Configure BitLocker on Windows 10 or 11 devices

Supported editions for this feature: Frontline Starter and Frontline Standard; Business Plus; Enterprise Standard and Enterprise Plus; Education Standard, Education Plus, and Endpoint Education Upgrade; Enterprise Essentials and Enterprise Essentials Plus; Cloud Identity Premium. Compare your edition

As an administrator, you can specify how Microsoft Windows 10 or 11 devices that are enrolled in Windows device management are encrypted. The settings you choose take effect if the device has BitLocker drive encryption turned on. The most common settings to configure are:

• Drive encryption
• Additional startup authentication
• Preboot recovery options
• Fixed drives encryption
• Fixed drives recovery options
• Removable drives encryption

Before you begin 

Devices must be enrolled in Windows device management for these settings to apply. Learn more

Configure BitLocker drive encryption

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesMobile and endpointsSettingsWindows.
3. Click BitLocker settings.
4. (Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
5. Under Drive encryption, select Enabled from the list of items.
6. Configure the options (open all): Drive encryption
   • Encryption option for system drives–Select the encryption method and the cipher strength of the key for operating system drives.
   • Additional startup authentication–Select whether BitLocker requires additional authentication each time the computer starts and specify if you’re using a Trusted Platform Module (TPM). When enabled, you can set the following:
     • Allow BitLocker without a compatible TPM–Check the box to require either a password or a USB drive is required for startup.
     • Configure TPM startup without a PIN or key–You can require TPM as startup authentication instead of a PIN or key.
     • TPM startup PIN–You can require a 6-digit to 20-digit PIN to be entered before startup. You can also configure the minimum PIN length.
     • TPM startup key–You can require users to authenticate with a TPM startup key to access a drive. A startup key is a USB key with the information to encrypt the drive. When this USB key is inserted into the device, access to the drive is authenticated and the drive is accessible.
     • TPM startup key and PIN–You can require both a startup key and a PIN.
   • Pre-boot recovery options–Enable to set the recovery message or customize the URL provided on the pre-boot key recovery screen when the operating system drive is locked.
   • System drives recovery options–Enable to set options for users to recover data from operating system drives protected by BitLocker. When enabled, you can set the following:
     • Allow data recovery agent–Data recovery agents are individuals whose public key infrastructure (PKI) certificates are used to create a BitLocker key protector. When allowed, these individuals can use their PKI credentials to unlock drives protected by BitLocker.
     • Specify 48-digit recovery password–Select whether users are allowed, required, or not allowed to generate a 48-digit recovery password.
     • 256-bit recovery key–Select whether users are allowed, required, or not allowed to generate a 256-bit recovery key.
     • Hide recovery options from BitLocker setup wizard–Check the box to prevent users from specifying recovery options when they turn on BitLocker.
     • Save BitLocker recovery information to Active Directory Domain Services–When checked, you can choose which BitLocker recovery information to store in Active Directory. You can select either the Backup recovery password and key package or the Backup recovery password only. When enabled, you can set the following:
       • Don't enable BitLocker until recovery information is stored in Active Directory–Check the box to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to Active Directory succeeds.
   Fixed drives encryption
   • Fixed drives encryption–Enable to require fixed drives be encrypted before write access is granted. When enabled, you can set the following:
     • Encryption for fixed drives–Select the encryption method and key cipher strength for fixed drives.
     • Fixed drives recovery options–Enable to set options for users to recover data from fixed drives protected by BitLocker. When enabled, you can set the following:
       • Allow data recovery agent–Data recovery agents are individuals whose public key infrastructure (PKI) certificates are used to create a BitLocker key protector. When allowed, these individuals can use their PKI credentials to unlock drives protected by BitLocker.
       • 48-digit recovery password–Select whether users are allowed, required, or not allowed to generate a 48-digit recovery password.
       • 256-bit recovery key–Select whether users are allowed, required, or not allowed to generate a 256-bit recovery key.
       • Hide recovery options from BitLocker setup wizard–Check the box to prevent users from specifying recovery options when they turn on BitLocker.
       • Save BitLocker recovery information to Active Directory Domain Services–When checked, you can choose which BitLocker recovery information to store in Active Directory. You can select either the Backup recovery password and key package or the Backup recovery password only. When enabled, you can set the following:
         • Don't enable BitLocker until recovery information is stored in Active Directory–Check the box to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to Active Directory succeeds.
   Removable drive encryption
   • Removable drives encryption–Enable to require all removable drives to be encrypted before write access is given. When enabled, you can set the following:
     • Encryption for removable drives–Select the encryption algorithm and key cipher strength for removable drives. 
     • Deny write access to devices configured in another organization–When checked, only drives with identification fields matching the computer's identification fields are granted write access. These fields are defined by your organization’s group policy.
7. Click Save. Or, you might click Override for an organizational unit.

   To later restore the inherited value, click Inherit. 

Changes can take up to 24 hours but typically happen more quickly. Learn more

Set drive encryption to Not configured

If you select Not configured for Drive encryption, the BitLocker policy you set in the Admin console is no longer enforced. On user devices, the policy reverts to the setting it had before. If the user encrypted the device, no changes are made either to the device or to data on the device.

Disable BitLocker drive encryption

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesMobile and endpointsSettingsWindows.
3. Click BitLocker settings.
4. If you want to disable a profile for only some users, select an organizational unit from the list on the left. Otherwise, it applies to everyone.
5. Under Drive encryption, select Disabled from the list of items.
6. Click Save. Or, you might click Override for an organizational unit.

   To later restore the inherited value, click Inherit. 

Related topics

• Enable Windows device management
• Enroll a device in Windows device management