Enable Device Encryption on Your Device Windows: A Step-by-Step Guide With the Editions That Actually Offer It

You can enable device encryption on Windows in two ways: on supported consumer editions (Windows 11 Home, Pro, and their Windows 10 equivalents) open Settings > Privacy & security > Device encryption and flip the switch, provided your hardware meets Microsoft's Modern Standby and TPM 2.0 requirements; on Windows Pro, Enterprise, or Education you use BitLocker under Settings > Privacy & security > Device encryption or through Control Panel. On Windows 11 version 24H2 and later, Microsoft requires you to complete the out-of-box experience setup with a Microsoft account before the Device encryption toggle appears, which is the most common reason people can't find it.

Why the Device Encryption Toggle Is Missing on Most PCs

The first thing to understand is that "Device encryption" in Settings and "BitLocker Drive Encryption" in Control Panel are two different features that share the same underlying technology. Device encryption is the simplified consumer front end that Microsoft introduced with Windows 10 in 2015, and it only switches on automatically when a strict hardware checklist passes. BitLocker is the full management console for professional editions, with recovery key options, network unlock, and policy controls that device encryption hides behind a single toggle.

Microsoft's documented prerequisites for device encryption are specific: TPM version 2.0, UEFI firmware with Secure Boot enabled, InstantGo (Modern Standby) support, Connected Standby sleep state, and no incompatible third-party disk drivers. If any one of those fails, the Device encryption page either shows nothing or tells you encryption isn't available. On many custom-built desktops with standard S3 sleep, the toggle never appears at all, even on Windows 11 Pro, because S3 sleep does not count as Modern Standby.

The edition matters just as much as the hardware. Windows 11 Home and Windows 11 Pro both expose the Device encryption toggle; Windows 11 Enterprise and Education do not show it in the same location because Microsoft expects IT to manage BitLocker directly. Windows 10 Home prior to version 1511 lacked device encryption entirely. Check your edition by pressing Windows key + R, typing winver, and pressing Enter — you'll see the version, build, and edition in one dialog.

If your machine passes the hardware test but the button is greyed out, the most likely culprit is that your Microsoft account isn't linked, or that Windows hasn't signed in to activate the encryption key escrow. According to Microsoft's BitLocker documentation, device encryption stores the recovery key in your Microsoft account or Azure Active Directory automatically — which is why signing in with a local account can leave the toggle non-functional on some builds.

Check TPM, Secure Boot, and Modern Standby Before You Touch Anything

Before enabling anything, run the readiness check so you don't waste an hour troubleshooting a device that was never going to qualify. You need to verify four items: TPM version and state, Secure Boot status, Modern Standby support, and the edition of Windows.

Open Windows Security (search "Windows Security" from the Start menu), click Device security, then Security processor details. TPM 2.0 with "Ready" status is what you want; "Not ready" means the firmware hasn't been initialized and you should reboot into BIOS to clear and re-enable it. Physical presence confirmation from the BIOS may be required on some Lenovo ThinkPads and Dell Latitude models.

For Secure Boot, open System Information (msinfo32) from Run and look at the "Secure Boot State" row. "On" is correct. "Off" means you need to enable Secure Boot in UEFI firmware settings — a change that can break dual-boot Linux installations, so plan the Linux bootloader update before flipping it.

Modern Standby is the trickiest check. Open Command Prompt as administrator and run powercfg /a. You'll see "Standby (S0 Low Power Idle) Network Connected" listed as available if your system supports Modern Standby. If only "Standby (S3)" appears, the device encryption toggle will not appear. Dell's OptiPlex desktops and many gaming motherboards from ASUS and MSI fall into this category, even on the newest Intel and AMD chipsets.

Once those three pass, verify your build number through winver — Windows 11 22H2 build 22621 and later, and Windows 10 21H2 build 19044 and later, are the supported targets for the simplified toggle. Older 1909 and 2004 builds may still show the Device encryption panel but handle recovery keys less gracefully, which matters if you're relying on Microsoft account escrow.

Enable Device Encryption Step by Step in Windows 11 Settings

If your PC meets every requirement above, this is the operational sequence. The whole process takes about 15 seconds of clicks, then anywhere from a few minutes to a couple of hours of background encryption depending on drive size and speed.

1: Sign in to Windows with your Microsoft account (not a local account). Confirm under Settings > Accounts > Your info. 2: Open Settings > Privacy & security > Device encryption. 3: Confirm the toggle reads "On" — if it reads "Off," click the toggle and wait for the UAC prompt. 4: When prompted, sign in again to your Microsoft account so Windows can upload the recovery key. 5: Leave the PC plugged in and awake until the drive encryption status shows "Complete" under Settings > Privacy & security > Device encryption > Related settings.

A 500 GB NVMe drive typically finishes encryption in 5 to 20 minutes on modern hardware; a 2 TB SATA SSD with a QLC NAND controller can take 40 minutes to over an hour, and encryption throttles when the machine sleeps. If power is cut during encryption, Windows resumes on next boot rather than corrupting the drive — the same restart behavior BitLocker uses.

If the toggle is greyed out or the page is blank, run "Manage BitLocker" from the Start menu as a fallback. On Windows 11 Home this only opens a help page, but on Pro it exposes the BitLocker control panel where you can confirm whether the underlying feature is installed. Missing the BitLocker Drive Encryption Optional Feature (Control Panel > Programs and Features > Turn Windows features on or off) prevents device encryption from reaching the hardware even on Home, because the encrypted file system is still BitLocker underneath.

If you see the error "This device can't be encrypted because the TPM is not initialized," reboot to BIOS, set TPM to "Enabled" and "Clear" once, save, reboot into Windows, then rerun the toggle. If the message is "Modern Standby is not supported," the hardware simply will not qualify — you'd need BitLocker on a Pro upgrade.

Use BitLocker Instead on Pro, Enterprise, and Education Editions

On Windows 11 Pro, Enterprise, and Education, the Device encryption toggle exists but is functionally a shortcut for BitLocker with defaults inherited from Group Policy. If your organization has set BitLocker policy (for example, requiring XTS-AES 256-bit with a recovery password stored in Active Directory), the toggle may be controlled by IT and require elevated privileges you don't have.

For individual Pro users, Control Panel > System and Security > BitLocker Drive Encryption shows the full console. Click "Turn on BitLocker" on the OS drive, choose "Save your recovery key" (Microsoft account, USB, file, or print), select "Encrypt used disk space only" for new drives or "Encrypt entire drive" for drives that previously held sensitive data, and pick the encryption mode. For fixed drives Windows now defaults to XTS-AES 128-bit, which the National Institute of Standards and Technology (NIST) considers appropriate for protecting data at rest.

The recovery key is a 48-digit numeric string. Save it somewhere other than the encrypted drive — a password manager, a printed sheet in a locked drawer, or your Microsoft account. BitLocker will not let you proceed without confirming the key was saved, and losing the key means permanently losing access to the drive.

One practical difference bite-size reviewers miss: BitLocker on Pro can pause protection during firmware updates (Control Panel > BitLocker > Suspend protection) to avoid recovery-key prompts when the TPM measurement changes. Device encryption on Home cannot pause protection, so BIOS or UEFI updates on Home machines can trigger a recovery-key prompt on next boot — keep the key accessible for 24 hours after any firmware update on a Home machine.

Understand What Encryption Actually Protects — and What It Doesn't

Encryption at rest protects data when the drive is powered off or stolen. Once you sign into Windows and the drive is unlocked, the operating system reads decrypted files normally, which means malware running under your account, a shoulder-surfer, or an unlocked laptop in a coffee shop are not stopped by device encryption. Microsoft's own BitLocker FAQ is clear on this: BitLocker protects against "offline attacks," meaning an attacker who has physical access to the powered-off drive.

That's a critical boundary for people who think "encrypted" equals "safe." Ransomware, credential theft via phishing, and browser-based session hijacking all happen with the drive fully unlocked. BitLocker and device encryption also do not cover files copied to an external drive or USB stick unless you enable BitLocker To Go on those drives separately.

The recovery key is the single point of failure. According to Microsoft's support documentation, if the TPM detects tampering, a firmware change, or a Secure Boot violation, Windows will demand the 48-digit recovery key at boot before the OS loads. If you saved it to your Microsoft account and can't sign in because the machine won't boot, you need another device to reach account.microsoft.com/devices/recoverykey. Save a secondary copy outside the machine.

Performance cost is real but small on modern hardware. On a 12th-gen Intel Core i5 with an NVMe SSD, BitLocker with XTS-AES 128-bit typically reduces sequential read throughput by 2 to 8 percent and CPU overhead by 1 to 3 percent — noticeable in synthetic benchmarks, invisible in everyday work. On older spinning drives or low-end Celeron-class systems, the overhead is heavier because encryption still requires CPU cycles. The general guidance from Microsoft is to enable it anyway: the security gain outweighs a benchmark number.

Recovery Key Storage: Where It Goes and How to Retrieve It

On a Microsoft-account-linked PC, device encryption automatically escrows the recovery key to your Microsoft account. To check, sign in at account.microsoft.com/devices/recoverykey — you'll see the key ID and the 48-digit key for each encrypted device. If your account uses two-factor authentication, you'll need the second factor to reveal the key, which is why setting up an alternate recovery method matters.

On work or school devices joined to Azure Active Directory, keys are stored in the organization's Azure AD tenant and can be retrieved by an administrator through the Azure portal or by the user through the "Access work or school" settings. Home users who never linked a Microsoft account during setup end up in a state where device encryption runs but the recovery key has nowhere to go; Microsoft's behavior in that scenario is to prompt at first boot after encryption for the machine to be linked, or to demand a key when the drive is first tampered with.

Retrieve the key through Settings > Accounts > Access work or school > [org name] > Info if you're on an Azure-joined device without admin access. For local PBKDF2-style recovery on BitLocker-managed machines, run manage-bde -protectors -get C: at an admin prompt to display the numerical password and the IDs of all protectors.

Store at least two copies. Print the key and put it in a safe, or save the text file to a password manager like Bitwarden or 1Password. Do not email it to yourself in plain text and do not save it to the same drive being encrypted.

Turn It Off Cleanly if You Need To — and What Happens to Data

You might need to disable encryption if you're replacing a drive, retiring the machine, or troubleshooting a boot loop. On Home, open Settings > Privacy & security > Device encryption and click the toggle to off — Windows begins decryption and it can take as long as the encryption did. Never interrupt decryption by pulling the drive or force-shutting down; partial decryption can leave the volume unbootable.

On Pro and Enterprise, open Control Panel > BitLocker Drive Encryption and click "Turn off BitLocker." Choose between "Disable BitLocker" (decrypts the entire volume) or "Suspend protection" (keeps the volume encrypted but leaves it unlocked at boot, useful for firmware updates and temporarily for troubleshooting). Suspend is reversible in one click; disable takes the full duration again to re-encrypt.

Before disabling, back up essential files to external storage — decryption does not delete data, but disabling BitLocker without backups leaves you without a recovery path if the SSD fails mid-process. Microsoft's documentation recommends confirming at least 20 percent free drive space, since some decryption workflows need staging space for the BitLocker metadata.

Machine resale or recycling is the reason most people disable encryption, but a cleaner step for a drive being retired is to format it and reinstall Windows — BitLocker encryption keys are destroyed when the drive is reformatted, making recovery nearly impossible even from forensic hardware. If you're donating the drive, secure-erase it with a tool like Samsung Magician or Crucial Storage Executive rather than just disabling encryption.

Compare Windows 10 Home, Pro, and Enterprise on Encryption Control

Different editions expose different levels of control over encryption. The table below shows what each edition gives you, based on Microsoft's BitLocker documentation and the Windows 11 feature comparison on Microsoft's site. Values reflect Windows 11 24H2 as the current reference; older builds may differ slightly.

For $99 retail (Microsoft Store price for Windows 11 Pro upgrade as of Microsoft's store page in 2024-2025), a Home user gets BitLocker console access and the ability to suspend protection during firmware updates. Home users who manage their own machines and update BIOS once a year may want to weigh that upgrade cost. Enterprise and Education users typically get BitLocker managed by their IT department, which means the toggle is either invisible or controlled remotely.

Worth noting: Windows 11 SE, the education-only edition shipped on some low-cost laptops, does not expose BitLocker console even though device encryption runs automatically. If you're on a school-issued device and want to verify encryption status, ask the school's IT — the local console will not show you.

The verdict is straightforward. If you have Windows 11 Pro, use the full BitLocker console so you can suspend protection before BIOS updates. If you're on Home and hardware qualifies, the toggle is enough — just keep the recovery key retrievable. If encryption isn't available on your Home machine, the Pro upgrade is the only path to BitLocker without reinstalling.

Common Failure Cases and How to Recover

The single most common failure is a boot-time recovery prompt after a firmware update on a Home-encrypted machine. Because Home can't pause protection, a BIOS update changes the TPM measurement and Windows demands the 48-digit key before the OS loads. Solution: enter the key from account.microsoft.com/devices/recoverykey, boot normally, then update firmware again deliberately with the machine plugged in. On Pro, suspend protection first.

The second failure is "BitLocker cannot be enabled" because the TPM is owned by a stale Operating System. Clear the TPM in BIOS by selecting "Clear TPM" and confirming in Windows Security > Device security > Security processor details > TPM troubleshooting > Clear TPM. This invalidates any existing encryption, so don't do it on a drive that's already encrypted unless you have the recovery key.

Third: storage driver interference. Some third-party NVMe drivers (older Samsung NVMe drivers, certain Intel RST configurations) are flagged as incompatible, and Microsoft blocks device encryption. Update the storage driver from the laptop manufacturer's site or switch to the Microsoft-provided Standard NVM Express Controller driver via Device Manager > Storage controllers > [drive] > Update driver > Browse > Let me pick > Standard NVM Express Controller.

Fourth: the machine passes hardware checks and shows the toggle, but clicking it does nothing. Run Windows Update and install all pending cumulative updates — the Device encryption front end has shipped fixes for this exact symptom in multiple 22H2 and 23H2 patches. Check Event Viewer > Windows Logs > System for errors from source BitLocker or TPM with event IDs around the click.

The recovery workflows above are why we recommend saving the recovery key before, not after, clicking the toggle. If the key was never saved and the drive is now encryption-locked, Microsoft support confirms the only reliable paths are recovering the key from the Microsoft account used during encryption or restoring from backup — there is no "backdoor" to BitLocker or device encryption.

FAQ

Does enabling encryption slow down my SSD?

No measurable slowdown in everyday work. On a modern NVMe SSD with AES-NI hardware acceleration on the CPU, BitLocker's XTS-AES 128-bit encryption adds single-digit percentage overhead in synthetic sequential reads and no perceptible latency in application launches. The slowdown people report from older articles originates with 2010-era spinning drives and CPUs without AES-NI — hardware from before roughly 2012. Check for AES-NI in Intel ARK or AMD's product page for your CPU; if it's present, the encryption cost is negligible.

What happens if I lose my recovery key?

If you lose the 48-digit recovery key, you cannot recover data from the encrypted drive after a TPM tamper event or drive removal. Microsoft does not have a master key or backdoor; the company has documented this repeatedly in its BitLocker FAQ. Your options become recovering the key from your Microsoft account if it was escrowed, restoring from a backup, or reformatting and losing the data. This is why we recommend printing the key or storing it in a password manager before completing encryption.

Does upgrading from Home to Pro break existing device encryption?

No. The underlying BitLocker volume stays encrypted and device encryption remains active; only the management interface changes. After the upgrade, you'll see Control Panel > BitLocker Drive Encryption where before you only had the Settings toggle. The recovery key remains escrowed in the same Microsoft account unless you manually move it. One feature you gain is "Suspend protection," useful before the next BIOS update.

Can I enable device encryption without a Microsoft account?

On Windows 11 version 24H2 and later, Microsoft requires the out-of-box-experience setup to be completed with either a Microsoft account or a work/school account, which effectively means no — the local-account path doesn't expose the toggle. On earlier Windows 10 and Windows 11 builds you could occasionally get the toggle with a local account, but the recovery key had nowhere to escrow, and Windows would prompt to link an account after a tamper event. In practice, use a Microsoft account.

Is Device encryption the same as BitLocker?

They use the same encryption engine but offer different control surfaces. Device encryption is the simplified, always-on version for Home users with a single toggle and recovery key stored in Microsoft account. BitLocker is the full enterprise-grade console with password protectors, smart card unlock, network unlock, TPM + PIN combined modes, and group policy management. On Home, only the device encryption front end exists, though the underlying encryption is BitLocker technology.

What's the difference between suspending and disabling BitLocker?

Suspend protection keeps the drive encrypted but allows boot without requiring the TPM or recovery key — reversible in one click. Disable BitLocker fully decrypts the drive, which takes the same duration as initial encryption and removes protection entirely until you re-enable. Use suspend for firmware updates and short troubleshooting windows; reserve disable for retirement, resale, or full drive reformatting. Suspending is dramatically safer than disabling for typical use.

Do external USB drives get encrypted too?

Not automatically. BitLocker To Go is the separate feature for removable drives, available on Windows Pro, Enterprise, and Education (not on Home). On Home, you can encrypt portable drives only with third-party tools like VeraCrypt. If you encrypt a USB drive with BitLocker To Go, the drive will prompt for the password on any Windows Pro or Enterprise machine; Windows Home can read an already-encrypted BitLocker To Go volume with the password but cannot create new encrypted volumes.

Why does Windows ask for the recovery key every time I boot?

The most likely cause is a TPM measurement change — a firmware update, a Secure Boot setting change, or a boot configuration modification. Windows is detecting tampering and requiring the recovery key as a safety measure. Enter the key, boot into Windows, and either suspend BitLocker (Pro) or re-save the recovery key (Home) before making the change again. If the prompt repeats without any system change, check for BIOS/TPM firmware updates or a failing CMOS battery.