# How to force BitLocker encryption on Windows with Hexnode UEM?

**Force BitLocker Encryption** is a remote security action in Hexnode UEM that allows administrators to instantaneously trigger drive encryption on Windows devices using a TPM Startup PIN or a Fallback Password, bypassing the need for user-initiated setup.

**Why Force BitLocker Encryption?**
-----------------------------------

While a standard [BitLocker policy](https://www.hexnode.com/mobile-device-management/help/how-to-manage-bitlocker-with-hexnode-mdm/) defines the requirements for encryption, it often relies on the user to begin the process. The **Force BitLocker** action ensures immediate compliance by remotely encrypting system, fixed, and removable drives to protect sensitive data from unauthorized access or theft.

- **Immediate Protection:** Encrypts drives “over-the-air” without waiting for user action.
- **Security for Stolen Devices:** Renders data unreadable to intruders who lack the Startup PIN or Recovery Key.
- **Customizable Scope:** Allows administrators to target specific drives or only used disk space for efficiency.

**Prerequisites and Critical Configuration**
--------------------------------------------

To ensure the remote action executes successfully, the following conditions must be met:

CategoryRequirementOS SupportWindows 10/11 Pro, Enterprise, or Education editions.Policy SetupIt is highly recommended to deploy a **[BitLocker Encryption Policy](https://www.hexnode.com/mobile-device-management/help/how-to-manage-bitlocker-with-hexnode-mdm/)** before forcing encryption to define preferred recovery and cipher settings.Startup PINMust be allowed/required in the BitLocker policy under **OS Drive Settings > Configure additional startup authentication settings**.ConstraintsThe **Startup Key** and **Recovery Key** must not be set as “Required Options” in the associated policy.**Step-by-Step Guide: Forcing BitLocker Encryption**
----------------------------------------------------

Follow these steps to remotely encrypt Windows drives via the Hexnode portal:

1. Log in to the **Hexnode UEM portal**.
2. Navigate to the **Manage** tab and select the target device.
3. Click on **Actions > Security > Force BitLocker Encryption**.
4. Configure the **Encryption Parameters**:
1. **Disk Space and Drive Selection**
    - **Encrypt used disk space:** Recommended for new PCs; encrypts only current data. New data is encrypted automatically thereafter.
    - **Encrypt entire drive:** Recommended for existing PCs; protects all data, including previously deleted files that could be retrieved by third-party tools.
    - **Drive Scope:** Choose **Encrypt all drives** or specify **Fixed**, **Removable**, or **Specific Drives** (separated by commas).
2. **Authentication and Recovery**
    - **Enable auto unlock:** Automatically unlocks fixed/removable drives when the OS drive is unlocked.
    - **TPM Startup PIN:** Provide a 6-20 digit PIN. This is required every time the system reboots.
    - **Fallback Password:** A minimum 8-character password for devices without a supported TPM.
    - **Mandate and escrow a recovery password:** (Recommended) Ensures a recovery password is generated and stored in the Hexnode portal.

6. Click **Proceed**.

**What Happens at the Device End?**
-----------------------------------

Once the action is initiated:

- BitLocker is enabled based on the configurations in the associated policy (or default Windows settings if no policy exists).
- The drive begins the encryption process in the background.
- The user can verify status by navigating to **Control Panel > System and Security > BitLocker Drive Encryption**.

[![Check encryption statues of the OS drive on the device](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2023/10/Encryption-status-of-the-OS-drive-on-the-device.png "Encryption status of the OS drive on the device")](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2023/10/Encryption-status-of-the-OS-drive-on-the-device.png)**Troubleshooting Guides**
--------------------------

ProblemPotential Root CauseResolutionAction fails: PIN not allowedGroup Policy or Hexnode Policy restricts Startup PINs.Ensure the policy allows **TPM Startup PIN**. If no policy exists, use gpedit.msc to set “Require additional authentication at startup” to Enabled.Encryption doesn’t startStartup Key is set as a “Required Option.”Check your BitLocker policy; if a physical Startup Key (USB) is required, the remote **Force PIN** action will fail.Recovery Password missing“Mandate and escrow” option was unchecked.If unchecked, the device may not generate a key. You must manually retrieve it from the device or re-encrypt with the option enabled.TPM ErrorsDevice lacks a TPM or TPM is not initialized.Use the **Fallback Password** (min 8 characters) to encrypt devices without hardware-based TPM modules.