Frequently Asked Questions
What's the difference between Used Space Only and Full Volume encryption?
Used Space Only encrypts only the disk space currently in use, which is faster on
a new or lightly used drive. Full Volume encrypts every sector, including space
that appears empty, which takes longer but leaves nothing unencrypted, including
data that was deleted but not yet overwritten. See
[how to enable and manage BitLocker disk encryption](/learn/disk-encryption/how-to-enable-and-manage-bitlocker-disk-encryption)
for where each option is set in the policy.
What happens if a device doesn't have a TPM?
With TPM Protection Mode set to TPM Only, encryption depends on the device
having a usable TPM. The alternative setting, Allow Without TPM, lets a policy
still encrypt a device that lacks one, typically backed by a password or
external key instead of the chip.
Where do I find a drive's recovery key?
Recovery keys are listed in BitLocker Recovery Keys, showing the endpoint,
drive, a Recovery Key ID, and whether that key is currently Active. A drive can
accumulate more than one key over time, for example after a rotation, but only
one is marked Active at a time.
Why would a drive have more than one recovery key on record?
Recovery Key Rotation, if enabled on the policy, generates a new key on the
configured rotation period. Older keys stay on record for reference, but only
the most recent one is marked Active.
How do I reverse encryption on a drive?
Create a second BitLocker Deployment with Deployment Type set to Decrypt,
targeting the same endpoint, and publish it. Progress counts down on BitLocker
Status until Encryption Status reads Fully Decrypted and the deployment's Stage
shows Completed.
How can I confirm exactly what a BitLocker deployment did on an endpoint?
Open the task and check its Output, which logs each step, including TPM status,
detected OS, which drives were already in the target state, and the live
progress percentage as encryption or decryption ran.
