Key takeaway
Decrypt a drive only when protection is no longer required; do not use it as a general troubleshooting step. Get the IT owner’s approval for managed devices.
What BitLocker protects
BitLocker encrypts a Windows volume and limits unauthorized reading on a powered-off device or a drive attached to another system. Unlocking, suspending protection and fully decrypting are different operations. Suspension keeps the data encrypted but temporarily removes normal protection; resume it after approved maintenance. Repair or reassignment alone does not require decryption. Decryption does not replace secure sanitization.
| Action | Effect on data | When to use |
|---|---|---|
| Unlock | Encryption remains; authorized reading is enabled | Authorized access to a locked volume |
| Suspend | Data stays encrypted; protectors are temporarily suspended | Approved maintenance; resume protection afterwards |
| Decrypt | Encryption is removed | Protection is no longer required; verify conversion |
Prepare first
Make a separate backup of important files, locate the recovery key and confirm that it belongs to the target volume. Connect a laptop to power; decrypting a large volume takes time. Check administrator access and organizational policy. If a work device lacks its key or the disable option is unavailable, do not work around policy; contact its administrator. Keep recovery material in an approved protected location separate from this device.
Decrypt through Control Panel
Open BitLocker Drive Encryption in the Windows Control Panel, select the target volume and confirm “Turn off BitLocker.” Menus can differ by Windows edition and organizational policy. Use reliable power and check progress; an ordinary restart does not necessarily damage decryption.
Command line and PowerShell
In an elevated terminal, check the volume with manage-bde -status. For approved decryption, run manage-bde -off D:; replace D: with the correct volume letter. In PowerShell, use Disable-BitLocker -MountPoint "C:". Substitute the right mount point for another drive. The manage-bde -off command disables protectors during conversion and removes them when decryption completes. Confirm the volume and authorization first; do not put recovery secrets in commands or logs.
Check progress and completion
Check manage-bde -status or Get-BitLockerVolume: Fully Decrypted and 0% encryption, or equivalent tool fields, confirm completion. Protection Off alone is insufficient because it can mean suspension. A large or slow drive may take hours. A locked volume needs valid, authorized password or recovery material. Keep the key in an approved protected location separate from the device and prevent unauthorized access. Contact the administrator if recovery material is missing.
After decryption
If the device will remain in use, restore disk encryption according to its loss and theft risk, and store the recovery key in the organization’s approved secure repository. Decryption does not securely erase confidential files; complete the approved wipe and asset process before reassignment. Investigate unexpected encryption changes, unknown scripts and simultaneous changes across multiple devices.