TopicCybersecurity →
⌚ About 2 min read
Check if Windows volumes are encrypted with BitLocker and know their status.
Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.
Étapes à suivre
-
1
Open Power Shell as admin
Run Windows Terminal with elevation.
-
2
Show BitLocker volumes
Run the volume of the Well-BitLocker.
-
3
Control Protection (2005)
Check if protection is active.
-
4
Save Recovery Keys.
Make sure that the recovery keys are stored in a secure location provided by your organization.
Commands utiles
The number of the units is the same as the number of units.
,-bde -status.
À retenir
- Do not disable BitLocker only to bypass a boot problem without understanding the situation.
- The recovery key must be saved before any sensitive operation.
BitLocker: encryption, protection and protectors are three different states
Technical checkpoints
- A volume can be 100% encrypted while protection is suspended: read EncryptionPercentage and ProtectionStatus separately.
- TPM, PIN, recovery key or password protectors determine how the volume can be unlocked.
- Before BIOS/firmware or boot changes, temporarily suspending BitLocker can avoid an unexpected recovery prompt without decrypting the disk.
Readable check
Compare status using manage-bde and the PowerShell BitLocker objects.
manage-bde -status C:
Get-BitLockerVolume -MountPoint C:Topic-specific pitfalls
- Never disable or remove a protector before confirming an accessible recovery key exists.
- Suspended protection does not mean the volume is decrypted.
How to validate
- The volume is FullyEncrypted, ProtectionStatus is On and expected protectors are present.
- The recovery key is stored in the intended location before any risky operation.