In short
BitLocker management means controlling Windows' built-in disk encryption centrally: enforcing it by policy on every device, choosing how drives unlock (TPM only or TPM plus PIN), storing recovery keys securely so locked-out users can be helped, and reporting which devices are encrypted. It is usually done from an endpoint security or device management console.
Get a quote for BitLocker management
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Why BitLocker needs managing
Left to individual users or one-off set-ups, BitLocker tends to end up in a familiar state: some devices encrypted, some not, recovery keys saved to a personal account or printed and lost, and no single list showing which is which. Problems surface at the worst time, when a user is locked out after a firmware update or an auditor asks for evidence.
A BitLocker management tool fixes that by doing four jobs:
- Enforcing encryption by policy so every device in scope is encrypted the same way
- Controlling how drives unlock, from TPM only to TPM plus PIN
- Escrowing recovery keys in a secure, central store with an audit trail
- Reporting which devices are encrypted, which are not and why
BitLocker is part of Windows Pro, Enterprise and Education. Devices on Windows Home need an edition upgrade before they can be managed this way, which is worth checking before you plan a rollout. For the wider picture, see full disk encryption.
Enforcing BitLocker by policy
A typical managed rollout looks like this:
- Discover. Report which devices are already encrypted, with which settings, and where their recovery keys are held today.
- Decide the policy. Choose the encryption method and strength, whether to encrypt used space only or the whole drive, which drives are covered (operating system, fixed data and removable) and how devices unlock.
- Take over existing encryption. Bring devices that are already encrypted under central management and escrow their keys, rather than decrypting and starting again.
- Pilot. Apply the policy to IT and a small group first, so you can see how users experience restarts and any PIN prompt.
- Roll out in groups. Extend by department or device type, laptops first, and tell users what to expect at the next restart.
- Report and follow up. Chase devices that fail to encrypt, usually because of TPM, firmware or Windows edition issues, and keep the report current as devices are replaced.
Encryption settings belong in your endpoint hardening baseline and your written endpoint security policy, so new devices are encrypted from day one.
TPM only or TPM plus PIN?
The Trusted Platform Module (TPM) chip in modern PCs can release the BitLocker key automatically when the device starts, if nothing has been tampered with. That is seamless for users but means the drive unlocks without anyone proving who they are.
In its August 2026 blog, How BitLocker PINs help protect your data and devices, the NCSC explains that its guidance recommends BitLocker be configured to require a PIN before the device decrypts, and that a PIN helps counter attacks that bypass BitLocker through the Windows Recovery Environment. Where a PIN is not practical, the NCSC describes alternatives:
| Option | How it works | Trade-offs the NCSC describes |
|---|---|---|
| TPM plus PIN | The user enters a PIN before Windows starts | Strongest of the common options; another thing for users to remember |
| Same PIN for Windows Hello and BitLocker | Users keep one PIN for both | Adds protection without a new PIN; does not suit shared devices |
| Network Unlock | The key is released on a trusted corporate network, so the PIN prompt is skipped there | Often the best option for desktops; off-network devices still ask for a PIN |
| Startup key | A USB key provides pre-boot authentication alongside the TPM | Keys can be lost or stolen and are hard to manage across many devices |
| Conditional access | Higher-risk devices are restricted from sensitive resources | The fallback where no pre-boot authentication is possible |
A management console lets you apply different choices to different groups, for example TPM plus PIN on laptops and Network Unlock on office desktops.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Recovery keys: escrow and self-service recovery
Every BitLocker-encrypted drive has a recovery key. Users need it when BitLocker sees a change it does not trust, such as some firmware updates, hardware changes or repeated wrong PINs. Without the key, the data on the drive is lost.
Good BitLocker key management means:
- Central escrow: keys are stored automatically when a device is encrypted, not left to users
- Controlled access: only authorised staff can retrieve a key, and each retrieval is logged
- Self-service options: some consoles let verified users retrieve their own key, which cuts helpdesk time
- Rotation: a key that has been revealed can be replaced
- Clean-up: keys for retired devices are handled in line with your data retention policy
Recovery is also part of incident response. If a device is reported stolen, you need to know it was encrypted and that its key has not been exposed.
Reporting encryption status
A BitLocker management console should be able to answer, at any time: which devices are fully encrypted, which are encrypting, which are not encrypted and why, and which keys are escrowed. That report is what you hand to an auditor, an insurer or a customer completing due diligence, and it supports the evidence expected under UK GDPR and the frameworks in our endpoint security compliance guide.
Look for reports you can filter by group, export and schedule, and for alerts when a device drops out of compliance.
Is BitLocker management the right fit for you?
We will check it against your systems and requirements and recommend the right option.
FileVault: the Mac equivalent
macOS has its own full disk encryption, FileVault. The management questions are the same: enforce it by policy, escrow the recovery key centrally, and report status. Several of the consoles below manage BitLocker and FileVault together, which is simpler for mixed Windows and Mac estates than running separate tools.
BitLocker management tools we supply
| Tool | BitLocker | FileVault | Notes |
|---|---|---|---|
| Bitdefender GravityZone Full Disk Encryption | Yes | Yes | Add-on to GravityZone: policy-based encryption, central recovery keys and status reports |
| WatchGuard Full Encryption | Yes | - | Module for WatchGuard Endpoint Security, with pre-boot authentication and central key recovery |
| Sophos Device Encryption | Yes | Yes | Managed in Sophos Fusion (formerly Sophos Central), with key escrow, self-service key recovery and reporting |
| Check Point Harmony Endpoint Complete | Yes | Yes | Managed BitLocker and FileVault or Check Point's own full disk encryption, plus removable media encryption |
| Microsoft Intune | Yes | Yes | Device management option if you already license Intune; see Microsoft Intune |
The right BitLocker management tool is usually the one that matches the endpoint security platform or device management tool you already run, so encryption sits next to everything else about the device. Ask us for a quote and we will compare the options for your estate.
How we help
We can help you find out which devices are encrypted today and where their keys are, choose a management tool that fits your estate, plan TPM and PIN settings with the NCSC's advice in mind, and set up recovery and reporting so you are not caught out when someone is locked out.
Contact us to talk through BitLocker management for your organisation.
How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos and Check Point Harmony
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
What is a BitLocker management tool?
A BitLocker management tool controls Windows' built-in BitLocker encryption from a central console. It enforces encryption by policy, sets how drives unlock, stores recovery keys securely and reports which devices are encrypted. Many endpoint security platforms include one as a module.
Where should BitLocker recovery keys be stored?
In a secure central store that saves the key automatically when a device is encrypted, limits who can retrieve it and logs each retrieval. Keys saved by users to personal accounts, files or paper are hard to find when needed and hard to protect.
Should BitLocker use a PIN?
The NCSC's guidance recommends configuring BitLocker to require a PIN before the device decrypts. Where that is not practical, it describes alternatives including using the same PIN for Windows Hello and BitLocker, Network Unlock for desktops, a startup key or conditional access.
Can BitLocker be managed without Intune?
Yes. Several endpoint security platforms manage BitLocker from their own console, including Bitdefender GravityZone Full Disk Encryption, WatchGuard Full Encryption, Sophos Device Encryption and Check Point Harmony Endpoint Complete.
Does Windows Home support BitLocker?
BitLocker is part of Windows Pro, Enterprise and Education. Devices on Windows Home usually need an edition upgrade before BitLocker can be managed centrally.
Still have a question about BitLocker management?
Ask us and a member of our team will reply by email.