Swif’s BitLocker policy lets you configure and enforce encryption on Windows 10+ devices. This guide covers TPM-based encryption, Force Without TPM scenarios, where to find passwords/recovery keys, and frequently asked questions.
Overview
BitLocker is a built-in encryption feature for Windows 10 Pro, Windows 11 Pro, and above.
Swif’s BitLocker Policy configures which drives to encrypt and whether to force a password when no TPM is detected.
Recovery Keys are automatically stored in your Swif console/device details for safekeeping.
Requirements
Supported OS
Windows 10 Pro or Enterprise, Windows 11 Pro or Enterprise, or Education equivalents.
Swif Desktop Agent
Must be installed and running on the device.
Note: Windows Home editions do not support full BitLocker management and typically appear as ineligible for this policy.
BitLocker Behavior with TPM vs. Non-TPM Devices
When deploying a BitLocker policy or sending a Device Lock command, the behavior depends on whether the device has a Trusted Platform Module (TPM) enabled.
1. Devices with TPM (TPM = ON)
Encryption: Once the policy is deployed with Force Without TPM: false, the C: drive is encrypted automatically.
Recovery: The recovery key is escrowed and becomes visible in the Swif WebApp.
User Experience: The user is not prompted for a password or recovery key during normal restarts after encryption is complete.
2. Devices without TPM (TPM = OFF)
What is TPM = OFF
Policy Requirement: To encrypt a non-TPM device, the policy must have Force Without TPM: true enabled. If this is set to
false, encryption will not proceed.Device Lock & Password Prompt: When a Device Lock command is sent to a non-TPM device (or when the policy is first applied), the Swif Windows desktop app will display a TPM password prompt. Learn more at Windows Device Lock/Unlock Behavior with BitLocker Policies.
Encryption Process:
Encryption will not start until the user enters a password.
Once entered, the password and the recovery key are both escrowed to the Swif WebApp.
Boot Behavior: The user will be required to enter this TPM password on every system boot to access the device. This is a security requirement for BitLocker on non-TPM hardware.
Enabling Windows Bitlocker Auto Policy
Go to Policy Management
In your Swif dashboard, find Device Management > Policies and either create a new Windows Bitlocker Auto Policy policy or edit an existing one.Select Which Drives to Encrypt
C, D, E: Encrypt only specific volumes.
*: Encrypt all drives (including USB).INTERNAL: Encrypt all internal drives (excluding USB).EXTERNAL: Encrypt only USB/external drives.
Set “Force Without TPM”
Checked:
For devices lacking a TPM (or disabled TPM), users must set a password and will be prompted on each boot.
Unchecked:
BitLocker relies on TPM if present and available. Otherwise, encryption may fail on devices with no TPM.
Set “Protection Status”
On: Enforces BitLocker protection. If a volume is encrypted but in a "Waiting for Activation" state (common on new enrollments), setting this to On will formally activate protection and complete the escrow process.
Off: Suspends or disables BitLocker protection on the targeted drives. This is useful for maintenance or troubleshooting without decrypting the entire drive.
Save and Assign
Once saved, the policy will be pushed to targeted devices. Those that meet the OS requirement and have the Swif agent installed will apply the policy.
Behavior on a Non-TPM Machine (Example)
Swif Desktop App Prompts for Password
If no TPM is detected, the user sees a prompt to create a BitLocker password.
If they do not enter a password, no encryption is performed.
If they do enter a password, encryption begins immediately.
Per-Boot Password Prompt
Every time the machine restarts, a boot password prompt appears (BitLocker Pre-Boot Environment).
The user must enter the password to unlock the drive.
Recovery Key
Automatically generated alongside the user password.
Stored in the Swif console under device details, ensuring admins can retrieve it if the password is forgotten.
Where to Find the Password and Recovery Key
After Force Without TPM encryption begins (and a user sets a password):
Admin Console:
Open the Swif Admin Console
Navigate to Devices and select the relevant Windows device.
Check Device Details
Look for the Security section
You should see both:
TPM Password (the one they entered on the device)
Recovery Key (automatically generated)
Employee Console:
Open the Swif Employee Console
Check Device > Security
You should see:
TPM Password (the one device user entered on the device)
Important: Keep this information in a safe place—anyone with the recovery key can unlock the drive.
Monitoring and Verifying Encryption
Use Manage-BDE (a built-in Windows command-line tool) to verify the protection state. Open Command Prompt as Administrator and run:
manage-bde -status
Look for fields like:
Conversion Status: Indicates if encryption is in progress or complete.
Percentage Encrypted: Shows the encryption progress from 0–100%.
Protection Status: Indicates if BitLocker is on, off, or suspended. You can now manage this state directly via the Protection Status field in your policy.
When Percentage Encrypted reaches 100%, your drive is fully protected.
Expected Results based on Policy Configuration:
Scenario | Policy Setting | Device Type | Expected |
Enable Protection |
| TPM Enabled | Protection Status: Enabled (On) |
Disable Protection |
| TPM Enabled | Protection Status: Disabled (Off) |
Non-TPM Device |
| No TPM | Protection Status: Disabled (Off)* |
Activation Transition |
| Waiting for Activation | Protection Status: Enabled (On) |
*Note: On devices without a TPM, protection will remain "Disabled" unless "Force Without TPM" is enabled and a password has been set by the user.
Frequently Asked Questions (FAQs)
Q: Do I need to enable “Force Without TPM” for devices that have a functioning TPM?
A: Typically, no. Devices with a TPM can automatically handle BitLocker encryption without needing a password at boot.
Q: My device doesn’t have a TPM. Does that mean I can’t use BitLocker at all?
A: You can still use BitLocker in password-only mode. Just enable Force Without TPM so that a password is required on every reboot.
Q: Can I recover my BitLocker key if my user forgets their password?
A: Yes. Swif stores the recovery key in the device’s details within the Swif console. This is essential for unlocking the drive in case of a lost password.
Q: How do I confirm encryption is completed?
A: Use the manage-bde -status command or check the device’s BitLocker status in the Windows Control Panel. The Percentage Encrypted should read 100%.
Q: Are USB drives encrypted if I choose the ‘*’ option in the BitLocker policy?
A: Yes. * applies encryption to all drives, including USB/external ones. Alternatively, you can specify INTERNAL or EXTERNAL if you only want to target internal or external drives.
Q: Does the INTERNAL policy encrypt recovery volumes?
A: No. With INTERNAL, Swif only targets a volume when it meets both of these conditions:
Windows reports it as a local fixed disk with an assigned drive letter.
BitLocker itself reports it as a manageable volume.
Windows recovery partitions (WinRE), EFI System Partitions and MSR partitions normally have no drive letter, so they fail the first condition and are never selected.
Some OEM factory images do ship a recovery or utility partition with a drive letter. Even in that case the volume is only targeted if BitLocker also reports it — an unformatted or RAW partition, for example, is skipped. Note that if such a partition were later formatted with NTFS, it would begin to qualify.
To see exactly which drives INTERNAL would target on a device, run both commands and compare:
powershell -Command "Get-CimInstance Win32_LogicalDisk | Where-Object DriveType -eq 3 | Select-Object DeviceID,VolumeName,FileSystem"
powershell -Command "Get-BitLockerVolume | Select-Object MountPoint,VolumeType,VolumeStatus"
Only drives appearing in both lists are encrypted. To remove any ambiguity, you can specify "C" in the policy instead of "INTERNAL", which limits encryption strictly to the OS drive.
Q: Is it recommended to encrypt all drives?
A: Not always. Encrypting all drives (especially external USBs) can impact performance and user workflow. Many organizations prefer encrypting just the C drive for the operating system and critical data.
Q: Does this work on Windows Home Edition?
A: No. Windows Home editions do not officially support BitLocker. You must have Pro, Enterprise, or Education editions.
Q: Does the policy ignore the TPM because it adds a Recovery Password protector?
A: No. The Swif BitLocker policy adds a Recovery Password protector as a backup recovery method, but it does not replace or remove the device’s TPM protector.
On a TPM-equipped device:
The TPM protector is used for normal startup, allowing Windows to unlock the encrypted drive without prompting the user for a recovery password.
The Recovery Password protector provides an alternative way to unlock the drive if Windows enters BitLocker recovery mode.
Therefore, seeing a Recovery Password protector does not mean the device is configured to use only a recovery password at startup. A BitLocker-encrypted drive can have multiple key protectors enabled at the same time.
To view all protectors configured for the system drive:
Open Command Prompt as Administrator.
Run:
manage-bde -protectors -get C:
On a TPM-equipped device, the results should normally include both:
TPM
Numerical Password, which is the BitLocker recovery password
Microsoft documents that the -get command displays every key-protection method enabled on the selected drive. See manage-bde protectors.
If the TPM protector is missing, verify that the TPM is present, enabled, and ready:
Get-Tpm
Check that both TpmPresent and TpmReady return True.
Q: Why does my device show "Waiting for Activation" with Protection Status "Off"?
A: This typically occurs when a volume has been encrypted and the recovery key has been escrowed to Swif, but BitLocker protection has not yet been formally activated by the OS. To resolve this, ensure the Protection Status field in your BitLocker policy is set to On. This triggers the transition from "Waiting for Activation" to Protection On.
Q: Does the Protection Status field work on all Agent versions?
A: This feature requires Swif Windows Agent v1.324.0 or higher. The agent has been verified to remain stable during multiple policy toggles of the protection state.
Additional Tips
Back Up Your Recovery Key: Even though Swif stores it, it’s wise to save a copy securely offline.
Minimize the Encryption Scope: Start with system drive (C:) encryption for simplicity and reliability.
Maintenance and Updates: Major Windows updates can sometimes prompt for a BitLocker recovery key if firmware or boot configuration changes occur.
Need Further Help?
If you encounter any issues or have additional questions, please contact Swif Support or visit our Help Center.
Swif Policy glossary – see All Windows policies article for context.