Encrypt company laptops with FileVault and BitLocker

A lost laptop is an inconvenience. A lost laptop with an unencrypted drive is a data breach: anyone can remove the disk and read customer files, saved passwords and email. Both macOS and Windows include full-disk encryption at no extra cost, FileVault and BitLocker, and switching them on takes minutes.

The part small businesses get wrong is the recovery key. If it is stored only on the laptop, or only in the personal account of the employee who left last month, the company's data is locked away for good. This tutorial shows how to turn encryption on, check it from the command line, and keep recovery keys where the business can reach them.

What you need before you start

• Mac: any Mac with Apple silicon or the Apple T2 chip, an administrator account, and the user's login password.
• Windows: Windows 11 Pro, Enterprise or Education for full BitLocker. Windows Home editions offer device encryption on qualifying hardware instead (see below). A TPM is strongly recommended.
• Somewhere the company controls to store recovery keys: your device management (MDM) service, Microsoft Entra ID, or a company password manager vault that two people can open.
• A current backup. Encryption rarely causes data loss, but any change to disk configuration deserves one.

Part 1: FileVault on a Mac

How FileVault protects data

FileVault uses AES-XTS to encrypt the whole internal volume. On Macs with Apple silicon or a T2 chip, all key handling happens in the Secure Enclave and the encryption keys are never directly exposed to the CPU. Those Macs encrypt their internal storage automatically; turning FileVault on adds the requirement that the user's login password is needed to unlock the data at startup.

Turn it on in System Settings

1. Open System Settings > Privacy & Security > FileVault and click Turn On.
2. Choose how the disk can be unlocked if the password is forgotten. For a company laptop, choose Create a recovery key and do not use my iCloud account, so recovery does not depend on an employee's personal Apple Account.
3. Record the recovery key immediately in the company vault, labelled with the Mac's serial number. Apple's warning is blunt: if the login password and the recovery key are both lost, the files are lost.
4. Enable any other users who need to unlock the Mac at startup when prompted.

Check FileVault from Terminal

The built-in fdesetup tool reports the state without opening Settings, which is useful when checking several machines:

# Is FileVault on? (no admin rights needed)
fdesetup status
# FileVault is On.

# Scriptable check: prints "true" and exits 0 when FileVault is enabled
fdesetup isactive

# Does the volume have a personal or institutional recovery key? (needs admin)
sudo fdesetup haspersonalrecoverykey
sudo fdesetup hasinstitutionalrecoverykey

If a key has been exposed, or you cannot find it, generate a new personal recovery key with sudo fdesetup changerecovery -personal. The old key is removed and replaced, so store the new one straight away.

With device management

If you manage Macs with an MDM service, use its FileVault payload instead of doing this by hand. MDM can enforce FileVault, escrow the personal recovery key to the MDM server, and show you which Macs are still unencrypted. That is the most reliable way to make sure the business, not the employee, holds the key.

Part 2: BitLocker on Windows

Which Windows editions have BitLocker

Microsoft notes that from Windows 11, version 24H2, more devices qualify for automatic device encryption because earlier hardware prerequisites were removed. Device encryption has a catch for businesses: if the PC uses only local accounts, the drive remains unprotected even though the data is encrypted, because the protection is completed only when the recovery key is backed up. Business PCs should sign in with work accounts and use Pro or higher.

Check the current state

Open PowerShell as administrator:

# Encryption method, protection status and key protectors for the system drive
Get-BitLockerVolume -MountPoint C: | Format-List MountPoint, VolumeStatus, ProtectionStatus, EncryptionMethod, KeyProtector

# Or with the classic tool
manage-bde -status C:

You want VolumeStatus: FullyEncrypted, ProtectionStatus: On, and key protectors that include Tpm and RecoveryPassword. A status of Waiting for Activation or Suspended means the drive is not actually protected.

Turn on BitLocker with a recovery password

# 1. Add a 48-digit recovery password protector
Add-BitLockerKeyProtector -MountPoint $env:SystemDrive -RecoveryPasswordProtector

# 2. Encrypt using the TPM as the unlock protector
Enable-BitLocker -MountPoint $env:SystemDrive -TpmProtector

# 3. Show the recovery password and its ID so you can store them
(Get-BitLockerVolume -MountPoint $env:SystemDrive).KeyProtector |
  Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' } |
  Format-Table KeyProtectorId, RecoveryPassword

Restart if prompted; Windows runs a hardware test and then encrypts in the background. For laptops that carry sensitive data, consider a startup PIN as well (-TPMandPinProtector), which requires a PIN before Windows starts.

Back up the key to Entra ID

On PCs joined to Microsoft Entra ID, copy the KeyProtectorId from the previous step and run:

BackupToAAD-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId "{PASTE-THE-ID-HERE}"

Keep the braces in the ID. For PCs joined to an on-premises domain, Backup-BitLockerKeyProtector stores it in Active Directory instead. If you have neither, save the recovery password in the company vault with the PC's name and serial number. Never save it only to a file on the same drive.

Recovery keys: a policy that works

Whatever you choose, test it: once a quarter, pick one laptop and confirm you can find its current recovery key in under five minutes. After a recovery key has been used, Microsoft recommends replacing it with a new one.

Limitations and gotchas

• Encryption protects a powered-off or locked device. A laptop that is running and unlocked gives no protection; set short screen-lock timeouts.
• External drives are separate. Windows device encryption does not cover USB drives, and on a Mac, removable storage does not use the Secure Enclave. Encrypt portable drives separately: BitLocker supports removable data volumes, and macOS Disk Utility can format a drive as encrypted APFS.
• Firmware updates can trigger recovery. BitLocker may ask for the recovery key after BIOS or Secure Boot changes; suspend protection with Suspend-BitLocker before planned firmware work and resume after.
• Changing the encryption method requires decryption first. Device encryption defaults to XTS-AES 128-bit; if policy needs 256-bit, set it before encryption starts.
• Do not decrypt as a troubleshooting step. Microsoft advises turning BitLocker off only when protection is no longer needed.

What to do next

1. List every company laptop and desktop with its owner and serial number.
2. Run fdesetup status or Get-BitLockerVolume on each and note the result.
3. Turn on encryption where it is off, choosing a recovery method the company controls.
4. Move existing keys out of personal accounts into MDM or the company vault.
5. Add "confirm recovery key is stored" to your new-starter and leaver checklists.