Check BitLocker status and enable it
On a prepared TPM-ready Windows 11 Pro workstation, use manage-bde -status to confirm that the OS volume is fully decrypted and protection is off. Then use manage-bde -on C: -recoverypassword to add the recovery and TPM protectors. Securely store and verify the generated recovery password before an approved restart and hardware test; encryption has not begun at the console step shown here. This lab uses a canned console and recovery password; it does not touch the learner's drive. Practice, not exam questions. Not a score predictor. Nothing here is taken from any exam.
The steps on this page are free to read. The hands-on lab for this procedure is included with Academy.
Steps
- 1
Run manage-bde -status and read the C: volume's Conversion Status, Percentage Encrypted, and Protection Status. Fully Decrypted, 0.0%, and Protection Off mean the volume is not protected.
- 2
Run manage-bde -on C: -recoverypassword. Record and verify the generated Numerical Password in approved off-device or organizational escrow before restarting; the OS volume must restart and pass its hardware test before encryption begins.
What you should see
The initial status shows Fully Decrypted, 0.0%, and Protection Off. The enable output adds Numerical Password and TPM protectors, prints the 48-digit recovery password, and gives restart and hardware-test actions without showing immediate encryption progress.