitLocker report field reference.* | Field | What it means | |---|---| | Drive Type | Whether the drive is an OS drive or a data drive. | | Encryption Status | The drive's encryption status and percentage complete. | | Auto Unlock | Data drives unlock automatically once the OS drive unlocks at login — this is default BitLocker behavior, and only data drives support it. | | Encryption Method | The algorithm used for encryption. | | Encryption Level | 'Full Space Encrypted' means the whole drive is encrypted; 'Used Space Encrypted' means only used portions are — new content is encrypted automatically as it's added. | | Lock Status | Whether the drive is locked or unlocked. It normally stays unlocked unless manually locked; since a powered-off machine can't report status, the console mostly shows 'unlocked'. A drive already locked before an Endpoint Central policy applies can't be encrypted. | | Drive Size | The size of the drive. | | Recovery Key Identifier | The identifier for the recovery key tied to that drive. | **Warning** **Protection Status** shows whether BitLocker is currently active: 'Enabled' means active; 'Disabled' means it isn't, and the drive may be decrypted, suspended, or paused. Endpoint Central's BitLocker module never suspends encryption itself — a fully encrypted drive showing 'Disabled' is suspended for another reason, such as Windows Device Encryption waiting on a key backup, a manual suspension, or third-party software. Deploying the Endpoint Central encryption policy re-enables protection. ### Protector types A **protector** is the key that allows access to encrypted data on a Windows device. Every drive also has a numerical password protector that serves as the recovery key, and data drives additionally carry an 'external key' for auto unlock. | Configured protector | Shown as | |---|---| | TPM Only | Trusted Platform Module | | TPM and PIN | TPM+PIN | | TPM and Enhanced PIN | TPM+PIN | | Passphrase | Passphrase | **Note** TPM+Enhanced PIN shows as TPM+PIN in reports too — BitLocker itself only has a TPM+PIN protector, and TPM+Enhanced PIN is an extension of it rather than a separate protector type. ## Related - [BitLocker Encryption Prerequisites](https://www.manageengine.com/products/desktop-central/help/bitlocker-management/bitlocker-pre-requisites.html) - [BitLocker Policy Creation](https://www.manageengine.com/products/desktop-central/help/bitlocker-management/bitlocker-policy-creation.html) - [Recovery Key Management](https://www.manageengine.com/products/desktop-central/help/bitlocker-management/recovery-key.html)