How to Encrypt a Windows Server Data Volume with BitLocker
Applies to: Windows Server 2019, 2022 and 2025, subject to installed updates and feature availability.
BitLocker protects data at rest. Recovery information must be stored outside the encrypted server before encryption begins.
Security controls should be piloted, monitored and reversible through console access. Visit networkmanager.info for managed Windows VPS services.
Prerequisites
- Confirm TPM or recovery-key design.
- Back up all data.
- Store recovery information in AD DS or approved vault.
- Schedule restart when role installation requires it.
Procedure
Step 1: Install BitLocker
Add role components and restart.
Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools -RestartStep 2: Inspect volume
Check status and free space.
Get-BitLockerVolume -MountPoint 'D:'
Get-Volume -DriveLetter DStep 3: Create recovery protector
Enable encryption and capture recovery material directly into the approved escrow workflow.
Enable-BitLocker -MountPoint 'D:' -EncryptionMethod XtsAes256 -UsedSpaceOnly -RecoveryPasswordProtectorStep 4: Back up protector
Use Backup-BitLockerKeyProtector for AD DS escrow when the domain and permissions are prepared.
Step 5: Monitor progress
Review conversion percentage.
Get-BitLockerVolume -MountPoint 'D:'Verification
Confirm protection status, encryption percentage and escrowed recovery.
Get-BitLockerVolume -MountPoint 'D:' | Format-List MountPoint,VolumeStatus,ProtectionStatus,EncryptionPercentage,KeyProtectorRollback and recovery
Disable-BitLocker begins decryption and can take significant time. Do not remove recovery protectors until decryption and backup are confirmed.
Security notes
Never publish recovery passwords. XTS-AES is for fixed data volumes and is not designed for moving encrypted disks between older systems.
Official references
Explore Netcloud24 Canada.
