How to know every laptop is actually encrypted
If a laptop is lost, drive encryption is what keeps the files private. The problem is that "turned on" and "protecting the drive" are not always the same thing.
Three states that look fine but are not
- Encryption paused, often after a firmware or BIOS update, and never resumed.
- Encryption started but not finished, which leaves part of the drive readable.
- Encrypted, but with no recovery key saved anywhere you can find it.
What to check on each device
- Is the system drive fully encrypted?
- Is protection on, not paused?
- Is there a recovery key, and is it stored in your directory or management tool?
WIN-006 BitLocker Status Check reports all three for the system drive and returns a clear exit code that a monitoring tool or scheduled task can alert on. It changes nothing. It is part of the free sample.
The matching item
WIN-006 BitLocker Status Check
Confirms the system drive is encrypted with BitLocker and has a recovery password.