Launch BitLocker Drive Encryption through start menu on your windows 10 system which will show Windows (C:) BitLocker on with lock sign. Restart now.Ĭomputer will start, this time asking the password to unlock your drive. You will get message that The computer must be restarted. Click Continue to start encryption process. Under page Are you ready to encrypt this drive, select Run BitLocker system check. Next page will show you Choose which encryption mode to use, go with New encryption mode (best for fixed drives on this device).

However the 2 nd option is more secure as it will protect whole disk. In Next page, select Encrypt used disk space only (faster and best for new PCs and drives) as it will only encrypt the disk which is used, rather than complete disk which could be time consuming. Once done, you will see Ýour recovery key was printer. We will go with last option as we will save this as PDF file. You can various option such as Save to your cloud domain account, Save to a USB flash drive, Save to a file, Print the recovery key. Next page will ask How do you want to back up your recovery key. This will launch BitLocker Drive Encryption wizard with page Choose how to unlock your drive at startup. Open explorer, right click c drive and select Turn on BitLocker. It is recommended to restart the system to apply new policy correctly. Open cmd prompt, run gpupdate /force to apply new policies. This option will make sure to save the recovery key first before initiating encryption process, hence it requires connectivity to Domain controller to save the info. Open Policy setting “ Choose how BitLocker-protected operating system drives can be recovered” – This setting is optional, however it could be a good setting if you wanted to save the BitLocker recovery information in AD DS.Įnable the option, uncheck Allow data recovery agent and check Save BitLocker recovery information to AD DS for operating system drives.Ĭheck the Box for Do not enable BitLocker until recovery information is stored to AD DS for operating system drives. Under settings page of the policy, Enable the policy by click on Enabled Radio Button.Ĭheck the box “ Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive)”. Under Right Pane, double click Require additional authentication at startup. Navigate to Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. Press Windows + R, type gpedit.msc (for local policy) or gpmc.msc (for group policy).

Bitlocker without tpm windows 10