Comprehensive Guide to BitLocker Management

Last Updated On: 22 Jul 2026|

6 minutes read |

Best practices for rolling out BitLocker encryption across your endpoints and keeping it recoverable.

Planning

Preparing before you deploy

Check readiness first, then encrypt every device — not just the ones with a TPM.

Clear every encryption prerequisite first

Encryption prerequisites are the conditions a computer has to meet before it's ready for BitLocker.

Prerequisites

Confirm every device meets all encryption prerequisites before you plan the rollout of an encryption policy.

Encrypt every endpoint, TPM or not

An unencrypted device puts its data at risk — if it's lost, stolen, or compromised, whatever's on it can be read or misused. Encrypt the whole network, including machines without a TPM chip. See the encryption settings in Endpoint Central MSP for how to configure this.

With a TPM — enable Enhanced PIN on top of TPM.
Without a TPM — a passphrase is the only option.

Enhanced PIN with TPM is the best choice on TPM-equipped machines, though it means users have to type the PIN in at every boot. TPM alone is an easier alternative, but it's not recommended since it gives up some security resilience.

Tip

Favor Enhanced PIN with TPM over TPM alone whenever you can accept the small extra step at boot — the security trade-off is worth it.

Encryption

Choosing what and how to encrypt

Default to the safest, broadest settings unless performance forces a trade-off.

Default to full disk encryption

Full disk encryption covers the entire drive, including unused space where traces of deleted data can still be recovered — making it the safest option, at some cost to performance. If that performance cost is a problem, Used Disk Space Only encryption is the alternative.

See configuring encryption policies for setup details.

Tip

Encrypt every drive on a device, not just the operating system drive — other volumes can hold valuable data too.

Stick with the default encryption method

Use the default encryption method Microsoft recommends for the Windows version in question. A manual policy can configure a stronger method for compliance or audit needs, but stronger methods cost more performance, so they aren't recommended as a default. More on the available encryption algorithms.

Recovery

Protecting the recovery key

The recovery key is the only way back in — treat it accordingly.

Always back up the recovery key

Windows asks for the BitLocker recovery key whenever it detects unauthorized access. Microsoft can't recover a lost key, so a secure backup is essential.

Warning

There's no recovery path if this key is lost — enable Update recovery key to domain controller to store it in Active Directory rather than relying on a local copy alone.

Rotate the recovery key periodically

Changing the recovery key on a regular schedule adds another layer of security. Endpoint Central MSP can automate this: turn on periodic rotation of the recovery key when you set up a BitLocker policy.

Policy

Applying policy the right way

BitLocker is tied to the machine, not the person using it.

Assign policies to computers, not users

BitLocker is a hardware-level feature that's specific to the computer, so encryption policies should be associated with computers rather than users.

Note

Deploy only one policy — either encryption or decryption — to a given computer at a time.