W02 – Turn on BitLocker protection

Use this when the Windows check shows W02 NOT DETECTED, including the case "encrypted but no key protector, protection off".

Tested path (admin PowerShell, tested on a real PC on 31 Oct 2026)

1. Check that the TPM is ready:

   Get-Tpm

   TpmPresent and TpmReady must both be True. If not, stop and ask us.
2. Add a recovery password:

   manage-bde -protectors -add C: -RecoveryPassword

3. Save the recovery password off this PC (printed copy kept locked away, or your Microsoft account). Show it with manage-bde -protectors -get C:. Check you can read it from another device.
4. Add the TPM protector:

   manage-bde -protectors -add C: -TPM

5. Turn protection on:

   Resume-BitLocker -MountPoint C:

6. Confirm:

   manage-bde -status C:

   Look for Protection Status: Protection On.
   SCREENSHOT PLACEHOLDER – no image yet: img/guides/bitlocker-04.png
   manage-bde output showing Protection On

Settings path (not yet tested; screenshots to come from the test VM)

1. Open Settings → Privacy & security → Device encryption (Windows 11 Home) or Control Panel → BitLocker Drive Encryption (Pro/Enterprise).
   SCREENSHOT PLACEHOLDER – no image yet: img/guides/bitlocker-01.png
   BitLocker Drive Encryption window for drive C:
2. First back up the recovery key: choose Print or Save to your Microsoft account. Do not keep the only copy on this PC.
   SCREENSHOT PLACEHOLDER – no image yet: img/guides/bitlocker-03.png
   Back up your recovery key options
3. Then click Turn on BitLocker (or Resume protection).
   SCREENSHOT PLACEHOLDER – no image yet: img/guides/bitlocker-02.png
   Turn on / Resume protection button

Describes settings detected at the time of the check. Not an audit, not a certification, not legal advice. Back to all fix guides.