Windows 10 Pro BitLocker drive encryption: a practical guide
BitLocker drive encryption is built into Windows 10 Pro. It encrypts data at rest on a drive so that a lost or stolen computer is much harder to read without your permission. The protection applies while the drive is locked; once you sign in and Windows unlocks it, normal work continues. BitLocker is useful for a notebook left on a train or a drive discarded during an upgrade, but it is not a backup, antivirus application, or replacement for a strong account password.
Check the edition and permissions before starting. You need Windows 10 Pro, administrator access, and a way to store an encryption recovery key. Most laptops that shipped with Windows 10 Pro through Australian retailers such as JB Hi-Fi, Harvey Norman, and Officeworks include a TPM 2.0 chip, although imported and refurbished models may have different firmware settings. A Microsoft account is convenient, while a local account can also use BitLocker.
Encryption is usually started from File Explorer: open This PC, right-click the system drive, and choose Turn on BitLocker. If that option is missing, use Control Panel, System and Security, and then BitLocker Drive Encryption. Some computers display Device encryption instead. The wording depends on the edition, firmware, and current protection state. Install outstanding Windows Update fixes and restart before troubleshooting, then allow the first encryption pass to finish without resetting the PC.
Plan a backup before enabling encryption. BitLocker protects access to a volume; it does not recover a file that has been deleted, repair a failing disk, or replace a backup. Keep important folders on an external drive or a reputable cloud service and test that a copy opens elsewhere. Australian users often move devices between a home, an office, and a university, so the recovery key and backup should be stored somewhere other than the encrypted computer.
What BitLocker protects and what it needs
BitLocker can protect the Windows partition, other fixed drives, and portable media with BitLocker To Go. On a typical notebook, the TPM releases the key automatically after sign-in, while a portable drive usually needs a password or startup key. BitLocker To Go is useful for an SSD carried between a Sydney office and a Melbourne home, but it must be unlocked on each Windows computer before its files can be used.
The Trusted Platform Module, or TPM, is a chip that stores secrets and helps Windows detect changes to the boot process. Its presence does not mean BitLocker is enabled. If encryption is unavailable, install current updates, restart, and check the manufacturer’s instructions for TPM or UEFI support. Avoid changing secure boot or BIOS settings on a work computer without checking the IT provider’s instructions.
BitLocker works at volume level, so it cannot repair a damaged file system. The recovery key allows Windows to unlock the volume after a major reinstall or hardware change. Check which drives contain documents before you start: on a desktop with two internal disks, encrypting only Windows may leave a second data disk readable. Make sure the important files are backed up and the key is recorded before encryption begins.
Turn on BitLocker step by step
Start with the drive containing Windows and your user profile. In File Explorer, right-click the system drive and select Turn on BitLocker. If the menu is missing, open Control Panel’s BitLocker Drive Encryption page. The page lists each volume, its protection state, and the available action. If the computer offers Device encryption, confirm the edition is Pro before expecting the full BitLocker controls.
Choose the unlock method and where to save the recovery key. Automatic unlocking through the TPM is common for a personal laptop; a PIN or account password adds protection for a shared household computer. Save the key to a Microsoft account, another drive, or a printed copy that you can reach if Windows fails. Do not keep its only copy on the encrypted system partition.
Select Encrypt the drive and let Windows work. Keep the computer connected to mains power, although you can continue light tasks. Moving large files or running demanding software can slow the process. Do not reset the machine, remove the drive, or interrupt the first pass. When the panel reports that BitLocker is enabled, reopen it and confirm the status is On. The related Windows 10 tips collection covers other useful operating-system checks.
Manage keys, drives and backups
BitLocker remains manageable after setup. Its control panel shows encryption progress and lets you suspend protection for a planned BIOS update, then resume it afterwards. Suspension is temporary and is not the same as turning encryption off. Before replacing, donating, selling, or returning a drive, decrypt it so the next owner does not inherit a locked volume. Decryption removes protection and takes time, so finish backups first.
The recovery key is a long number grouped for easier entry. Keep it in a password manager, a secure printout, or an encrypted file on a separate device, depending on your circumstances. If you use a Microsoft account, the key may appear under the device’s BitLocker information in account security settings. Do not rely on an email inbox on the same laptop as the only copy, because a sign-in problem could make that email unavailable.
BitLocker and backups solve different problems. Encryption discourages an unauthorised reader; a backup restores data after deletion, corruption, or ransomware. Copy active work to an external SSD or a privacy-appropriate service and periodically test a restore on another machine. If a drive is failing, stop writing to it and avoid repeated repair attempts. For portable media, use a separate password rather than relying on one computer’s automatic unlock.
Troubleshoot common BitLocker problems
Warnings such as This device can’t be encrypted usually point to firmware, hardware, or update status rather than a ruined disk. The TPM may be disabled, firmware may be old, or a required update may be unfinished. Open Windows Update, install pending updates, restart, and retry. Check that a desktop drive is online and visible as a local disk. For a managed work computer, ask the IT provider before changing boot settings.
An encryption prompt asking for a recovery password is not asking for your normal Windows password. Enter the BitLocker recovery key through the Windows recovery environment, usually opened with the Windows key and the appropriate Startup option. A lost key normally cannot be guessed or bypassed with ordinary recovery software. For a separate issue involving files removed from an already unlocked drive, the deleted file recovery guide can explain possible next steps without altering the encrypted volume.
Performance problems often mean Windows is still encrypting or decrypting a volume. Check the BitLocker panel before changing settings, and leave the machine on power until the operation reaches 100 per cent. If a display driver, update utility, or backup application seems involved, record the error and update the software. Never format an encrypted drive or delete its partition to silence a warning; that usually destroys the route to the data.
Use BitLocker comfortably in Australia
BitLocker suits Australian students, remote workers, and small businesses that move sensitive material between locations. A notebook used at a Melbourne home office, a shared device in a Brisbane team, and an archive in Perth can all be encrypted when the recovery information is handled consistently. For organisations, encryption is one layer, not a complete security programme: it can support controls aligned with the Australian Signals Directorate’s Essential Eight, but it does not automatically satisfy the Privacy Act 1988 or Notifiable Data Breaches obligations.
Travel adds another local consideration. A work laptop carried through Sydney or Melbourne airports still has to follow employer travel procedures, and travellers must still meet Australian Customs and border-security requirements. BitLocker is a separate security control rather than a replacement for those procedures. Keep the recovery key with the owner rather than sharing a portable drive containing client or customer information. If a technician needs access, use the organisation’s documented process instead of disabling encryption informally.
Warranty repairs and retail support can also affect an encrypted drive. Before sending a notebook to a service centre, check its BitLocker instructions, save the recovery key and drive serial number, and keep an independent backup. Send the key only through a secure channel if the centre genuinely requires it. The backup and recovery resources can provide a second reference when planning copies across an external drive, NAS, or cloud account.
Make a short readiness check now: confirm that the edition is Windows 10 Pro, identify the system and removable drives, install pending updates, and create a test backup. Enable BitLocker on the system drive, choose an appropriate unlock method, and save the recovery key outside the computer. Label where the key and backup are held, then repeat the process for portable storage that leaves your home or office. Protect the drive, preserve the key, and verify the backup today.