# Creation of BitLocker Policy

Build and configure a BitLocker encryption policy, from authentication type to recovery key rotation.

**Last Updated On**: 22 Jul 2026  
**9 minutes read**

## Overview

### What a BitLocker policy controls

One policy module covers encryption scope, authentication, algorithms, and recovery keys.

### The BitLocker Management module

BitLocker Management module lets you build tailored encryption policies for the devices on your network. A policy can apply full drive, OS drive, or used-space encryption depending on what a given device needs.

It supports both devices with a TPM and devices without one, gives granular control over the encryption algorithm, and offers separate options for Windows 10 and later versus Windows 8.1 and earlier.

## Setup

### Creating the policy

Name the policy and choose whether it encrypts or decrypts.

#### Perform encryption or decryption

1. Go to the **BitLocker** module in the Endpoint Central MSP console → **Policy Creation** → **Create Policy**.
2. Enter a **name** for the policy, and an optional description.
3. Toggle **Drive Encryption**: on applies encryption when the policy deploys, off applies decryption.

![BitLocker policy creation screen showing the name, description, and Drive Encryption toggle.](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/bitlocker-management/create-bitlocker-policy.gif)

*Creating a new BitLocker policy.*

## Authentication

### Choosing how devices authenticate

TPM-equipped and non-TPM devices use different authentication paths.

#### Authentication for machines with TPM

![Authentication type options for machines with a TPM.](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/bitlocker-management/create-bitlocker-policy-1.gif)

*TPM authentication options.*

- **TPM only** — the drive unlocks via TPM authentication with no user input required.
- **TPM and PIN** — TPM authentication is followed by a PIN (digits only, 6—20 characters) entered at boot.
- **TPM and Enhanced PIN** — TPM authentication is followed by an Enhanced PIN (6—20 alphanumeric and special characters) entered at boot.

#### Authentication for machines without TPM

![Authentication type option for machines without a TPM.](https://www.manageengine.com/products/desktop-central/images/Bitlocker-howto3.png)

*Non-TPM authentication option.*

Devices without a TPM authenticate with a **passphrase** only, entered by the user at boot.

## Scope

### Choosing what gets encrypted

Combine one of three encryption scopes with the authentication settings above.

#### Complete encryption of drives

To encrypt every drive and all space on them, enable **Drive Encryption** only, and leave **Encrypt OS drive only** and **Encrypt used space only** disabled.

![Drive Encryption setting enabled with OS-only and used-space-only options disabled.](https://www.manageengine.com/products/desktop-central/images/bitlocker-howto4.png)

*Complete drive encryption setting.*

#### Encryption of the OS drive only

Enable **Encrypt OS drive only** to encrypt just the operating system drive, leaving all other data drives decrypted.

![Encrypt OS drive only setting enabled.](https://www.manageengine.com/products/desktop-central/images/bitlocker-how-to5.png)

*OS drive encryption setting.*

#### Encryption of used space only

Enable **Encrypt used space only** to encrypt just the used space on a drive, leaving free space decrypted.

![Encrypt used space only setting enabled.](https://www.manageengine.com/products/desktop-central/images/bitlocker-howto6.png)

*Used-space encryption setting.*

## Algorithms

### Choosing an encryption algorithm

The available algorithms depend on the Windows version, and Microsoft's default is the safe choice for most devices.

#### Algorithms for Windows 10 and above

Windows 10 and later devices can use **AES_128**, **AES_256**, **XTS_AES_128**, or **XTS_AES_256**.

![Encryption algorithm options for Windows 10 and above.](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/bitlocker-management/create-bitlocker-policy-2.gif)

*Algorithm options for Windows 10+.*

**Tip:** Use Microsoft's default encryption method for the best performance. Stronger algorithms are available for compliance needs, but they can slow the computer down.

#### Algorithms for Windows 8.1 and below

Windows 8.1 and earlier devices can use **AES_128** or **AES_256**. As with Windows 10 and later, Microsoft's default gives the best performance, and stronger options exist for compliance but can slow the device.

![Encryption algorithm options for Windows 8.1 and below.](https://cdn.manageengine.com/sites/meweb/images/desktop-central/help/bitlocker-management/create-bitlocker-policy-3.gif)

*Algorithm options for Windows 8.1 and below.*

**Note:** The default algorithm is based on any previously configured Group Policy Object (GPO), or otherwise on the encryption method associated with the system's OS.

## Passwords

### Password prompt settings

Control whether users can defer setting a BitLocker password.

#### Allow users to skip the password request

This setting lets an admin define a window of time during which a user can click **Cancel** to skip the password prompt.

![Setting for allowing users to skip the password request for a set timeframe.](https://www.manageengine.com/products/desktop-central/images/bitlocker-pass-1.png)

*Skip-password timeframe setting.*

Once that window passes, the **Cancel** button is disabled and the user must create a BitLocker password, keeping every system encrypted and compliant.

![Password prompt after the skip window has expired, with Cancel disabled.](https://www.manageengine.com/products/desktop-central/help/images/bitlocker-pass-2.png)

*Password prompt once the skip window has closed.*

#### Enforce immediately

This setting requires the user to set a password right away — the **Create Password** window can't be canceled or closed until they do.

**Note:** If TPM devices are set to **TPM only** and non-TPM devices are set to **Protection off**, the password setting won't appear, since no authentication is configured in that case.

## Recovery

### Advanced settings for recovery keys

Control where recovery keys are stored and how often they rotate.

#### Recovery key storage and rotation

![Advanced settings panel for recovery key update and rotation options.](https://www.manageengine.com/products/desktop-central/images/bitlocker-howto10.png)

*Advanced recovery key settings.*

- **Update recovery key to domain controller** — keeps a consolidated list of recovery keys in Active Directory; if disabled, keys live only on the product server.
- **Allow periodic rotation of the recovery key** — replaces old recovery keys with new ones automatically after a set number of days.

**Tip:** Setting a rotation period is recommended as an added safety precaution.

To reset recovery keys that have already been used, modify the deployed policy, enable rotation, and set the rotation period — for example, seven days generates new recovery keys every seven days starting from when the modification takes effect.

#### Saving the policy

Once the settings are configured, save the policy as a draft or publish it directly. Published and drafted policies both appear in the policy list under the **Policy Creation** tab.

The created policy can be deployed through [Policy Deployment](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/bitlocker-policy-deployment.html) for the endpoints to be encrypted.

## Related

- [BitLocker Encryption Prerequisites](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/bitlocker-pre-requisites.html)
- [BitLocker FAQ](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/bitlocker-faq.html#createfaq)