BitLocker on Windows Server: enabling it, checking volume status, and backing up recovery information before you reboot

Goal

Install BitLocker Drive Encryption on Windows Server, encrypt a data volume with a recovery-password protector, and confirm that protector is backed up somewhere recoverable before rebooting or locking the volume.

Prerequisites

Administrator rights; on Windows Server, the BitLocker feature is not present by default.

Steps

1. Install the feature: Install-WindowsFeature -Name BitLocker -IncludeManagementTools -Restart. -Restart reboots the server automatically, without a prompt, if the installation requires a restart (installing BitLocker normally does) — run it only inside a maintenance window. Confirm afterward with Get-WindowsFeature -Name BitLocker.
2. Check current volume state before changing anything: Get-BitLockerVolume -MountPoint "D:", which reports VolumeStatus ("whether BitLocker currently protects some, all, or none of the data on the volume") and EncryptionPercentage.
3. Add a recovery-password protector and start encryption: Enable-BitLocker -MountPoint "D:" -RecoveryPasswordProtector. A data volume protected only this way is locked after every restart until someone enters the password; if the OS volume is itself BitLocker-protected, Enable-BitLockerAutoUnlock -MountPoint "D:" unlocks it automatically at boot. A recovery password is described in Microsoft's BitLocker recovery guidance as "a 48-digit number used to unlock a volume when it is in recovery mode."
4. Immediately back the protector up off the host. Get its ID with (Get-BitLockerVolume -MountPoint "D:").KeyProtector | Where-Object KeyProtectorType -eq RecoveryPassword, then run Backup-BitLockerKeyProtector -MountPoint "D:" -KeyProtectorId <id>, which saves it "to Active Directory Domain Services (AD DS)" on a domain-joined server (manage-bde -protectors -adbackup D: -id <id> is the command-line equivalent). For a Microsoft Entra-joined device, BackupToAAD-BitLockerKeyProtector takes the same parameters. The AD backup can fail if Group Policy does not allow recovery information to be stored in AD DS.
5. Verify the backup exists before relying on it: in AD, recovery passwords are stored as msFVE-RecoveryInformation child objects under the computer object, whose name includes the protector ID (visible with the BitLocker Recovery Password Viewer or Get-ADObject -SearchBase <computer DN> -Filter "objectClass -eq 'msFVE-RecoveryInformation'"); in Entra ID, check the device's BitLocker keys in the admin center.
6. Only after step 5 is confirmed, allow a reboot or let the volume lock; Get-BitLockerVolume again afterward should show VolumeStatus: FullyEncrypted (or EncryptionInProgress immediately after step 3).

Expected result

Get-BitLockerVolume shows the volume protected, and a lookup in AD or Entra ID (not on the encrypted host) returns the same recovery password ID recorded when the protector was created.

Limits and test basis

Encrypting without a verified off-host backup of the recovery password risks permanent data loss if the boot chain flags the volume for recovery and no other protector is usable — do not skip step 5. To remove protection, Disable-BitLocker -MountPoint "D:" decrypts the volume; this can take as long as the original encryption and should not be interrupted. Feature installation in step 1 normally requires a reboot; encrypting a data (non-OS) volume in step 3 does not, and encryption continues in the background after the command returns.