How to Enable BitLocker for Your Entire Drive Using Command Prompt

BitLocker is Windows’ built-in encryption tool that protects your data from unauthorized access. While you can enable it through the graphical interface, using Command Prompt gives you more control and is faster once you know the commands.

This guide walks you through enabling BitLocker for your entire disk using manage-bde — right from the Command Prompt.

Prerequisites

Before you begin, make sure of the following:

• You are running Windows 10 Pro, Enterprise, or Windows 11 (BitLocker is not available in Windows Home).
• You have administrative privileges on your PC.
• For the system drive (C:), your computer should have a TPM (Trusted Platform Module) chip, or you must configure a PIN/password protector.

Open Command Prompt as Administrator:

1. Press Win + X → select Terminal (Admin) or Command Prompt (Admin).
2. Click Yes if prompted by User Account Control (UAC).

Step 1: Check Current BitLocker Status

First, see what drives are available and their current encryption status:

manage-bde -status

This shows each drive and whether BitLocker is FullyEncrypted, EncryptionInProgress, or ProtectionOff.

Step 2: Enable BitLocker on Your Drive

For the System Drive (C:)

Run the following command:

manage-bde -on C: -usedspaceonly

What this does:

• On → Enables BitLocker.
• C: → Applies it to your main drive.
• -usedspaceonly → Encrypts only the space currently in use (faster). If you prefer to encrypt the entire drive including free space, simply remove this flag.

To encrypt the full disk with no flags:

manage-bde -on C:

For Data Drives (e.g., D:, E:)

manage-bde -on D:

Replace D: with your target drive letter.

Step 3: Set Up a Protection Method

After enabling encryption, you must add a “protector” — basically, the method used to unlock your drive.

Option A: Password (Most Common)

manage-bde -protectors -add C: -Password

ou’ll be prompted to create and confirm a password.

Option B: TPM + PIN (For System Drives)

If your PC has TPM and you want extra security:

manage-bde -protectors -add C: -TPMAndPIN

Enter your desired PIN when prompted.

Option C: Recovery Key

Including a recovery key is highly recommended in case you forget your password or lose access:

manage-bde -protectors -add C: -RecoveryPassword

Step 4: Verify and Monitor Progress

Check the current status and active protectors:

manage-bde -status C:

You should see:

• Conversion Status: 100% Complete when done
• Protection Status: On
• Key Protectors: TPM, Password, or Recovery Password (your configuration)

Step 5: Enable Automatic Unlock for Data Drives (Optional)

If you have a secondary drive you want to unlock automatically each time you sign in:

manage-bde -autounlock -enable D:

Important Notes

Backup your recovery key! Without it, you may permanently lose access to your data if you forget your password or change hardware.

# Check status
manage-bde -status

# Enable encryption
manage-bde -on C:

# Add password protection
manage-bde -protectors -add C: -Password

# Add recovery key
manage-bde -protectors -add C: -RecoveryPassword

# View all protectors
manage-bde -protectors -get C:

# Enable auto-unlock for data drive
manage-bde -autounlock -enable D:

Enabling BitLocker via Command Prompt is straightforward and gives you precise control over your encryption settings. Whether you’re securing your system drive or an external backup disk, these commands let you get the job done efficiently — no GUI required.