How to Enable and Disable BitLocker with TPM in Windows

Overview

This article explains how to enable and disable Windows BitLocker Drive Encryption using a Trusted Platform Module (TPM) on Dell computers running Windows 10 or Windows 11. It covers TPM activation in BIOS, BitLocker setup, status verification, suspension, and decryption. USB-as-TPM configurations, Domain Group Policy changes, and network-managed BitLocker deployments are outside the scope of this article.

Quick Reference

Use the table below to quickly match a user question or intent to the relevant section.

Key Concepts and Definitions

BitLocker Drive Encryption

A full-volume encryption feature built into Windows that protects data by encrypting entire disk volumes. When enabled, BitLocker encrypts data at rest, preventing unauthorized access if a drive is removed or the computer is stolen.

Trusted Platform Module (TPM)

A dedicated hardware security chip on the motherboard that stores cryptographic keys. BitLocker uses TPM to seal encryption keys, ensuring the drive can only be decrypted on the original computer with the same hardware configuration. Two versions exist:

• TPM 1.2 — Required for Legacy (non-UEFI) Boot Mode systems.
• TPM 2.0 — Supported in UEFI Boot Mode. Required by Windows 11. Some models (e.g., Latitude 5175, Latitude 7275) have TPM 2.0 only.

Recovery Key

A 48-digit numeric key generated during BitLocker setup. It is the only way to access a BitLocker-encrypted drive if the TPM cannot be verified (e.g., after hardware changes). Loss of the recovery key makes encrypted data permanently inaccessible — the operating system must be reinstalled.

BitLocker States

• On (Encrypted) — Drive is fully encrypted and protected.
• Encrypting — BitLocker encryption is in progress.
• Suspended — BitLocker is temporarily paused; the drive is accessible without the TPM. Required before certain maintenance tasks.
• Off (Decrypted) — BitLocker is disabled and the drive is decrypted.

Prerequisites and Compatibility

TPM Version vs. Boot Mode Compatibility

Section 1 — Enabling the TPM in BIOS

1. Power on the computer.
2. During POST, press the F2 key to enter the BIOS Setup.
3. Navigate to the Security section.
4. Within Security, locate the TPM option.
5. Select the TPM 2.0 or TPM 1.2 section from the left panel.
6. Check the TPM checkbox to turn on the TPM.
7. Select Activate or Enable the TPM (if the option is present).
8. Click Save Changes and Exit the BIOS. The computer will restart.

Section 2 — Enabling BitLocker in Windows

Step 1 — Open the Manage BitLocker Console

Use any one of the following methods:

Method A — Start Menu Search (Recommended)

1. 1. Click the Windows Start Menu button.
   2. In the search box, type: Manage BitLocker (Windows 10) or Device Encryption (Windows 11).
   3. Press Enter or click the result icon.

Method B — Control Panel

1. 1. Click the Windows Start Menu → Control Panel.
   2. Click System and Security.
   3. Click any option under BitLocker Drive Encryption.

Method C — File Explorer (Drive Right-Click)

1. 1. Open File Explorer and select This PC.
   2. Right-click the C:\ (Windows) drive.
   3. Click Turn on BitLocker. (This skips the initial BitLocker screen.)

Step 2 — Run the BitLocker Setup Wizard

1. In the BitLocker Management screen, click Turn on BitLocker. BitLocker performs a short initialization.
2. Save the Recovery Key — choose one of these options:

• • Save to your Microsoft account
  • Save to a USB flash drive
  • Save to a file (on a different drive)
  • Print the recovery key

3. After saving the key, click Next.
4. Select an encryption option:

• • Encrypt used disk space only — Faster; preferred for new computers. Encrypts data as space is used; free space remains unencrypted.
  • Encrypt entire drive — Slower; encrypts all space regardless of use. Recommended for drives already in use.

5. Click Next.
6. Select the encryption mode if prompted:

• • New encryption mode (XTS-AES) — Recommended for fixed drives on Windows 11/10.
  • Compatible mode — Use for removable drives shared with older Windows versions.

7. Click Next.
8. Ensure the Run BitLocker system check checkbox is selected, then click Continue.
9. Restart the computer to begin encryption.

Section 3 — Checking BitLocker Status

Method A — Manage BitLocker Console

1. 1. Open the Manage BitLocker console using any method from Section 2, Step 1.
   2. Read the status reported in the console:

• • • Encrypting — BitLocker encryption is currently in progress.
    • BitLocker On (lock icon) — The drive is fully encrypted and protected.
    • BitLocker Off — The drive is decrypted and unprotected.
    • Suspended — BitLocker is paused; protection is temporarily disabled.

Method B — Command Line

For automation, scripting, or IT administration use.

1. 1. Open an elevated Command Prompt: In the search box type cmd, then right-click Command Prompt > Run as Administrator.
   2. In the Command Prompt type manage-bde -status, and press Enter.
   3. Review the output: conversion status, protection status, key protectors, and lock status are displayed for each volume.

Key Output Fields

Section 4 — Suspending BitLocker

Suspending BitLocker is a temporary state — it does not decrypt the drive. Use it for BIOS updates, firmware changes, or hardware modifications.

1. Boot into Windows.
2. Open the Manage BitLocker console (see Section 2, Step 1).
3. Click Suspend Protection for the target drive.
4. Review the warning prompt and click Yes to confirm.
5. After completing the maintenance task, return to Manage BitLocker and click Resume Protection to re-enable BitLocker.

Section 5 — Disabling (Turning Off) BitLocker

Disabling BitLocker fully decrypts the drive. This is a permanent action that removes all encryption. No data is deleted, but the drive will no longer be protected.

1. Boot into Windows.
2. Open the Manage BitLocker console (see Section 2, Step 1).
3. Click Turn off BitLocker for the target drive.
4. Confirm the decision in the prompt.
5. Allow the computer to complete decryption. Do not force a shutdown during decryption.

Troubleshooting