Company Laptop Stolen: Was BitLocker On? How to Check Every Device

Say a sales manager’s laptop disappears at the airport. It holds price lists, customer contracts and years of Outlook mail. The first question is not “how bad is this”, it is “was the disk encrypted?” If yes, you have lost a piece of hardware. If no, whoever picks it up can pull the drive, plug it into another machine and read everything, no Windows password needed.

A Windows password does not protect the disk. It is the misunderstanding I run into most often.

What does BitLocker actually protect?

BitLocker encrypts the whole volume. Microsoft’s own documentation states the goal plainly: preventing data theft or exposure from lost, stolen or improperly decommissioned devices. The key sits in the machine’s TPM chip. If the drive is moved to another computer, the key does not travel with it and the data stays unreadable.

It does not cover everything. If a laptop is taken while running and unlocked, or a user clicks a malicious link, encryption does nothing. It closes one scenario: physical access to a powered-off device. That scenario happens to describe nearly every lost laptop.

Does Windows 11 turn encryption on by itself?

Partly. Windows has a feature called device encryption that starts BitLocker automatically on eligible hardware. Since Windows 11 24H2, the old prerequisites (Modern Standby, DMA port restrictions) were dropped, so more devices qualify.

The catch is where the recovery key ends up:

Device state	Where the recovery key goes	Data protected?
Joined to Microsoft Entra (signs in with a work account)	Backed up to Entra ID automatically	Yes
Joined to an Active Directory domain	Backed up to AD DS (if the policy is enabled)	Yes
Admin signs in with a Microsoft account	Uploaded to that person’s Microsoft account	Yes, but the key sits in an employee’s personal account
Local account only	Not backed up	Per Microsoft’s documentation the device stays unprotected

The third row is the sneaky one. If an employee set up the laptop with a personal Microsoft account, your company has no access to the recovery key. When that person leaves, or the laptop asks for a 48-digit number after a firmware update, you have nothing to type.

A seven-minute check per device

For every laptop in the inventory I look at three things:

1. Encryption status. In an elevated command prompt run manage-bde -status. You want “Protection Status: Protection On”. “Protection Off” or “Fully Decrypted” means the device is exposed.
2. Eligibility. In msinfo32, the “Device Encryption Support” line should read “Meets prerequisites”. Without a TPM, BitLocker still works but demands a startup key on a USB drive, a setup almost nobody uses in practice.
3. Key location. Open the device in the Entra admin center (or Intune) and confirm a BitLocker key is listed. If it is not, you have no recovery path, even with encryption on.

By hand, fifty laptops take half a day. With one Intune policy and a report it is a matter of minutes, and it applies itself to every new device.

When does the recovery screen appear?

One day an employee calls: “my laptop wants a 48-digit key.” Usually nothing is broken. The system is doing its job. Microsoft’s list of triggers includes BIOS or UEFI updates, disabling or clearing the TPM, a motherboard swap, a changed boot order, repeated wrong PIN entries and moving the drive to another machine.

Before a planned firmware or hardware update, suspend BitLocker protection first. The disk stays encrypted, protection resumes afterwards, and nobody is asked for the key. Support teams that skip this step lose half an hour hunting for keys after every BIOS update.

TPM only, or TPM plus PIN?

The default setup uses the TPM alone: the device boots, the chip releases the key, the user lands on the Windows sign-in screen. It is convenient, though a determined attacker faces no extra barrier. Adding a PIN asks for a second check at boot.

My view: for general office users TPM-only is enough, because the goal is “a lost laptop must not be readable”. Consider a PIN for finance, legal, executives and people who travel constantly. Forcing a PIN on every device just turns into a help desk call every morning.

What to do when a device is stolen

• Lock or wipe it remotely from Intune and revoke the account’s sessions.
• Confirm encryption was on and that you hold the key. Everything after this depends on it.
• If the device held personal data and was not encrypted, the KVKK (Türkiye’s data protection law) breach notification clock of 72 hours applies. Being able to show a record that encryption was on makes the assessment far easier.
• If the browser stored passwords, reset the user’s account passwords.

Frequently asked questions

Does Windows 11 Home support BitLocker? Full BitLocker management is a Pro-and-above feature. Home only offers device encryption on eligible hardware, with limited controls. Use Pro on company devices.

Does encryption slow the laptop down? Modern processors accelerate it in hardware, so day-to-day use feels the same. The disk is busy for a short while during the first encryption pass.

Are USB drives encrypted too? Device encryption covers the operating system and fixed drives only. Removable drives need BitLocker To Go configured separately.

Who should be able to see the recovery key? A small group: the IT administrator and the help desk. Whoever holds a key can open all data on that device, so keep it away from the device and access-logged.

If you do not know how many of your laptops are encrypted, or how many keys are sitting in Entra, an inventory is a good place to start. Get in touch and we will go through your device list together.