How to Check Windows Encryption Status in 2026

How to Check Windows Encryption Status in 2026

If you need to confirm whether a Windows PC is encrypted, the fastest methods are already built into the operating system.

This guide explains how to check Windows encryption status with built-in settings, Command Prompt, PowerShell, and admin tools, so you can verify protection without guessing.

What Windows encryption status actually means

Windows can use several encryption technologies, and the status you see depends on which one is active.

The most common are BitLocker for full-volume encryption, Device Encryption on supported consumer devices, and EFS (Encrypting File System) for individual files and folders.

When you check encryption status, you are usually confirming one or more of these details:

• Whether the operating system drive is encrypted
• Whether data drives and removable drives are encrypted
• Whether encryption is fully enabled, partially enabled, or suspended
• Whether recovery information has been backed up to a Microsoft account, Active Directory, or Azure AD

How to check Windows encryption status in Settings

The Settings app is the easiest place to start, especially on Windows 11 and newer Windows 10 builds.

Check device encryption in Settings

1. Open Settings.
2. Go to Privacy & security or Update & Security, depending on your Windows version.
3. Select Device encryption or BitLocker.

If you see a device encryption page, Windows will show whether encryption is on or off.

If the page is missing, your device may not support Device Encryption, or BitLocker may be managed elsewhere.

Check BitLocker status in Control Panel

1. Open Control Panel.
2. Go to System and Security.
3. Select BitLocker Drive Encryption.

This view shows every eligible drive and its state.

You may see On, Off, or Suspended.

Suspended means the drive remains encrypted, but the protection is temporarily paused, often during firmware or system changes.

How to check Windows encryption status with Command Prompt

For a quick and precise result, the manage-bde command is one of the most reliable options.

It is available on editions that support BitLocker.

Use manage-bde to check a drive

Open Command Prompt as Administrator and run:

manage-bde -status

This command returns detailed status for each volume, including:

• Conversion status
• Percentage encrypted
• Protection status
• Encryption method
• Lock status

To check a specific drive, use:

manage-bde -status C:

Look for Conversion Status and Protection Status.

If conversion is complete and protection is on, the volume is encrypted and actively protected.

How to check Windows encryption status with PowerShell

PowerShell is useful when you want a scriptable check or need to audit multiple devices.

It is especially helpful for IT teams using Windows Server, Microsoft Intune, or endpoint automation.

Use Get-BitLockerVolume

Open PowerShell as Administrator and run:

Get-BitLockerVolume

This command displays each volume with fields such as:

• VolumeStatus
• ProtectionStatus
• EncryptionPercentage
• MountPoint

For a single drive:

Get-BitLockerVolume -MountPoint C:

In the output, a ProtectionStatus of On indicates active encryption protection.

If you need a more readable summary, you can format the results with:

Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, ProtectionStatus, EncryptionPercentage

How to check Windows encryption status in File Explorer

File Explorer does not provide the full technical encryption status, but it can reveal whether individual files or folders use EFS.

Check for EFS on files and folders

1. Right-click a file or folder.
2. Select Properties.
3. On the General tab, choose Advanced.

If Encrypt contents to secure data is enabled, the item uses EFS.

This is different from BitLocker because EFS protects individual files, while BitLocker protects entire volumes.

How to check Windows encryption status in Microsoft management tools

In managed environments, local checks are often not enough.

Administrators may also use Microsoft admin consoles to confirm encryption compliance across fleets of Windows 10 and Windows 11 devices.

Microsoft Intune

In Microsoft Intune, device compliance and encryption reports can show whether BitLocker or Device Encryption is active.

This is common in modern zero trust deployments where compliance must be verified centrally.

Active Directory and Azure AD

Organizations that back up BitLocker recovery keys to Active Directory or Microsoft Entra ID can verify whether key escrow succeeded.

That matters because encryption without recovery access can create support problems during password resets, hardware changes, or reimaging.

How to interpret common encryption status messages

Different tools use different wording, but the meaning is usually consistent.

These are the most common statuses you may see when checking Windows encryption status.

• On or Protection On: the drive is encrypted and actively protected
• Off: encryption is not enabled on that volume
• Suspended: encrypted, but protection is temporarily paused
• Encrypting: encryption is still in progress
• Decrypted: encryption has been removed

If a drive shows Encrypting, wait until the process completes before assuming the device is fully protected.

On large drives, encryption may take time depending on hardware, SSD performance, and whether the device uses hardware-based or software-based encryption.

What to do if encryption is not enabled

If your check shows that Windows encryption is off, the right next step depends on your device and edition.

Windows Pro, Enterprise, and Education typically support BitLocker, while some Windows Home devices support Device Encryption only if the hardware meets Microsoft requirements.

Before enabling encryption, verify these items:

• Your edition of Windows supports the feature
• The TPM 2.0 chip is present and ready, if required
• The recovery key is backed up
• Your device is plugged in and unlikely to power off during encryption
• You have admin rights to change encryption settings

On managed devices, contact your IT administrator before making changes, since policies from Microsoft Intune, Group Policy, or mobile device management may control encryption settings.

Best practices for confirming Windows encryption

A single check is not always enough, especially for compliance or security audits.

For a more complete review, combine multiple methods.

• Use Settings for a quick visual check
• Use manage-bde -status for accurate command-line verification
• Use Get-BitLockerVolume for automation or reporting
• Confirm recovery key backup in Microsoft Entra ID, Active Directory, or a Microsoft account
• Check both the operating system drive and any attached data drives

This layered approach is useful for laptops, desktops, hybrid workstations, and shared business devices.

It also helps avoid false confidence when encryption is partially enabled or temporarily suspended.

Why checking encryption status matters

Encryption status affects more than privacy.

It is tied to regulatory compliance, data loss prevention, and endpoint security.

If a Windows device is lost or stolen, BitLocker or Device Encryption can help prevent unauthorized access to local files, cached credentials, and sensitive business data.

For organizations, checking encryption status supports policies aligned with CIS Controls, NIST guidance, HIPAA safeguards, and general endpoint hardening.

For home users, it provides basic assurance that personal documents, photos, and browser data are protected if the device is compromised.