How to Disable BitLocker on Windows 10 and 11

To disable BitLocker, open a Command Prompt run as administrator and run manage-bde -off C:, or run Disable-BitLocker -MountPoint "C:" in PowerShell. Windows then decrypts the drive in the background and removes every key protector when it finishes. If you only need BitLocker out of the way for a BIOS, firmware or TPM update, do not decrypt. Suspend it instead, and it comes back on its own.

This guide covers both, on Windows 10 and Windows 11, plus how to check whether BitLocker is on, what to do when the option is greyed out, and how to handle a fleet without losing recovery keys.

Suspend or turn off: pick the right one first

Suspending keeps the data encrypted. Turning BitLocker off decrypts the whole drive. Most admin jobs only need the first.

Microsoft's FAQ says you do not need to suspend BitLocker for Windows quality and feature updates. You do need to for non-Microsoft updates that change the UEFI or BIOS configuration, and for some TPM firmware updates. Skip the suspend and the PC asks for the recovery key at the next start.

How to check if BitLocker is enabled

Run this in a Command Prompt run as administrator:

manage-bde -status C:

Look at two lines. Conversion Status says whether the drive is encrypted. Protection Status says whether protection is on or off. A drive can be fully encrypted with protection off. That is the suspended state.

In PowerShell, Get-BitLockerVolume returns the same information for every volume on the PC.

Before you turn BitLocker off: save the recovery key

Back up the recovery key first, even if you are about to decrypt. A suspended or half-decrypted drive that hits a problem still asks for it.

manage-bde -protectors -get C:

That lists every protector on the drive with its ID. To copy the recovery password into Active Directory, run manage-bde -protectors -adbackup C: -id {protector-ID}. For Microsoft Entra ID use -aadbackup with the same -id.

How to turn off BitLocker on Windows 11 and Windows 10

You need to be in the local Administrators group. Pick one of the four ways below. They all do the same thing.

Turn off BitLocker in Control Panel

1. Open Control Panel and go to System and Security > BitLocker Drive Encryption.
2. Next to the drive, select Turn off BitLocker.
3. Confirm. Decryption starts in the background and you can keep working.

Turn off device encryption in Settings

On a PC that uses device encryption, go to Settings > Privacy & security > Device encryption and switch it off. Microsoft notes that once you turn device encryption off, it does not switch itself back on. You have to enable it manually.

Turn off BitLocker with manage-bde

manage-bde -off C:

Check progress with manage-bde -status C:. Conversion Status moves from Fully Encrypted through Decryption in Progress to Fully Decrypted.

Turn off BitLocker with PowerShell

Disable-BitLocker -MountPoint "C:"

This removes all key protectors and starts decrypting. If the OS volume has automatic unlock keys, the cmdlet stops. Run Clear-BitLockerAutoUnlock first, then run it again. To decrypt every volume on the PC:

$BLV = Get-BitLockerVolume
Disable-BitLocker -MountPoint $BLV

If you came here to uninstall BitLocker: you do not. BitLocker is part of Windows, so the way to remove it is to decrypt the drive.

How to suspend BitLocker for a BIOS, firmware or TPM update

There is no BitLocker switch inside the BIOS. If you want to disable BitLocker in BIOS terms, you suspend it in Windows before you restart into the update.

1. Suspend protection. In a Command Prompt run as administrator: manage-bde -protectors -disable C: -rc 1. The -rc value is the number of restarts before protection comes back, from 0 to 15. Use 0 to keep it suspended until you resume it by hand.
2. Install the update and restart.
3. Check manage-bde -status C:. With a reboot count of 1, protection is back on after that restart.

The PowerShell version is Suspend-BitLocker -MountPoint "C:" -RebootCount 1, and Resume-BitLocker -MountPoint "C:" turns protection back on early. If you do not give a reboot count, Windows resumes protection after the next restart.

In Control Panel the same action is Suspend protection, next to Turn off BitLocker.

While BitLocker is suspended it does not check boot integrity, and the key is readable on the disk. Keep the window short, and do not leave a laptop at reboot count 0 for days.

Microsoft also says that on Microsoft Entra joined devices, protection needs a network connection to back up the recovery password before it resumes. If the key cannot be backed up and policy requires it, protection stays off.

If you cannot turn off BitLocker

• The option is missing or greyed out. A group policy or MDM policy may be controlling it, or you are not an administrator on the PC. Check the applied Group Policy and your MDM profile before you fight it locally.
• Windows 11 Home. Windows 11 Home has device encryption but not BitLocker drive encryption management. Use Settings, Privacy & security, Device encryption.
• Disable-BitLocker refuses to run. Look for automatic unlock keys on the OS volume and clear them, as above.
• The PC asks for a recovery key after your change. A firmware, BIOS or boot order change happened without a suspend. Enter the key from Active Directory, Microsoft Entra ID or the user's Microsoft account, then suspend before the next change.
• It turned itself back on. A device that meets the device encryption requirements can be encrypted automatically after a clean Windows install, and since Windows 11 24H2 more PCs qualify. Microsoft documents a registry value, PreventDeviceEncryption under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BitLocker, to stop the automatic process. A BitLocker policy that requires encryption will also turn it back on.

Turn off BitLocker across a fleet

On one PC, turning BitLocker off is a menu choice. On fifty, the order matters.

1. Confirm the reason. If the goal is a firmware update, suspend with a reboot count instead. It is faster, reversible and leaves the drive encrypted.
2. Check the keys. Before any decryption, confirm each device's recovery key is in Active Directory or Microsoft Entra ID. Microsoft's own guidance is that a lost recovery key means unrecoverable data.
3. Remove or change the policy first. If a Group Policy or MDM profile requires BitLocker, a decrypted device is told to encrypt again. Removing the policy does not decrypt anything. Decryption still has to run on each device.
4. Run the command per device. manage-bde -off C: and Disable-BitLocker both work from a script run through your management tool. manage-bde also takes -computername to act on another computer. Run it on a small test group first and read the status output.
5. Verify. Collect manage-bde -status or Get-BitLockerVolume output afterwards. Decryption time depends on drive size and speed, and a PC that is off finishes at its next start.

An audit shows the cost. A decrypted laptop fails any disk encryption check, and if the laptop holds company data, that is a finding. If you have to leave a device decrypted, record who approved it, why, and when it will be encrypted again.

Where trio.so fits

trio.so shows the disk encryption state of your managed Windows devices and flags the devices where encryption is off. It does not turn BitLocker off for you: you still use the commands above. What you get is one list that says which PCs are encrypted before and after you change anything.

If you want to set BitLocker the other way, to encrypt and back up keys by policy, read BitLocker Drive Encryption Group Policy: A Step by Step Guide. For what BitLocker is and how it compares with other options, see BitLocker Drive Encryption, BitLocker vs VeraCrypt and full disk encryption.