# BitLocker Encryption Pre-requisites Last Updated On: 23 Jul 2026 6 minutes read The system requirements and configuration checks a computer must clear before a BitLocker policy can encrypt it. ## Supported operating systems BitLocker isn't available on every Windows edition — check the device is on one of these first. ### Windows editions that support BitLocker - Windows 11 Pro, Enterprise, and Education editions - Windows 10 Pro, Enterprise, and Education editions - Windows 8.1 Pro and Enterprise editions - Windows 8 Pro and Enterprise editions - Windows 7 Ultimate and Enterprise editions - Windows 7 Vista Ultimate and Enterprise editions - Windows Server 2008 and above ## Enabling BitLocker on server machines BitLocker is off by default on Server OS computers and needs to be turned on manually, either through Server Manager or the command line. ### Enable through Server Manager 1. On the Windows taskbar, open **Server Manager** and choose **Add Roles and Features** to launch the wizard. ![Server Manager Add Roles and Features wizard.](https://www.manageengine.com/products/desktop-central/images/bitlocker-pre-requisites-3.png) Opening the Add Roles and Features wizard. 2. In the **Features** pane, select **BitLocker Drive Encryption Administration Utilities**, along with **BitLocker Drive Encryption Tools** and **BitLocker Recovery Password Viewer**. ![BitLocker Drive Encryption Administration Utilities checkbox selected in the Features pane.](https://www.manageengine.com/products/desktop-central/images/bitlocker-pre-requisites-4.png) Selecting the BitLocker feature checkboxes. 3. Click **Next**, then click **Install** on the Confirmation pane to start the BitLocker feature installation. Follow the Confirmation pane for any additional features BitLocker requires. ![BitLocker feature installed confirmation.](https://www.manageengine.com/products/desktop-central/images/bitlocker-pre-requisites-5.png) BitLocker installation confirmed. 4. Restart the computer to complete installation. Confirm success by checking that Active Directory Users and Computers shows a **BitLocker Recovery** tab. ![BitLocker Recovery tab visible after restart, confirming successful installation.](https://www.manageengine.com/products/desktop-central/images/bitlocker-pre-requisites-6.png) Confirming installation after restart. ### Enable through Command Prompt 1. Open **Command Prompt** with administrator rights and run the command below. ```bash dism /online /Enable-Feature /all /FeatureName:BitLocker /quiet /norestart ``` 2. Restart the computer to complete installation. Confirm success by checking that Active Directory Users and Computers shows a **BitLocker Recovery** tab for the computer object. ### Fixing WMI registration **Windows Management Instrumentation (WMI)** is Microsoft's remote protocol for management tasks and information retrieval, and BitLocker depends on it being registered correctly. 1. Open **Command Prompt** with administrator rights and run the command below. ```bash mofcomp.exe C:\Windows\System32\wbem\win32_encryptablevolume.mof ``` 2. A successful run shows a confirmation that BitLocker WMI registration succeeded. ![Notification confirming successful BitLocker WMI registration.](https://www.manageengine.com/products/desktop-central/images/bitlocker-pre-requisites-1.png) Successful WMI registration. ## TPM ownership TPM-based encryption needs full, not partial, ownership of the chip. ### Why full TPM ownership matters The **Trusted Platform Module (TPM)** is a microchip that encrypts drives using cryptographic keys to mitigate dictionary attacks. With only partial ownership of the TPM, BitLocker can't use its cryptographic keys — full ownership is required. To gain full ownership, [clear the TPM](https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm#clear-all-the-keys-from-the-tpm), which triggers the OS to automatically reinitialize and acquire full ownership. **Warning** Clearing the TPM can cause loss of stored cryptographic keys. Review the [precautions to take before clearing the TPM](https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm#precautions-to-take-before-clearing-the-tpm) first, to safeguard your data. ## BIOS mode compatibility TPM-aided encryption needs the right firmware mode. ### UEFI is required for TPM-based encryption TPM-aided BitLocker encryption is only supported in **UEFI (Unified Extensible Firmware Interface)** mode. If a device is running in Legacy or Compatibility Support Mode (CSM), [switch it to UEFI mode](https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/faq#which-trusted-platform-modules--tpms--does-bitlocker-support) to enable TPM-based encryption. ## GPO configuration Existing Group Policy settings can quietly fight the policy Endpoint Central deploys. ### Clear conflicting BitLocker GPO settings **Group Policy (GPO)** settings can control Microsoft BitLocker's preliminary actions, and existing GPO settings on a computer can counteract Endpoint Central MSP's BitLocker policy. **Tip** Remove all GPO configurations related to BitLocker and encryption on target devices for seamless operation. See the full [BitLocker Group Policy settings reference](https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/configure?tabs=common#%24bitlocker-policy-settings) for details. ## Related - [BitLocker Policy Creation](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/bitlocker-policy-creation.html) - [BitLocker FAQ](https://www.manageengine.com/desktop-management-msp/help/bitlocker-management/bitlocker-faq.html#reqfaq)