BitLocker Audit & Reports

Last Updated On: 23 Jul 2026|

6 minutes read |

Where to check per-device encryption status, and what the BitLocker and TPM reports actually show.

Overview

Managed Computers

One view summarizes every device's encryption state, policy, and prerequisite status.

What the Managed Computers view shows

The Managed Computers section under Insights lists, for each device: its name, domain, operating system, storage capacity, encryption status, applied policy, BitLocker and TPM availability, and BitLocker component and prerequisite statuses.

Managed Computers view listing devices with their BitLocker details.

The Managed Computers list.

Reading the Encryption Status icon

Encryption Status is a machine-level summary across all of a computer's drives. The color of the icon next to the status matters as much as the status text itself:

Status	Icon	What it means
Unknown	Green	BitLocker prerequisites are met, but the BitLocker module isn't enabled.
Unknown	Orange	BitLocker prerequisites are not met, and the drive isn't encrypted.
Fully Decrypted	Green	BitLocker prerequisites are met, but the drive hasn't been encrypted.
Fully Decrypted	Orange	BitLocker prerequisites are not met, and the drive isn't encrypted.
Fully Encrypted	Green	BitLocker prerequisites are met, and BitLocker has been enabled successfully.
Fully Encrypted	Orange	BitLocker prerequisites are not met, but BitLocker has been enabled.

Per-device view showing the Encryption Status icon.

Per-device encryption status.

Reports

BitLocker Reports

Every computer is scanned for its BitLocker and drive details, starting right after agent installation.

BitLocker status report showing volume, encryption, and protector details.

The BitLocker status report.

What's in the status report

All computers are scanned to assess their BitLocker encryption status and drive details. The initial scan runs right after agent installation, and later scans detect new computers and track changes in drive status and encryption progress.

Field	What it shows
Volume details	The computer's volume name and identification number.
Protection Status	Whether the drive is protected through BitLocker encryption.
Encryption status	'Fully Encrypted' means the drive is completely encrypted; 'Fully Decrypted' means it isn't.
Encryption method	The method BitLocker selected by default, such as AES-CBC 128-bit, AES-CBC 256-bit, or XTS-AES 128.
Lock Status	Whether the drive is locked or unlocked.
Drive Type	Whether the encrypted drive is an OS drive, a data drive, or both.
Protector	The current protection method — TPM alone, TPM and Passphrase, or Passphrase/Numerical password alone. The OS drive (C:) is protected by TPM; an external key protects data drives.
Auto lock	Whether the drive auto-locks; for extra safety this only applies once the OS volume is encrypted.
Auto Unlock	Whether Auto Unlock is enabled or disabled.
Percentage Converted	The encryption progress so far.
Volume Status	Categorizes volumes as Fully Encrypted, Fully Decrypted, or Partially Encrypted.
Drive Size	The size of the selected drive.
BitLocker Version	The version of the BitLocker feature in use.

Reports

TPM Reports

TPM handles the hardware side of encryption, and its own report tracks whether it's available, enabled, and owned.

The TPM report.

How TPM protects the drive

The Trusted Platform Module (TPM) is a hardware security chip on the motherboard that provides hardware-level drive encryption. It generates a set of cryptographic keys unique to the host system, storing part of the key in the TPM and the rest on the hard drive — the drive is only accessible when both halves match, so if the drive is moved to another computer, the data stays encrypted.

What's in the TPM report

Field	What it shows
TPM Availability of computers	Which system requirements each computer meets for a TPM chip, and how many computers do or don't have one installed.
Enabling TPM	Whether TPM is enabled or disabled at the hardware/BIOS level — required to use TPM's benefits.
Activating TPM	Whether TPM, once enabled, is also activated at the OS level.
Owned	Whether IT admins hold ownership privileges to manage TPM operations.
Manufacturer details	The name of the TPM chip's manufacturer.