Is BitLocker on by default? How Windows device encryption works

Sometimes. Windows device encryption turns BitLocker on automatically on qualifying devices, but the drive is only truly protected once a recovery key is backed up. A laptop that uses only a local account can have encrypted data and still be unprotected. Check the state instead of assuming.

What device encryption is

Microsoft describes device encryption as a way for some devices to enable BitLocker automatically. It is available on all Windows versions and, until recently, required the device to meet Modern Standby or HSTI security requirements, with no externally accessible DMA ports.

Starting in Windows 11, version 24H2, those DMA and HSTI or Modern Standby prerequisites are removed, so more devices qualify.

It encrypts the OS drive and fixed drives. It does not encrypt external or USB drives.

The suspended state to watch for

After a clean install and first setup, the OS drive and fixed drives are encrypted with a clear key. Microsoft says this is the equivalent of standard BitLocker in its suspended state, and Explorer shows a warning icon on the drive.

The warning goes away once a TPM protector is created and the recovery key is backed up. Where it is backed up depends on the account:

• Microsoft Entra joined or Active Directory domain joined: the key goes to Entra ID or AD DS.
• Not joined to either: a Microsoft account with administrative privileges must sign in, and the recovery key is uploaded to that account.
• Local accounts only: Microsoft says the device remains unprotected even though the data is encrypted.

That last case is the one developers hit. A freshly set up laptop with a local account looks fine and is not.

How to check your machine

1. Open System Information by running msinfo32.exe.
2. Look for the line Device Encryption Support. If your device qualifies, it reads Meets prerequisites.
3. Open Settings and find the device encryption panel. Microsoft notes the Settings page does not show it as enabled until encryption is complete.
4. Look at the drive in File Explorer. A yellow warning icon means the clear key is still in place.

If the device is not on that list, check whether a full BitLocker setup is available on your Windows edition. Microsoft lists Pro, Enterprise, Pro Education and Education as supporting BitLocker enablement.

Settings that matter

By default, device encryption uses XTS-AES 128-bit. Microsoft says that if you need a different method and the device is already encrypted, it has to be decrypted first. If your organisation has a required cipher strength, set the policy before the first sign-in, not after.

Microsoft recommends keeping device encryption on for any system that supports it. There is a registry value, PreventDeviceEncryption under the BitLocker key, that stops the automatic process. Leave it alone unless you have a documented reason.

Also note a behaviour that can confuse you: if device encryption is turned off, it will not turn itself back on later. You would need to enable it manually.

Where this leaves a developer laptop

Do three things. Sign in with an account that can back up the recovery key. Confirm the warning icon is gone. Store a note of where the recovery key lives, because you will need it after a firmware change or a motherboard swap.

For dependency risk on the code on that laptop, you can run Safeguard's free scan at gold.safeguard.sh/scan. It does not replace disk encryption.

Quick check

Sources

• BitLocker overview (Microsoft Learn)

Last reviewed: 19 October 2026.