If you need to know how to turn on encryption on work laptop devices, the exact steps depend on whether your organization uses Windows, macOS, or a managed endpoint platform.
This guide explains how full-disk encryption works, where to check settings, and what to do if your company controls the device.
What laptop encryption does
Laptop encryption protects data at rest by converting files and disk contents into unreadable code unless the device is unlocked with the correct credentials or recovery key.
On modern work devices, this is usually full-disk encryption, such as Microsoft BitLocker on Windows or FileVault on macOS.
For employers, encryption supports data protection, regulatory compliance, and incident response.
If a laptop is lost, stolen, or repurposed, encrypted storage makes it much harder for unauthorized users to access sensitive files, credentials, and cached business information.
Before you try to enable encryption
Many work laptops are already encrypted by IT through device management tools such as Microsoft Intune, Jamf Pro, VMware Workspace ONE, or Endpoint Central.
Before changing anything, check whether your organization has a policy that requires IT approval or central management.
- Confirm whether the device is company-owned or bring-your-own-device.
- Check if you have local administrator access.
- Make sure the battery is charged and the laptop is plugged in.
- Back up important files to approved storage.
- Verify that Windows or macOS is fully updated.
If your company uses Microsoft Entra ID, Active Directory, or an MDM platform, the encryption setting may be enforced automatically and you may only need to confirm that it is active.
How to turn on encryption on work laptop devices running Windows
On Windows 10 and Windows 11, the most common encryption feature is BitLocker.
Some devices support Device Encryption, which is a simplified version of the same protection and may turn on automatically when the hardware meets requirements.
Check whether your device supports BitLocker
Open Start, search for BitLocker, and look for Manage BitLocker or BitLocker Drive Encryption.
If you see this control panel item, your device likely supports full BitLocker management.
On some editions, especially Windows Pro, Enterprise, and Education, BitLocker is available natively.
You can also check system readiness with msinfo32.
Search for System Information and review whether Device Encryption Support is listed as ready.
TPM 2.0, Secure Boot, and a supported Windows edition often influence availability.
Turn on BitLocker in Windows
- Open Control Panel and select System and Security.
- Choose BitLocker Drive Encryption.
- Next to the operating system drive, select Turn on BitLocker.
- Select how you want to unlock the drive at startup, usually with TPM plus PIN or automatic unlock depending on policy.
- Save or print the recovery key, or store it in your organization’s approved account such as Microsoft Entra ID or Azure AD.
- Choose whether to encrypt the entire drive or only used disk space.
- Start the encryption process and keep the laptop powered on until it finishes.
For most work laptops, encrypting the used disk space first is faster, while full-drive encryption may be preferred for devices with older files or reused hardware.
Your IT policy may dictate which option you must choose.
Verify BitLocker status
After setup, return to Manage BitLocker and confirm the status shows BitLocker on.
In Command Prompt, administrators can also use manage-bde -status to inspect drive encryption progress and protection status.
How to turn on encryption on work laptop devices running macOS
Apple’s built-in encryption is called FileVault.
It encrypts the entire startup disk and is commonly managed through MDM on corporate MacBooks, including those enrolled in Apple Business Manager.
Turn on FileVault on a MacBook
- Open System Settings.
- Select Privacy & Security.
- Scroll to FileVault.
- Click Turn On.
- Choose whether to allow your iCloud account to unlock the disk or create a recovery key.
- Follow your company’s recovery-key policy and save the key only in approved systems.
On managed Macs, the option may be greyed out because your administrator has already enabled FileVault or requires it through a configuration profile.
In that case, the correct action is usually to verify status rather than manually changing settings.
Confirm FileVault is active
In System Settings, FileVault should show that disk encryption is on.
Administrators can also use Terminal commands such as fdesetup status to verify whether encryption has completed.
What to do if encryption is already enabled
If the laptop is managed by your employer, encryption may have been enabled before the device reached you.
This is common in zero-touch deployment workflows and standard corporate onboarding.
In that case, your task is to verify compliance, not reconfigure the system.
Look for signs such as policy banners, a company portal app, or a security dashboard that reports encryption status.
If the status is unclear, contact IT support and ask whether the device is compliant under your organization’s endpoint protection policy.
Common problems when enabling laptop encryption
Encryption can fail or stall for several reasons, especially on older devices or poorly maintained systems.
- TPM not ready: The Trusted Platform Module may need to be enabled in BIOS or firmware.
- Secure Boot disabled: Some organizations require Secure Boot for modern device security.
- No administrator rights: You may need IT assistance to apply the setting.
- Unsupported edition: Some Windows editions have limited encryption features.
- Recovery key not saved: Policies may block activation until the key is escrowed.
- Battery or power interruption: The process can pause if the device loses power.
If the laptop belongs to your employer, avoid bypassing security controls.
In managed environments, the right fix is usually to follow the approved setup path or request an IT ticket.
How to check whether the device is truly protected
Turning encryption on is only part of the process.
You should also confirm that protection is active, the recovery key is stored securely, and the device can still be unlocked after a restart.
This matters because some systems show encryption as enabled while protection is still being finalized in the background.
Useful verification points include:
- The OS reports encryption as active.
- The recovery key is escrowed in the company’s management system.
- Startup authentication works after a full reboot.
- The device appears compliant in the endpoint management console.
For security teams, encryption status is often tracked alongside antivirus, firewall, patch level, and mobile device management enrollment.
A laptop is only considered fully secure when those controls work together.
Best practices for work laptop encryption
Strong encryption works best when paired with disciplined device management.
That means using unique passwords, enabling multi-factor authentication, keeping firmware up to date, and avoiding unapproved software that could weaken system integrity.
- Store recovery keys in approved enterprise systems.
- Keep the operating system patched.
- Do not disable TPM, Secure Boot, or security policies without approval.
- Use a screen lock and short idle timeout.
- Report lost or stolen devices immediately.
When organizations combine full-disk encryption with identity protection and endpoint management, they reduce the impact of theft, travel risk, and accidental exposure.
That is why many security baselines now treat encryption as a standard requirement rather than an optional feature.