>

Turn On BitLocker Encryption with PowerShell

Encrypt your drive with BitLocker from the command line and get a recovery password.

WindowsbitlockersecurityencryptionMedium risk
Run Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -RecoveryPasswordProtector in an admin PowerShell.

01Command

Command
$ Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -RecoveryPasswordProtector

02What it does

BitLocker encrypts the whole drive so a thief can't read your files from another machine. -UsedSpaceOnly encrypts just the used blocks, letting the drive stay usable during the first (much faster) pass, and -RecoveryPasswordProtector generates the 48-digit key that unlocks the drive if the TPM can't. The recovery password prints to the console — back it up immediately.

03Risk

RiskMedium risk
RequirementsWindows Pro/Enterprise/Education, a TPM chip, and administrator PowerShell. Save the 48-digit recovery key somewhere safe — without it you cannot unlock the drive after hardware changes.
!Warning: Losing the recovery password can mean losing all data after a motherboard or TPM change — save it to your Microsoft account or print it before continuing.

04Undo

Undo
$ Disable-BitLocker -MountPoint "C:"

05Sources

  • Enable-BitLocker
    Microsoft Learn · vendor-doc · 2026-09-17
    Evidence: Documents the MountPoint, EncryptionMethod, UsedSpaceOnly and RecoveryPasswordProtector parameters for turning on BitLocker encryption.

Last verified: 2026-09-18 · Category: Security & Privacy

06Related solutions

Fix 'scripts is disabled on this system' with Set-ExecutionPolicy
WindowsTerminaldevelopersecurity

Understand PowerShell's execution policy scopes and set the one that lets you run your own local scripts without gutting the security model.

Medium risk ✓ 2026-09-17
Take ownership of a file or folder with takeown and icacls
WindowsFilessystemsecurity

Two-step command sequence that makes you the owner of a locked file tree and grants yourself full control — the standard fix for 'Access is denied' on old profiles and OS reinstall leftovers.

High risk ✓ 2026-09-17
Verify File Hashes with certutil -hashfile
Windowshashcmdsecurity

Built-in Windows command to compute MD5, SHA1 or SHA-256 hashes of any file.

Low risk ✓ 2026-09-17