To check BitLocker status, search Start for Manage BitLocker, or run manage-bde -status in an admin Command Prompt. Look at Protection Status: Protection On means your drive is really protected. Fully Encrypted with Protection Off means it isn't, yet.
To check BitLocker status on Windows 11 or 10, search the Start menu for Manage BitLocker and read the status next to each drive, or open Command Prompt as administrator and run manage-bde -status. The line that matters most is Protection Status. "Protection On" means the drive is encrypted and locked to your PC. "Protection Off" means anyone with the disk could read it, even if the drive says it's 100% encrypted. On Windows Home, look under Settings > Privacy & security > Device encryption instead.
That last point catches a lot of people out. A drive can be fully encrypted and still unprotected, because BitLocker has been suspended or never finished activating. This guide shows every way to check, explains each status in plain English, and walks you through fixing the ones that need attention. It's part of my Windows security guides, so you'll find related checks there too.
In this guide:
If you just want a yes or no, Windows shows you without any commands. Which screen you use depends on your edition, so check that first under Settings > System > About, next to Edition.
On Windows 11 or 10 Home:
If you can't see Device encryption at all, either your hardware doesn't support it or you're signed in with a standard account. Microsoft explains both cases on its Device Encryption support page.
On Pro, Enterprise or Education: open File Explorer and click This PC. A padlock on a drive icon means BitLocker is turned on for that drive. A padlock with a yellow warning sign usually means protection is suspended or waiting for activation. No padlock means the drive isn't encrypted. File Explorer is a hint rather than proof, so use one of the methods below to confirm.
The BitLocker Control Panel page is the friendliest way to see every drive at once on Pro and higher editions.
These are the statuses you'll see there, based on the list in Microsoft's BitLocker operations guide:
| Status shown | What it means | Do you need to act? |
|---|---|---|
| BitLocker on | The drive is encrypted and protected | No. Just make sure your recovery key is saved |
| BitLocker off | The drive isn't encrypted | Turn it on if the device leaves your home or holds sensitive files |
| BitLocker suspended | Encrypted, but the key is sitting unprotected on the disk | Yes. Resume protection unless an update or BIOS change is in progress |
| Waiting for activation | Encrypted with a clear key; no proper protector has been added yet | Yes. Add a protector or back up the recovery key to finish setup |
| Encrypting or Decrypting | BitLocker is still working through the drive | No. Leave the PC on and plugged in until it finishes |
Windows Home doesn't include this Control Panel page, which is why searching for it on a Home laptop finds nothing.
The manage-bde command gives you the full picture in one go and works the same on Windows 10 and 11. It needs administrator rights.
manage-bde -status and press Enter to see every drive, or manage-bde -status C: for just the system drive.A healthy system drive looks something like this:
C:\>manage-bde -status C:
Volume C: [Windows]
[OS Volume]
Size: 476.31 GB
BitLocker Version: 2.0
Conversion Status: Used Space Only Encrypted
Percentage Encrypted: 100.0%
Encryption Method: XTS-AES 128
Protection Status: Protection On
Lock Status: Unlocked
Identification Field: Unknown
Key Protectors:
TPM
Numerical PasswordIf you write scripts, the -protectionaserrorlevel switch (short form -p) makes the command return 0 when the drive is protected and 1 when it isn't. Microsoft's manage-bde status reference lists every parameter, including -computername for checking another PC on your network.
If you see "Access is denied" or "requires elevation", the window isn't running as administrator. Close it and open it again with Run as administrator.
Most of the output is self-explanatory once you know which lines carry the verdict. Here's what each one tells you.
| Line | Typical values | What it tells you |
|---|---|---|
| Conversion Status | Fully Encrypted, Used Space Only Encrypted, Fully Decrypted, Encryption in Progress, Encryption Paused | How much of the drive has been encrypted. "Used Space Only" is normal on new PCs and still protects all your data |
| Percentage Encrypted | 0% to 100% | Progress of the encryption or decryption job |
| Encryption Method | XTS-AES 128, XTS-AES 256, AES-CBC 128 | The algorithm in use. XTS-AES 128 is the Windows default |
| Protection Status | Protection On, Protection Off, Protection Unknown | The real answer to "am I protected?" |
| Lock Status | Unlocked, Locked | Whether the drive is open for use right now |
| Key Protectors | TPM, TPM And PIN, Numerical Password, Password, External Key | How the drive gets unlocked. "Numerical Password" is your 48-digit recovery key |
Two combinations deserve a second look. Fully Encrypted plus Protection Off means BitLocker is suspended or still waiting for activation. Protection Unknown plus Locked usually means a data or USB drive that you haven't unlocked yet, so Windows can't read its details.
If Key Protectors shows only TPM and no Numerical Password, there's no recovery key for that drive. Fix that before anything else, because a motherboard repair or firmware change could leave you locked out.
PowerShell gives you the same information as objects, which makes it easy to filter, sort or export. Open Terminal (Admin) and run:
Get-BitLockerVolumeThat prints a table of every volume. For the full detail on one drive, use:
Get-BitLockerVolume -MountPoint C: | Format-ListAnd for a tidy one-line-per-drive summary you can paste into a support ticket:
Get-BitLockerVolume |
Select-Object MountPoint, VolumeType, VolumeStatus, ProtectionStatus, EncryptionPercentage, LockStatus,
@{n='Protectors'; e={$_.KeyProtector.KeyProtectorType -join ', '}} |
Format-Table -AutoSizeThe VolumeStatus property uses slightly different words from manage-bde:
| VolumeStatus | Plain English |
|---|---|
| FullyEncrypted | The whole drive (or all used space) is encrypted |
| FullyDecrypted | Not encrypted |
| EncryptionInProgress | Encrypting now; check EncryptionPercentage |
| DecryptionInProgress | BitLocker is being turned off |
| EncryptionSuspended / DecryptionSuspended | The job has paused, often because the laptop went on battery or restarted |
As with manage-bde, ProtectionStatus is the property that tells you whether you're actually protected. Microsoft's Get-BitLockerVolume documentation describes every property in the output.
Windows Home doesn't have the full BitLocker interface, but many Home laptops are encrypted anyway through Device Encryption, which uses BitLocker underneath. Microsoft's support page says it switches on automatically when you first sign in with a Microsoft account, or a work or school account, on supported hardware. With a local account, it doesn't turn on by itself.
To check it, use the Settings path from the first section. If the option is missing, find out why:
| Value shown | What it means |
|---|---|
| Meets prerequisites | Device Encryption is available; turn it on in Settings |
| TPM is not usable | No TPM, or it's disabled in the BIOS/UEFI settings |
| WinRE is not configured | The Windows Recovery Environment isn't set up |
| PCR7 binding is not supported | Secure Boot is off, or a dock or other device was connected during start-up |
Microsoft's BitLocker overview notes that from Windows 11 version 24H2, some older hardware requirements were removed, so more devices now qualify. The command-line checks above also work on Home, so manage-bde -status is a quick way to confirm what the Settings toggle is telling you.
Here's how to act on what you found. Most results need nothing at all, and the rest take a minute or two.
manage-bde -protectors -enable C: or the PowerShell command Resume-BitLocker -MountPoint C:.manage-bde -resume C:.One thing worth knowing about suspension: the PowerShell Suspend-BitLocker command resumes protection automatically after one restart unless you set a different restart count. Choosing 0 keeps it suspended until you resume it by hand, which is how a drive can end up unprotected for months without anyone noticing.
While you're checking status, confirm you can get to your recovery key. It's a 48-digit number, and if Windows ever asks for it at start-up you'll need it from a different device.
manage-bde -protectors -get C: in an admin Command Prompt and compare the ID under Numerical Password. If they match, you're covered.Work or school devices store keys in the organisation's account instead, at aka.ms/aadrecoverykey, or with your IT team. If someone else set up the PC, the key may be in their Microsoft account. You may also have a printout or a text file on a USB stick.
Microsoft's page on how to find your BitLocker recovery key is blunt about one thing: its support staff can't retrieve, provide or recreate a lost key. If the key is gone and the drive locks, the only way back is to reset the PC, which removes your files. Five minutes of checking now is worth it.
Removable drives encrypted with BitLocker To Go show up in the same places: under Removable data drives in Control Panel, and in manage-bde -status once plugged in.
To unlock a drive automatically on your own PC, open Manage BitLocker and choose Turn on auto-unlock for it. Only do this on a PC you trust, because anyone signed in to it can then open the drive.
If you're choosing a password for a portable drive, make it long. A memorable three- or four-word passphrase works well, and my free password generator makes one in your browser without sending it anywhere.
These are the problems people run into most often when checking status, with the usual fix.
| Problem | Likely cause | Fix |
|---|---|---|
| "Manage BitLocker" doesn't appear | You're on Windows Home | Use Settings > Privacy & security > Device encryption, or manage-bde |
| Access is denied in Command Prompt | The window isn't elevated | Reopen it with Run as administrator |
| Device encryption option is missing | Standard account or unsupported hardware | Sign in as an admin, then check Device Encryption Support in System Information |
| Stuck on "Encryption in Progress" | On battery, sleeping or a slow drive | Plug in, stop it sleeping, give it time, then check the percentage again |
| Protection Off after a BIOS update | Suspended for the update and not resumed | Run Resume-BitLocker -MountPoint C: |
| Asked for the recovery key at every start | Firmware, Secure Boot or TPM change | Enter the key, then suspend and resume BitLocker so it re-seals to the new settings |
For deeper digging, open Event Viewer and go to Applications and Services Logs > Microsoft > Windows > BitLocker-API. The Management log records when protection was suspended, resumed or changed. Microsoft's BitLocker troubleshooting guide lists the commands its own support engineers run, including Get-Tpm and reagentc /info.
BitLocker status is one of a handful of things worth glancing at once a month, especially on a laptop. Here's a short routine:
manage-bde -status C: and confirm Protection On.If step 3 shows a warning, my guide on how to check if Windows Defender is on explains what each message means and how to fix it without switching anything important off.
Look in File Explorer under This PC. A padlock on the drive icon means BitLocker is turned on. For the full status, including whether protection is suspended, you need an administrator account to run manage-bde -status or open Manage BitLocker.
Fully Encrypted describes the data on the disk. Protection On means the key that unlocks it is protected by the TPM, a PIN or a password. A drive can be fully encrypted with protection off, which happens when BitLocker is suspended or waiting for activation, and in that state it isn't really protected.
Windows 11 Home doesn't have the full BitLocker tools, but it has Device Encryption, which uses BitLocker to encrypt the system drive and internal drives on supported hardware. Check it under Settings > Privacy & security > Device encryption.
The drive was encrypted with a temporary clear key and no proper protector has been added yet. On a home PC, signing in with a Microsoft account that has administrator rights usually backs up the recovery key and completes activation. You can also turn BitLocker on from Control Panel to finish it.
No. While it's suspended, the key needed to read your data is stored unprotected on the drive. Suspension is meant to be brief, for example during a BIOS update. Resume it with Resume-BitLocker -MountPoint C: or manage-bde -protectors -enable C: when the update is done.
Open Command Prompt as administrator and run manage-bde -protectors -get C:. The 48-digit number under Numerical Password is the recovery key. Store a copy somewhere other than the PC, such as your Microsoft account or a printout.
No. manage-bde -status, Get-BitLockerVolume and the Control Panel page only read information. Nothing changes until you choose an action such as suspending, resuming or turning BitLocker off.
Last checked: 24 October 2026. Figures, settings and guidance can change, so confirm anything important with the sources linked above.
To check Windows Firewall status, open Windows Security and select Firewall & network protection. Each profile (Domain, Private, Public) says whether the firewall is on, and the one you're using is marked active. netsh and PowerShell give the same answer in one line.
Step-by-step Windows security guides: check Defender, startup programs, failed logins, open ports, UAC, encryption, passwords and 2FA. Plain English, free tools.
Check if Microsoft Defender Antivirus is on, up to date and not in passive mode. Windows Security steps, Get-MpComputerStatus fields, tamper protection and fixes.
To check startup programs, open Task Manager > Startup apps on Windows or System Settings > General > Login Items & Extensions on a Mac. For a full picture, including scheduled tasks and services, use Microsoft's free Autoruns tool.