BitLocker Encryption

The BitLocker Encryption check verifies on Windows devices (x64, ARM64) that the operating-system volume and fixed data drives are protected by BitLocker and fully encrypted. It runs locally through the octoja agent, every 60 minutes by default.

Prerequisites

• You need the Monitoring Check Management permission.

Steps

1. Go to Devices and open the device.
2. Click the Checks tab → Add Check → BitLocker Encryption.
3. Enable Operating-system volume only if needed.
4. Click Add Check.

To roll it out to many devices at once, use a config package.

Settings

Results

The check rates each volume separately. The overall result is the worst individual status.

For each volume, the check shows the drive letter or mount point, the protection status, the volume status and the encryption percentage.

• A running decryption also only raises a warning. Once it has finished, the check reports the volume as critical.
• If BitLocker protection is temporarily suspended, for example during a BIOS or firmware update, the check reports the volume as critical until protection is resumed.
• Unavailable BitLocker, missing volumes and failed queries raise a warning, not a critical status. The detail view names the reason.

See also: Assign checks with config packages · Set up alerts for a check