Encrypting a Company Laptop: BitLocker, Keys and a Lost Machine

The laptop was left on a train seat, or in a car in the Vaňkovka car park. A few hours later the employee calls in and a question lands that the company should be able to answer within a minute: was that drive encrypted?

When the answer is “I think so,” that is a bad answer. And when someone adds “and the key is in an account somewhere, isn’t it?”, that is worse still. Encrypting a company laptop is not a click of a button — it is a record that has to hold up at the moment the device is no longer in your hands.

Quick answer: BitLocker protects data stored on the drive when the device is not in an active, unlocked session — typically after shutdown, during hibernation, or once the drive has been removed. It does not protect data available in a system that is currently unlocked. For the protection to work, three things must be true: encryption is genuinely active (verify with manage-bde -status, not by gut feeling), the recovery key is stored with the company — in Microsoft Entra ID, Active Directory or the company password manager, not just in the employee’s personal account — and there is a written procedure for a loss that a colleague can follow while the IT admin is on holiday. Everything else — phishing, malware, data already synced to OneDrive — is not something BitLocker solves.

What encryption solves and what it does not

Disk encryption has one specific purpose: it protects data at the moment the device leaves your physical control. A stolen laptop, an SSD pulled out and plugged into another computer via an adapter, a drive handed in for repair without being wiped. Without the key, the content is unreadable.

Outside that scenario, BitLocker does nothing. If the laptop is left unlocked on a café table, the attacker works with the files exactly as the employee would — at that moment the drive is unlocked and, as far as the system is concerned, encryption does not exist. Likewise it does not stop phishing, malware, or access to data already synced to OneDrive or SharePoint. That data lives in the cloud, not on the drive, and it is protected by the account password, not by BitLocker.

That is why the same package has to include things that seem unrelated to encryption at first glance:

• automatic screen locking after a few minutes of inactivity,
• an employee account without administrator rights for everyday work,
• a Windows Hello PIN or a strong password,
• two-factor authentication on company accounts,
• a working backup of work data,
• a clear procedure for who to report a loss to and how.

And one thing that trips up most companies: BitLocker is not a backup. An encrypted SSD dies just as readily as an unencrypted one — except that without the recovery key you also lose any chance of getting the data off it. When an SSD starts to fail and what to do before it happens is covered in SSD failure: warning signs.

Is BitLocker enough, or do you need something else?

For a small Windows-based company, BitLocker is a sensible default. In the Windows Pro, Enterprise and Education editions it is part of the system, and recovery information can be stored centrally in, for example, Microsoft Entra ID or on-premises Active Directory.

The catch is the edition. BitLocker with full management is found in Windows Pro, Enterprise and Education. Windows Home does not have it in this form; some Home devices offer the simpler Device Encryption, which turns itself on with suitable hardware once you sign in with a Microsoft account. It does protect the data, but the company does not get the same level of control — which is why, for employee laptops, it pays to insist on Windows 11 Pro at the point of purchase. Paying for edition upgrades afterwards on five machines is needless extra work. The edition differences and the conditions for both variants are described in Microsoft’s BitLocker documentation.

Before you turn encryption on, go through five points:

• Windows edition and activation — find out whether you have full BitLocker in Windows Pro, Enterprise or Education, or the automatic Device Encryption available on eligible devices including Windows Home,
• TPM chip status — check via tpm.msc; Windows 11 requires TPM 2.0, while BitLocker itself can use boot integrity as far back as TPM 1.2. Without a TPM, BitLocker can be configured with a startup key on removable media, but for an ordinary company laptop that is not a standard, convenient deployment,
• Secure Boot and firmware — Secure Boot is a recommended additional layer; BIOS/UEFI or firmware changes can trigger recovery, so suspend BitLocker before a planned update and re-enable it once it is done,
• all internal drives — laptops with an SSD for the system and a second drive for data typically have only the system drive encrypted,
• where the key will be stored — decide that before you click “Turn on”.

Then verify the status properly, not by eye: in Control Panel under BitLocker Drive Encryption, with the manage-bde -status command, or in PowerShell via Get-BitLockerVolume. The percentage column must show encryption completed and protection switched on — on a freshly enabled BitLocker the initial disk encryption can easily run for tens of minutes, and until then the protection is not complete. The assumption that “a new laptop is encrypted, surely” is one of the most common mistakes; on some models it holds, on others it does not, and only that command gives you certainty.

Where recovery keys belong

The recovery key is an emergency 48-digit numeric code. Windows asks for it the moment something on the path to booting the system has changed from its point of view — a UEFI firmware update, a BIOS setting change, clearing or replacing the TPM, a motherboard swap, sometimes even connecting a new bootable device. It is not a fault, it is a defensive reaction.

For a company device, a simple rule applies: the company must control the key, not just the employee.

Both Microsoft Entra ID and on-premises Active Directory can store recovery information tied to a specific device — that is the whole difference compared with a folder full of files. Intune additionally lets you control permissions and force a change of the recovery password after it has been used. The company storage options and the recovery procedure are described in the BitLocker recovery overview.

Where the key definitely does not belong:

• in a text file on that same encrypted laptop (a classic that works right up to the moment you need it),
• on a label stuck to the underside of the device,
• in the laptop bag,
• only in the employee’s personal Microsoft account,
• in a shared spreadsheet or an email the whole company can reach.

For every key, record the computer name, serial or asset number, the user and the recovery key identifier — that is exactly what you search by in a crisis. Six files named “BitLocker Recovery Key.txt” in the same folder are, from a recovery standpoint, almost as useful as none at all.

If you are already in the situation of hunting for a key and not finding it, work through the steps in You can’t find the BitLocker key: what to check before writing the drive off. And if the machine has locked itself and wants the key on a blue screen right now, start with BitLocker drive won’t unlock.

For a laptop that is not company-managed and is therefore under a personal Microsoft account, you will find the key after signing in at aka.ms/myrecoverykey. When BitLocker is being turned on, Windows also offers to save the key to a USB drive or print it — both are worth doing alongside storing it in the account, not instead of it.

TPM alone, or TPM with a startup PIN?

The usual deployment uses BitLocker with a TPM. The laptop boots without asking, the chip releases the key, and the employee only enters their Windows sign-in. For an office laptop that is generally the right compromise — it protects against the “stolen machine that was switched off” scenario and annoys nobody.

The second option is TPM plus a startup PIN, entered before Windows even loads. It adds protection against more advanced attacks on a physically stolen computer, because the TPM alone will not release the key until the correct PIN arrives. The price is another password that employees forget — and a forgotten startup PIN leads straight to the recovery key. It makes sense on machines that genuinely carry sensitive data: accounting, medical records, client project data.

Connected to this is how the laptop travels. In sleep, the system session and part of the sensitive data stay in RAM and the drive is effectively unlocked — which is why Microsoft recommends hibernation or a full shutdown for higher-risk devices, so that protection takes effect again at the next boot. An overview of these measures is in the BitLocker countermeasures documentation. In practice it means one single change of habit: shut the laptop down before travelling, don’t just close the lid.

Preparing a laptop before handing it to an employee

Encryption belongs before company documents are loaded onto the machine, not after. The handover check should have at least these ten steps:

1. Record the manufacturer, model, serial and asset number.
2. Assign the laptop to a specific employee and handover date.
3. Update Windows, drivers and firmware/UEFI — a later firmware update is a classic trigger for a recovery key prompt.
4. Check the TPM (tpm.msc) and enable Secure Boot.
5. Create a separate administrator account the company has access to.
6. Set the employee up as a standard user, not an administrator.
7. Turn BitLocker on for both the system and the data drive.
8. Verify that the recovery key is stored from another device or from the administrator account — not from that laptop.
9. After a restart, check the encryption status again (manage-bde -status).
10. Configure automatic locking, Windows Hello and a backup of work data.

Point 8 is the one that breaks down in practice. “The key was saved” and “I saw the key from another computer” are two different claims, and only the second one is verification.

One extra technical choice: on a new or securely wiped drive it is enough to encrypt used space only — it is faster. On a laptop being reassigned from another employee, encrypt the whole drive, because remnants of earlier data can survive in the free space and would otherwise not get encrypted.

The handover record should also cover who to report a loss to and how. The instruction “get in touch once you’re sure you won’t find the laptop” is a recipe for losing half a day during which something could still be done about access.

If you would rather not handle this yourselves, securing computers in a small company sets out the wider framework — and if you just need the configuration done on specific machines, get in touch and we will go through it with you.

What to do after a loss or theft

A company needs a short list of steps that even someone who is not the IT admin can follow. In this order:

1. Write down the facts. Who was using the device, when it was last seen, and above all: was it switched off, asleep, or unlocked? The whole risk assessment rests on that single question.
2. Verify encryption against your records. Was the drive genuinely encrypted, and can the key be located? This is the moment you find out whether anyone really did step 8 from the previous section.
3. Revoke the sign-in. Sign the employee out of all sessions of company services and force a new sign-in — not just change the password, but kill the active tokens.
4. Remove the device from two-factor authentication if it served as an authentication factor.
5. Block the device’s access to company accounts and applications.
6. On a managed laptop, send the wipe command if your management platform supports it.
7. Document what data the user had access to — including synced cloud folders and locally stored exports.
8. Report the theft to the police and, depending on your policy terms, to the insurer.
9. Hand the incident to the person responsible for personal data protection so they can assess whether any further obligations follow.

A remote wipe is a useful second layer, but never the main protection. The command only runs once the laptop connects to the internet — and whoever stole it for the data will not connect it to a network, or will simply pull the drive out. The available remote actions, including wipe and BitLocker key rotation, are described in the Microsoft Intune documentation.

If the laptop turns up, do not automatically plug it back into the company network. First check the device state, the sign-in events and any configuration changes. A recovery key that has been used or shown to several people in the meantime should be replaced with a new one — from a security standpoint it is now public information.

On company machines this falls under company IT management. A related step is data recovery in Brno.

When BitLocker starts asking for the recovery key

A blue screen asking for the key does not, in itself, mean someone has attacked you. In most cases the cause is something entirely mundane: a UEFI change, a firmware update, a TPM problem, a change to boot files, or a hardware repair. BitLocker did exactly what it exists for — it noticed a change on the path to the system and locked.

The practical procedure: copy the key identifier from the screen (the short code above the entry field) and use it to find the matching record in your register. Do not try keys from other laptops and, above all, do not clear the TPM “to make it boot” — clearing the TPM without a stored key is the fastest route to permanently inaccessible data.

And one lesson for company IT management: if you are only looking for the key at the point of failure, it means nobody verified that it had been stored when the laptop was handed over.

What it costs and what the result should be

The cost of the setup depends on the number of laptops, the Windows edition, the TPM status, how keys will be stored and whether you want central management. The specific scope and price can only be determined after an initial check of editions, TPM, accounts, existing encryption and backups: five laptops on Windows Home are a different job from five machines already joined to Microsoft Entra ID and Intune.

Have the quote itemise separately:

• any Windows upgrade to the Pro edition,
• configuration of one device,
• setting up the key register and storage,
• configuration of Microsoft Entra ID or Intune,
• a recovery test and handover documentation,
• management of additional laptops and removal of access when an employee leaves.

You recognise work done properly by the output, not the invoice: you get a list of devices, a confirmed encryption status for each of them, traceable recovery keys, documented permissions and a brief procedure for both loss and recovery. If the technician merely switched BitLocker on and left the key with the employee, the company has solved nothing — it has just added one more way to lose its data.

In Brno, at your place or at our workshop, we will go through the Windows editions, TPM status, current accounts and backup arrangements on all your machines. Only then does it make sense to decide whether a one-off setup is enough or whether central management through Intune is worth it.

Order online: Company IT management — tell us the model and what happens, and we will come back with the next step.