Fix Volume With BitLocker Waiting for Activation on Windows 11

If you see “BitLocker waiting for activation” on a volume in Windows 11, the drive is not yet encrypted and BitLocker is not actively protecting it. The fix is to enable BitLocker on that volume, either by turning on the feature in the Control Panel or by running a single command in an elevated PowerShell or Command Prompt window.

What “Waiting for Activation” Means

BitLocker Drive Encryption is a Windows feature that encrypts entire volumes to protect data if the device is lost or stolen. When a volume shows “Waiting for activation” in the BitLocker Management console, it means that BitLocker has been prepared for that drive but has not been turned on yet. This status commonly appears on new computers where the manufacturer enabled the necessary TPM (Trusted Platform Module) and pre-provisioned BitLocker, but the actual encryption process has not been started. Until you activate it, the drive remains fully readable without any encryption, so the status is a warning rather than an error.

Why Windows Shows This Status

There are several reasons why a volume might be in this state:

Pre-provisioned by the manufacturer: Many OEM systems come with BitLocker enabled on the OS drive but the user has not yet activated it.
Group Policy settings: In enterprise environments, a policy may require BitLocker but the drive has not been encrypted yet.
TPM not initialized: If the TPM is not ready, BitLocker may show waiting status until the TPM is cleared or initialized.
After a Windows update or feature update: Sometimes the status appears after a major update, but the encryption is actually still in progress or paused.

How to Activate BitLocker on the Volume

Activating BitLocker is straightforward. You can use the graphical interface or a command-line tool. Here are the steps for both methods.

Method 1: Using the Control Panel

Open Control Panel and go to System and Security > BitLocker Drive Encryption.
Find the volume that shows “BitLocker waiting for activation.”
Click Turn on BitLocker next to that drive.
Choose how you want to unlock the drive (usually a password or a smart card, or automatically with TPM).
Choose where to save your recovery key (Microsoft account, USB drive, or file).
Select Encrypt entire drive (recommended) or Encrypt used disk space only.
Click Start encrypting. The encryption runs in the background and you can continue using the computer.

Method 2: Using Command Line (PowerShell or CMD)

Open an elevated PowerShell or Command Prompt (right-click Start and choose Windows Terminal (Admin) or Command Prompt (Admin)).
Run the following command to enable BitLocker on the C: drive (replace the letter with your drive):
Manage-bde -on C:
If you want to use a password protector, add:
Manage-bde -protectors -add C: -Password and then follow the prompts.
If you want to use TPM only, run:
Manage-bde -protectors -add C: -TPM
After adding a protector, run Manage-bde -on C: again to start encryption.

Note: The command-line method requires you to add a protector first; otherwise, BitLocker may not start. The graphical method walks you through this automatically.

What to Do If Activation Fails

Sometimes clicking “Turn on BitLocker” does nothing or gives an error. Here are the most common issues and how to resolve them:

TPM not ready: Check in Device Manager under Security devices that the TPM is present and working. If it shows an error, you may need to clear the TPM from the BIOS/UEFI (this will not erase your data, but you may need to re-enable BitLocker afterward).
Group Policy blocks encryption: In Windows 11 Pro/Enterprise, a local or domain policy might require a specific encryption method or disallow the use of a password. Open gpedit.msc and navigate to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives to check the settings.
Insufficient disk space: BitLocker needs a small system partition (usually 100-500 MB) to store boot files. If that partition is missing or too small, activation may fail. You can use the Disk Management tool to check.
BitLocker service disabled: Ensure the BitLocker Drive Encryption Service is running. Open Services (services.msc), find “BitLocker Drive Encryption Service,” and set its startup type to Automatic and start it.

Common Misconceptions

A frequent misunderstanding is that “waiting for activation” means the drive is partially encrypted or that BitLocker is already protecting it. In reality, the drive is completely unencrypted until you activate it. Another misconception is that you need to decrypt the drive first if you see this status after a Windows update. In most cases, the encryption is simply not started, and you can activate it directly. Also, some users think that turning on BitLocker will slow down their system significantly; modern CPUs with AES-NI instructions handle encryption with minimal performance impact, usually less than a few percent.

Should You Activate BitLocker or Leave It Off?

If you are on a laptop or any device that could be stolen, activating BitLocker is strongly recommended because it prevents unauthorized access to your files without the recovery key. For desktop PCs that never leave your home, the need is less urgent, but it still protects against physical theft of the drive. However, if you forget your password and lose the recovery key, your data is permanently inaccessible. So always back up your recovery key to a safe place (ideally not the same device). If you use a Microsoft account, the key is automatically backed up to your account, which is convenient.

Frequently Asked Questions

Q: How long does BitLocker encryption take?

Encryption time depends on the drive size and the amount of data. On a modern SSD, encrypting a 256 GB drive can take anywhere from a few minutes to an hour. On a large HDD, it can take several hours. You can continue using the computer during encryption, but performance may be slightly lower.

Q: Can I use BitLocker on Windows 11 Home?

BitLocker is not available on Windows 11 Home. If you have Home edition, you will not see the BitLocker option in Control Panel. You can only use BitLocker on Pro, Enterprise, or Education editions. Alternatively, you can use the built-in “Device Encryption” feature that is available on some Home devices, which is a simplified version.

Q: What is the difference between BitLocker and Device Encryption?

Device Encryption is a streamlined version of BitLocker that is automatically enabled on many modern Windows 11 devices that support InstantGo or Modern Standby. It encrypts the system drive and uses your Microsoft account to store the recovery key. BitLocker offers more control, such as encrypting additional drives and using different unlock methods. If you see “Device encryption” in Settings, it is already active; if you see “BitLocker waiting for activation,” it is not.

Q: Will activating BitLocker erase my files?

No, activating BitLocker does not erase any files. It encrypts the drive in place, meaning your data remains intact. The process is non-destructive. However, it is always wise to back up important files before enabling encryption, just in case of unexpected issues.

Q: Can I turn off BitLocker after it’s activated?

Yes, you can decrypt the drive at any time by going to BitLocker Drive Encryption in Control Panel and selecting “Turn off BitLocker.” This will decrypt the drive and remove all protections. The process takes as long as the encryption did, and you will be asked to confirm that you want to decrypt.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →