Overview

Swif’s Device Lock command on Windows leverages BitLocker to enforce full-disk protection and securely lock the machine. The exact behavior depends on:

Windows Edition (Home vs. Pro / Enterprise)
BitLocker Status & Policy on the C: drive (Enabled vs. Disabled / Unencrypted)
Presence of a TPM (Trusted Platform Module)

Context & Protectors

For Windows device encryption and locking, Swif utilizes BitLocker with the following protectors:

Numerical Password (Recovery Key): A system-generated 48-digit numerical key used to unlock the device at the BitLocker recovery screen.
TPM: A hardware security chip that automatically unlocks the drive during standard boot.
Password: A user-defined startup password (used when TPM is unavailable).

Remote Device Lock Flow

When a Device Lock command is sent from Swif:

The Swif agent enforces the Numerical Password protector on next boot, regardless of whether a TPM chip is present.
If BitLocker is currently disabled or unencrypted, the agent automatically enables BitLocker, provisions the recovery protector, escrows the newly generated 48-digit key to Swif, and initiates a reboot/lock (~3–4 minutes).
The device reboots into the BitLocker Recovery Lock Screen, requiring the 48-digit numerical recovery key to unlock.
The TPM password prompt will appear if the device does not have TPM enabled but BitLocker is enabled. In Swif, when a Device Lock command is sent to a non-TPM device, the user will be prompted to enter the TPM password on the device. This password will then be visible in the WebApp (Security tab > Encryption section) and must be entered on every boot.

Lock & Unlock Scenarios

1. Windows Home Edition

BitLocker Support: Not supported by Windows OS.
Lock Behavior: Command is unsupported/ignored.
Unlock Behavior: N/A.

2. Windows Pro / Enterprise with Existing BitLocker Policy (Already Encrypted)

TPM Present?	Lock Action	Unlock Behavior
Yes	Immediately shuts down / locks the device.	Enter the 48-digit recovery key once. The drive remains unlocked on subsequent boots without re-prompting.
No	Immediately shuts down / locks the device.	Enter the 48-digit recovery key once. On subsequent boots, the startup password/key will be required.

3. Windows Pro / Enterprise without Existing BitLocker Policy (BitLocker Disabled / Unencrypted)

TPM Present?	Automatic Encryption & Lock Action	Recovery Key Escrow	Unlock Behavior
Yes	Initiates BitLocker enablement and protector creation on `C:`, then reboots/locks the device to the BitLocker recovery screen (~3–4 min).	The 48-digit Recovery Key is generated and immediately escrowed to the Swif WebApp (Security Tab).	Enter the recovery key once. The drive remains encrypted and automatically unlocked by TPM on subsequent boots.
No	Initiates BitLocker enablement and protector creation on `C:`, then reboots/locks the device to the BitLocker recovery screen (~3–4 min).	The 48-digit Recovery Key is generated and immediately escrowed to the Swif WebApp (Security Tab).	Enter the recovery key once. The startup password will be required on subsequent boots.

How to Unlock a Locked Device

Retrieve the Recovery Key:
- In the Swif Dashboard, navigate to Devices and select the locked Windows device.
- Open the Security tab (or device details drawer) to view the escrowed 48-digit BitLocker Recovery Key.
Unlock the Device:
- Power on the target computer to display the blue BitLocker Recovery Screen.
- Type the 48-digit numerical recovery key using the keyboard (or function keys F1–F10 for digits 1–0 if prompted) and press Enter.
Post-Unlock State:
- Once unlocked, the system boots normally into Windows.
- On TPM-enabled machines, TPM resumes handling normal boot operations without requiring the recovery key again.

Summary Matrix

Windows Edition	Initial BitLocker State	TPM	Device Lock Execution	WebApp Key Escrow	Device Unlock Action
Home	Any	N/A	Unsupported / No-op	N/A	N/A
Pro / Enterprise	Enabled	Yes	Immediate shutdown / lock	Existing key in Security tab	Enter recovery key once; normal boots resume
Pro / Enterprise	Enabled	No	Immediate shutdown / lock	Existing key in Security tab	Enter recovery key once; prompt on subsequent boots
Pro / Enterprise	Disabled / Off	Yes	Auto-enables BitLocker + reboot (~3–4 min)	New 48-digit key auto-escrowed to Security tab	Enter recovery key once; drive stays encrypted
Pro / Enterprise	Disabled / Off	No	Auto-enables BitLocker + reboot (~3–4 min)	New 48-digit key auto-escrowed to Security tab	Enter recovery key once; drive stays encrypted

Key Takeaways

No Pre-requisite Encryption Needed: Remote lock works seamlessly even if BitLocker was previously turned off or fully decrypted (manage-bde.exe -status C: showing Protection Off).
Automatic Escrow: When locking an unencrypted device, Swif provisions BitLocker and immediately syncs the recovery key to the WebApp before rebooting, preventing lockouts.
Clean Audit Trail: Lock commands report Completed / Success with no exit status 0x8031001d errors.

Windows Device Lock/Unlock Behavior with BitLocker Policies