> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure the BitLocker Library Item

> Set up the BitLocker Library Item in Iru Endpoint to encrypt Windows device drives. Configure encryption methods, recovery options, and escrow keys.

<Callout icon="microsoft" color="#B84A7A" iconType="regular">This Library Item is available for Windows devices</Callout>

The **BitLocker** Library Item lets you configure and enforce BitLocker encryption settings on Windows devices. BitLocker provides full-disk encryption to protect data at rest, ensuring that sensitive information can't be accessed if a device is lost or stolen.

Some configuration options require a Microsoft Entra ID–joined device. Settings are divided into **General**, **System (OS) drives**, **Fixed (internal) drives**, and **Removable (external) drives**.

<Note>
  For more details on BitLocker configuration and requirements, see Microsoft's [BitLocker documentation](https://learn.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-overview).
</Note>

## Create a BitLocker Library Item

To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the [Library Overview](/en/endpoint/library/library-items-profiles/library-overview) article.

<Steps>
  <Step title="Navigate to Library">
    Navigate to the **Library** and select **Add Library Item**.
  </Step>

  <Step title="Select BitLocker">
    Search for and select **BitLocker**.
  </Step>

  <Step title="Name the Library Item">
    Give the Library Item a **Name**.
  </Step>

  <Step title="Assign to Blueprints">
    Assign it to one or more **Blueprints**.
  </Step>
</Steps>

## Settings

### General

* **Require BitLocker encryption**

  Enforces encryption on the device.

* **Prompt user to enable BitLocker**

  * When enabled, users see a prompt to turn on BitLocker.

  <Note>
    Requires an Entra ID–joined device.
  </Note>

* **Configure identification fields**

  Allows you to define identification metadata for BitLocker.

### System (OS) Drives

* **System drive encryption type**

  Defines the encryption method used by BitLocker.

* **Allow BitLocker without a compatible TPM**

  If enabled, requires a startup password or USB drive for authentication on systems without TPM.

* **Startup authentication policy**

  Controls whether BitLocker requires additional authentication (e.g., PIN, USB key) at startup.

* **Permit enhanced PINs**

  Allows enhanced PINs with uppercase, lowercase, numbers, symbols, and spaces.

* **Allow standard users to change BitLocker volume PINs**

  Lets standard users (users without administrator rights on the device) change BitLocker PINs if they know the existing PIN.

* **Allow devices compliant with InstantGo or HSTI to opt out of pre-boot PIN**

  Exempts compliant devices from requiring pre-boot authentication.

* **Required minimum PIN length**

  Sets minimum TPM startup PIN length (4–20 digits, default is 6).

* **Configure system drive recovery options**

  Determines how recovery information is handled when startup keys are missing.

* **Customize recovery screen**

  Optionally customize the recovery message or URL displayed during recovery.

### Fixed (Internal) Drives

* **Require BitLocker for write access to fixed (internal) drives**

  When enabled, fixed drives without BitLocker protection are mounted as read-only.

* **Configure fixed (internal) drive recovery options**

  Defines recovery behavior when credentials are unavailable.

### Removable (External) Drives

* **Allow users to apply BitLocker protection on removable drives**

  Permits users to run the BitLocker setup wizard for removable drives.

* **Allow users to suspend and decrypt BitLocker on removable data drives**

  Lets users pause or remove BitLocker protection for maintenance.

* **Require BitLocker for write access to removable (external) drives**

  When enabled, removable drives without BitLocker are mounted as read-only.

## Considerations

* Enabling strict policies (such as requiring TPM or write access restrictions) may block users from accessing drives until BitLocker is properly enabled.
* Use recovery configuration options to ensure that you can regain access if users forget PINs or lose recovery keys.
* Testing in a small pilot group before broad deployment is recommended.

### Recovery Key Storage

Recovery keys can be stored in different locations depending on the device's configuration and join state:

<AccordionGroup>
  <Accordion title="Active Directory or Microsoft Entra ID">
    When recovery keys are backed up to Active Directory or Entra, you can retrieve them and assist users who are locked out. This requires that the device be **domain-joined** (for AD) or **Entra-joined**.

    <Note>
      Using a centralized directory service (Active Directory or Entra ID) is strongly recommended for enterprise environments so that you can provide recovery assistance.
    </Note>
  </Accordion>

  <Accordion title="Microsoft Account (consumer)">
    Recovery keys can also be backed up to a personal Microsoft account (such as Outlook.com or Hotmail). In this case, only the end user can access the recovery key; administrators cannot retrieve it.
  </Accordion>

  <Accordion title="USB drive">
    Keys saved to USB can be used by the end user to recover their own device, but administrators cannot access these keys centrally.
  </Accordion>
</AccordionGroup>

## Best Practices

<Steps>
  <Step title="Plan your deployment">
    Test BitLocker policies on a small group of devices before rolling out to your entire fleet.
  </Step>

  <Step title="Configure recovery options">
    Set up appropriate recovery key storage options based on your organization's needs and security requirements.
  </Step>

  <Step title="Document policies">
    Clearly document BitLocker policies and recovery procedures for your IT team and end users.
  </Step>

  <Step title="Monitor compliance">
    Regularly check that devices are properly encrypted and compliant with your BitLocker policies.
  </Step>
</Steps>

## Troubleshooting

<AccordionGroup>
  <Accordion title="BitLocker not enabling">
    **Possible causes:**

    * Device not Entra ID–joined (for some features)
    * TPM not available or not enabled
    * Insufficient disk space

    **Solutions:**

    * Verify device join status
    * Check TPM availability in Device Manager
    * Ensure adequate free disk space
  </Accordion>

  <Accordion title="Recovery key not accessible">
    **Possible causes:**

    * Recovery key not backed up to directory service
    * User account issues
    * Network connectivity problems

    **Solutions:**

    * Verify recovery key backup configuration
    * Check user account status
    * Ensure network connectivity for directory services
  </Accordion>

  <Accordion title="Performance issues after encryption">
    **Possible causes:**

    * Encryption process still in progress
    * Hardware limitations
    * Software conflicts

    **Solutions:**

    * Wait for encryption to complete
    * Check device hardware specifications
    * Review installed software for conflicts
  </Accordion>
</AccordionGroup>

<Note>
  For recovery key management, refer to Microsoft's [BitLocker recovery guide](https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview).
</Note>