How to Enable BitLocker with PowerShell (Step by Step)

To enable BitLocker with PowerShell, open PowerShell as administrator, add a recovery password, back it up, then run Enable-BitLocker with a TPM protector:

Add-BitLockerKeyProtector -MountPoint 'C:' -RecoveryPasswordProtector
Enable-BitLocker -MountPoint 'C:' -TpmProtector -EncryptionMethod XtsAes256 -UsedSpaceOnly

Encryption then runs in the background. Below I cover the checks to do first, every protector type, data drives, backing up the recovery key and tracking progress.

I ran the read-only checks on my own Windows 11 PC. I didn’t change its encryption, so the commands that do are shown as code, checked against Microsoft’s documentation.

Check that your PC is ready

BitLocker management needs Windows 11 or 10 Pro, Enterprise or Education. Home editions only get device encryption. This check shows the edition, the BitLocker module and whether you’re elevated:

$id = [Security.Principal.WindowsIdentity]::GetCurrent()
$admin = ([Security.Principal.WindowsPrincipal]$id).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

"Windows edition:   $((Get-CimInstance -ClassName Win32_OperatingSystem).Caption)"
"BitLocker cmdlets: $((Get-Command -Module BitLocker).Count)"
"Run as admin:      $admin"

Output:

Windows edition:   Microsoft Windows 11 Enterprise
BitLocker cmdlets: 15
Run as admin:      False

The BitLocker module has 15 cmdlets and loads in both PowerShell 7 and Windows PowerShell 5.1. On Windows Server, install the feature first with Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools -Restart.

Why BitLocker commands need administrator rights

Run as admin is False above, so I tried reading the C: drive status and the TPM anyway. Both refuse:

try { Get-BitLockerVolume -MountPoint 'C:' -ErrorAction Stop }
catch { "Failed. $($_.Exception.Message)" }
Get-Tpm

Output:

Failed. Access to a CIM resource was not available to the client.
Administrator privilege is required to execute this command.

Windows PowerShell 5.1 says Access denied instead of the CIM message. Either way, right-click PowerShell and choose Run as administrator. Elevated, Get-Tpm shows TpmPresent and TpmReady, which should both be True for a TPM protector.

Check the current BitLocker status

In an elevated window, Get-BitLockerVolume lists every drive. Select the columns that matter:

Get-BitLockerVolume |
    Select-Object -Property MountPoint, VolumeType, VolumeStatus, ProtectionStatus, EncryptionPercentage

VolumeStatus is FullyDecrypted on a drive that isn’t encrypted yet. ProtectionStatus turns On once a protector is active. To list drives first, see listing drives in PowerShell.

Choose a key protector

A key protector is what unlocks the drive, such as the TPM chip, a PIN or a password. Enable-BitLocker has one switch per protector type:

(Get-Command -Name Enable-BitLocker).Parameters.Keys |
    Where-Object { $_ -like '*Protector' }

Output:

PasswordProtector
RecoveryPasswordProtector
StartupKeyProtector
AdAccountOrGroupProtector
TpmAndPinAndStartupKeyProtector
TpmAndPinProtector
TpmAndStartupKeyProtector
TpmProtector
RecoveryKeyProtector