Windows Security · BitLocker

How to Enable BitLocker Without TPM in Windows
Windows 10 · Windows 11 · Startup Key

A practical guide to turning on BitLocker drive encryption on a Windows PC that does not have a compatible TPM module, including the required Group Policy setting, startup authentication options, recovery-key backup, and troubleshooting.

⏱ 12 min read 🔐 BitLocker 🪟 Windows 10 🪟 Windows 11 🧩 No TPM 💾 USB Startup Key
Overview

How BitLocker Works Without a TPM Module in Windows

BitLocker normally uses a compatible Trusted Platform Module (TPM) to help protect the operating system drive and release the encryption key only when the boot environment looks trusted. On a computer without a usable TPM, BitLocker can still encrypt the Windows drive, but it must use another startup protector.

In practice, enabling BitLocker without TPM means Windows will require pre-boot authentication. Depending on the available options on your edition and hardware, this may be a startup password or a USB flash drive that contains a BitLocker startup key. The drive remains encrypted, but the computer cannot unlock it silently before Windows starts.

ℹ️
Important concept

Without TPM, BitLocker does not have the same hardware-backed boot integrity verification. The protection still encrypts the drive, but the startup credential becomes much more important.

🔐

Data is encrypted

Files on the system drive are protected when the PC is powered off, lost, stolen, or removed from the computer.

⌨️

Startup input is required

You must provide a startup password or insert a USB flash drive with the startup key before Windows can boot.

🧩

Policy must be changed

Windows blocks this setup until the policy Allow BitLocker without a compatible TPM is enabled.

Before You Start

Requirements to Enable BitLocker Without TPM in Windows 11 or Windows 10

Before you change BitLocker settings, verify that the computer and Windows edition can support the configuration. This is especially important on older PCs, custom builds, virtual machines, and laptops where TPM was disabled in BIOS or UEFI.

Requirement Why It Matters What to Check
Windows edition Full BitLocker Drive Encryption is available on Windows Pro, Enterprise, Education, and some business editions. Open winver or Settings → System → About.
Administrator account Changing BitLocker policy and encrypting the system drive require elevated permissions. Use an account that can open Windows Terminal, PowerShell, or Command Prompt as administrator.
Recovery key storage If the startup password or USB key is lost, the recovery key may be the only way to unlock the drive. Prepare a Microsoft account, printed copy, external drive, or secure password manager entry.
USB boot support If you use a USB startup key, firmware must be able to read the USB drive before Windows starts. Confirm that USB storage works in BIOS/UEFI boot mode and run the BitLocker system check.
Backup of important files Encryption changes the whole system drive and a mistake with keys can lock you out. Back up personal files before enabling BitLocker on the operating system drive.
⚠️
Do not skip this

Never store the only copy of the recovery key on the same encrypted Windows drive. If the drive locks, that copy will also be inaccessible.

Step 01

How to Check Whether Your Windows PC Has a TPM Module

First, confirm whether TPM is really missing or just disabled. Many modern PCs have TPM 2.0 in firmware, but it may be turned off in BIOS/UEFI or named differently, such as Intel PTT or AMD fTPM.

Check TPM with tpm.msc

  1. Press Win + R.
  2. Type tpm.msc and press Enter.
  3. Look at the Status section.
  4. If it says The TPM is ready for use, your PC has a working TPM.
  5. If it says a compatible TPM cannot be found, continue with the no-TPM BitLocker setup or check BIOS/UEFI first.

Check TPM with PowerShell

Get-Tpm

If TpmPresent is False, Windows does not currently detect a TPM. If TpmPresent is True but TpmReady is False, the module exists but may need to be enabled, initialized, or fixed.

✅
Better option when available

If your computer has TPM but it is disabled, enabling TPM in BIOS/UEFI is usually better than running BitLocker without TPM. TPM-based BitLocker can unlock more conveniently and can provide stronger boot-state protection.

Step 02

Enable the “Allow BitLocker Without a Compatible TPM” Group Policy

By default, Windows may show the error This device can't use a Trusted Platform Module when you try to encrypt the operating system drive. To allow BitLocker without TPM, change one Local Group Policy setting first.

Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption → Operating System Drives
  1. Press Win + R, type gpedit.msc, and press Enter.
  2. Go to Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption → Operating System Drives.
  3. Double-click Require additional authentication at startup.
  4. Select Enabled.
  5. Check Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive).
  6. Leave the TPM-related options unchanged unless you are also configuring BitLocker for computers that do have TPM.
  7. Click Apply, then OK.

Force the policy to refresh

You can restart Windows, or run this command in an elevated Command Prompt: 

gpupdate /force
💡
Policy name to remember

The critical setting is Require additional authentication at startup. The checkbox inside that policy is what allows BitLocker on an operating system drive without a compatible TPM.

Step 03

How to Turn On BitLocker Without TPM After Changing Policy

After the policy is enabled, start BitLocker from Control Panel. This method is safer for most users because Windows shows the setup wizard, asks where to save the recovery key, and can run a system check before encryption begins.

Open BitLocker Drive Encryption

  1. Press Win + R.
  2. Type control /name Microsoft.BitLockerDriveEncryption and press Enter.
  3. Find the operating system drive, usually C:.
  4. Click Turn on BitLocker.
  5. Choose the startup method offered by the wizard: password or USB startup key.
  6. Save the recovery key outside the encrypted system drive.
  7. Choose Encrypt used disk space only for a new PC, or Encrypt entire drive for a PC that already contained personal data.
  8. Select the newer encryption mode for internal Windows 10/11 system drives unless you need compatibility with older Windows versions.
  9. Run the BitLocker system check when offered, then restart the PC.
⚠️
Run the system check

The BitLocker system check verifies that the selected startup method works before Windows fully commits to the encrypted startup process. This is especially important when using a USB startup key.

Startup Protection

BitLocker Without TPM: Startup Password vs USB Startup Key

When TPM is not available, the startup protector becomes the practical key to the encrypted system drive. Choose an option you can use reliably every time the computer starts.

Option How It Works Pros Risks
Startup password You type a password before Windows starts. No USB drive is required. Easier for laptops and travel. A weak password reduces security. Forgotten passwords require the recovery key.
USB startup key Windows reads a special key file from a USB flash drive before booting. No password typing at boot. Useful for fixed desktops in controlled environments. The USB drive can be lost, copied, damaged, or left inserted in the PC.
Recovery key A 48-digit emergency key unlocks the drive when the normal startup protector fails. Essential fallback if startup authentication fails. If it is lost, encrypted data may be unrecoverable.

Recommended

  • Use a long startup password if the wizard offers password-based startup authentication.
  • Use a dedicated USB flash drive if you choose a startup key.
  • Keep at least one recovery-key copy offline.
  • Test the first reboot before relying on the configuration.

Avoid

  • Do not store the recovery key only on C:.
  • Do not leave a USB startup key permanently inserted in a laptop.
  • Do not use short, obvious, reused, or shared passwords.
  • Do not change BIOS boot settings immediately after enabling encryption unless you have the recovery key.
Recovery

How to Back Up the BitLocker Recovery Key Before You Encrypt

The recovery key is your emergency access method. If Windows cannot use the startup password or startup key, it may ask for the 48-digit recovery key before it unlocks the drive.

Safe places to store the recovery key

Unsafe places to store the recovery key

🚫
No bypass

If BitLocker is configured correctly and you lose both the normal startup protector and the recovery key, Windows cannot simply bypass encryption. You may be able to reinstall Windows, but the encrypted files on the locked volume are not recoverable without a valid protector.

Commands

Useful Commands for BitLocker Without TPM

These commands help you check status, confirm protectors, and monitor encryption. Run Command Prompt, PowerShell, or Windows Terminal as administrator.

Check BitLocker status

manage-bde -status C:

Show BitLocker protectors for the system drive

manage-bde -protectors -get C:

Check BitLocker with PowerShell

Get-BitLockerVolume -MountPoint "C:"

Open the BitLocker Control Panel applet

control /name Microsoft.BitLockerDriveEncryption

Refresh Group Policy

gpupdate /force

If you use scripts for BitLocker deployment, test them on a non-critical machine first. Startup protectors, recovery-key storage, firmware behavior, and Windows edition differences can change the result.

Edition Notes

What If gpedit.msc Is Missing in Windows?

If gpedit.msc is missing, first check your Windows edition. Windows Home editions usually do not include the Local Group Policy Editor, and they also do not provide the full BitLocker management experience used on Pro, Enterprise, and Education editions. Some Windows Home devices support Device Encryption, but that is not the same as manually configuring full BitLocker without TPM.

Windows Edition BitLocker Without TPM Setup Recommended Action
Windows Pro Supported through Local Group Policy and BitLocker Drive Encryption. Use gpedit.msc, enable the startup authentication policy, then start BitLocker.
Windows Enterprise / Education Supported and often managed by IT policy, Intune, or Active Directory. Check with your administrator before changing startup protectors.
Windows Home Full BitLocker configuration is normally not available. Use Device Encryption if supported, or upgrade to Pro if you need full BitLocker management.
ℹ️
Registry edits

Registry-based BitLocker policy changes exist, but using Local Group Policy is clearer, safer, and easier to audit. For most home users, the missing gpedit.msc problem usually means the Windows edition does not support the intended BitLocker workflow.

Fixes

Fix BitLocker Without TPM Problems in Windows

The most common problems are caused by policy not applying, unsupported Windows edition, firmware that cannot read the USB startup key, or recovery-key backup mistakes.

Problem Likely Cause Fix
This device can't use a Trusted Platform Module The required policy is disabled or has not refreshed. Enable Require additional authentication at startup, check the no-TPM checkbox, then run gpupdate /force or restart.
BitLocker option is missing Windows Home, missing admin rights, or disabled BitLocker feature on a managed PC. Check Windows edition with winver and open Control Panel as administrator.
USB startup key is not detected before boot Firmware cannot read the USB drive, USB boot support is disabled, or the port is unavailable in pre-boot mode. Try another USB port, enable USB support in BIOS/UEFI, use a simple FAT32 USB drive, and run the BitLocker system check.
Recovery key prompt appears after BIOS changes Boot configuration changed after encryption. Enter the recovery key, verify boot order, then suspend BitLocker before future firmware updates.
Password or key works on one boot but not another Keyboard layout, pre-boot keyboard support, damaged USB key, or changed boot path. Use simple characters for startup passwords, test another keyboard or USB port, and keep a recovery-key copy available.

Safe maintenance tip

Before BIOS updates, boot-order changes, disk cloning, partition work, or major firmware changes, suspend BitLocker temporarily and resume it after the maintenance is finished. 

manage-bde -protectors -disable C:
manage-bde -protectors -enable C:
FAQ

BitLocker Without TPM FAQ

Q Can I enable BitLocker without TPM in Windows 11? ▼
Yes, on editions that include full BitLocker management, you can enable the policy that allows BitLocker without a compatible TPM and then use a startup password or USB startup key.
Q Is BitLocker without TPM as secure as BitLocker with TPM? ▼
It still encrypts the drive, but it does not provide the same TPM-backed boot integrity checks. Security depends heavily on the startup password or USB startup key and on how safely you store the recovery key.
Q Do I need a USB flash drive for BitLocker without TPM? ▼
Not always. Some setups allow a startup password. If you choose a USB startup key, the flash drive must be available every time the computer starts and must be readable before Windows boots.
Q Why does Windows still say TPM is required after I changed the policy? ▼
The policy may not have refreshed, the wrong policy was edited, the checkbox was not selected, or BitLocker is being controlled by an organization policy. Run gpupdate /force, restart, and verify the policy path under Operating System Drives.
Q Can Windows Home enable BitLocker without TPM? ▼
Windows Home generally does not include full BitLocker Drive Encryption controls. Some Windows Home devices support Device Encryption, but that is a different feature and normally depends on modern hardware security support.
Q What should I do if I lose the USB startup key? ▼
Use the 48-digit BitLocker recovery key to unlock the drive, then create a new startup protector. If you also lost the recovery key, the encrypted data may not be recoverable.

🔐 Summary: Enable BitLocker Without TPM Carefully

To enable BitLocker without a TPM module, first open gpedit.msc, enable Require additional authentication at startup, and check Allow BitLocker without a compatible TPM. After that, turn on BitLocker from Control Panel and choose the startup method offered by the wizard.

The most important safety rule is simple: back up the recovery key before encryption begins and keep it outside the encrypted Windows drive. Without TPM, your startup password or USB startup key becomes critical, and the recovery key is your emergency access method if startup authentication fails.