Comprehensive Guide to BitLocker Management

Last Updated On: 03 Nov 2026|

6 minutes read |

Best practices for rolling out BitLocker encryption across your endpoints and keeping it recoverable.

Planning

Prerequisites

Check readiness first, then encrypt every device — not just the ones with a TPM.

Clear every encryption prerequisite first

Encryption prerequisites are the conditions a computer must meet before you deploy BitLocker encryption. Confirm every device meets all encryption prerequisites before you plan the rollout of an encryption policy.

Encrypt every endpoint, TPM or not

An unencrypted device puts its data at risk — if it's lost, stolen, or compromised, its data can be read or misused. Encrypt the whole network, including machines without a TPM chip. See the encryption settings in Endpoint Central MSP for how to configure this.

With a TPM — enable Enhanced PIN on top of TPM.
Without a TPM — a passphrase is the only option.

Enhanced PIN with TPM is the best choice on TPM-equipped machines, but users must enter the PIN at every boot. TPM alone is an easier alternative, but it's not recommended since it gives up some security resilience.

Tip

Favor Enhanced PIN with TPM over TPM alone whenever you can accept the small extra step at boot — the security trade-off is worth it.

Encryption

Choosing what and how to encrypt

Default to the safest, broadest settings unless performance forces a trade-off.

Default to full disk encryption

Full disk encryption covers the entire drive, including unused space where traces of deleted data can still be recovered — making it the safest option, with a possible performance cost. If that performance cost is a problem, Used Disk Space Only encryption is the alternative.

See configuring encryption policies for setup details.

Tip

Encrypt every drive on a device, not just the operating system drive — other volumes can hold valuable data too.

Stick with the default encryption method

Use the default encryption method Microsoft recommends for the applicable Windows version. An administrator can configure a stronger method for compliance or audit needs, but stronger methods cost more performance, so they aren't recommended as a default. More on the available encryption algorithms.

Recovery

Protecting the recovery key

A usable recovery key is required when the normal unlock method is unavailable.

Always back up the recovery key

Windows asks for the BitLocker recovery key whenever it detects unauthorized access. Microsoft can't recover a lost key, so a secure backup is essential.

Warning

There's no recovery path if this key is lost — enable Update recovery key to domain controller to store it in Active Directory rather than relying on a local copy alone.

Rotate the recovery key periodically

Changing the recovery key on a regular schedule adds another layer of security. Endpoint Central MSP can automate this: turn on periodic rotation of the recovery key when you set up a BitLocker policy.

Policy

Apply BitLocker policies

BitLocker is tied to the machine, not the person using it.

Assign policies to computers, not users

BitLocker is a hardware-level feature that's specific to the computer, so encryption policies should be associated with computers rather than users.

Deploy only one policy — either encryption or decryption — to a given computer at a time.

During a migration, review policies from every encryption-management tool that still targets the computer. Verify recovery-password backup and compare encryption settings before changing policy ownership. Agree the transition sequence with the other tool’s administrator and test it on a pilot computer. See Migration considerations.