Check device encryption on a new Windows laptop in the first hour

What device encryption does

Device encryption is a Windows feature that turns on BitLocker encryption for the system drive and other fixed drives. It is designed for everyday users who want their data protected without managing complicated settings. Without the key, the data on the drive cannot be read.

Full BitLocker Drive Encryption is available on Windows Pro, Enterprise and Education. Device encryption is available on a wider range of devices, including many running Windows Home.

Check whether it is on

Open Settings and go to Privacy and security, then Device encryption. If the option is missing, the device may not support it, or you may be signed in with a standard account rather than an administrator account.

Support depends on the hardware and settings, including a usable Trusted Platform Module and Secure Boot. Some docking stations or external graphics devices connected at start-up can interfere.

• Signed in with an administrator account.
• Device encryption shown as on.
• Recovery key saved and its location known.
• Recovery key stored somewhere other than the laptop.

Know where the recovery key is

When you sign in with a Microsoft account, or a work or school account, device encryption can turn on automatically and the recovery key is attached to that account. It does not turn on automatically if you only use a local account.

If Windows ever asks for the recovery key, you will need to get it from wherever it was saved. Find it now, while everything works, and make sure you can still sign in to that account.

When buying a laptop

Ask the seller whether the exact configuration supports device encryption or BitLocker, especially if you handle client or business files. For a second-hand laptop, make sure the previous owner's accounts have been removed and the drive has been reset before you set it up as yours.