Disable BitLocker: When to Turn It Off vs Suspend

BitLocker is Windows’ full-disk encryption tool that protects your data if your device is lost or stolen. This guide shows you how to permanently disable BitLocker on your system drive or removable drives, and explains when you should suspend protection instead—a faster, safer option for temporary tasks like firmware updates. You’ll need administrator rights and, for the system drive, your recovery key if you’ve lost the password.

What You’ll Need

• Windows 10 or 11 Pro, Enterprise, or Education edition (BitLocker is not in Home)
• Administrator account access
• Your BitLocker recovery key (48-digit number) if you’re disabling on the system drive and don’t have the password
• For external drives: the drive must be unlocked before you can change settings

Step-by-Step

Disable BitLocker on the System Drive (C:)

1. Open the Start menu, type Control Panel, and press Enter.
2. Go to System and Security → BitLocker Drive Encryption.
3. Find your system drive (usually C:) in the list. Click Turn off BitLocker.
4. A confirmation prompt appears. Click Turn off BitLocker again.
5. Windows begins decrypting the drive. This can take from minutes to hours depending on drive size and speed. You’ll see a progress notification in the system tray.
6. Once decryption finishes, the drive is no longer encrypted. You can verify by checking the Control Panel—BitLocker should show as Off.

Disable BitLocker on a Removable Drive (USB, External HDD)

1. Plug in the drive and unlock it if prompted (enter password or use auto-unlock).
2. Open Control Panel → BitLocker Drive Encryption.
3. Click Turn off BitLocker next to the removable drive.
4. Confirm and wait for decryption to complete. The drive will be accessible like any normal drive.

Suspend BitLocker (Temporary)

1. Open Control Panel → BitLocker Drive Encryption.
2. Click Suspend protection next to the drive.
3. In the dialog, click Yes to confirm. BitLocker is now paused—the drive stays encrypted but uses a plaintext key, so it’s not protected.
4. To resume, click Resume protection in the same location. Windows also automatically resumes after a reboot if you don’t manually resume.

Common Mistakes

• Confusing suspend with disable: Suspend is temporary and resumes automatically on reboot. Disable fully decrypts the drive. Don’t suspend if you want permanent removal.
• Not having the recovery key: If you disable on the system drive and can’t log in, you’ll need the 48-digit key. Store it in your Microsoft account or print it before starting.
• Interrupting decryption: Don’t shut down or restart during decryption. If interrupted, Windows will resume the process on next boot, but it can cause errors.
• Disabling on a drive with important data without backup: Though rare, decryption errors can corrupt data. Always back up critical files first.

Tips

• Use Suspend for firmware updates, BIOS changes, or when you need to boot into a different OS temporarily. It’s much faster than decrypting.
• If you’re selling or giving away a computer, disable BitLocker and then perform a full drive wipe to ensure data is unrecoverable.
• For external drives, consider using BitLocker To Go with a password instead of disabling—you can still read the drive on other systems with the password.
• Check if your drive supports hardware encryption—decryption may be faster on SSDs with built-in encryption.

Troubleshooting

• “Turn off BitLocker” is grayed out: You may not have admin rights. Right-click Control Panel and select Run as administrator. Or, if the drive is locked, unlock it first.
• Decryption stuck at a percentage: Wait—large drives can take hours. If it hasn’t moved for over an hour, restart the PC. Windows will resume decryption automatically.
• BitLocker asks for recovery key after disabling: This can happen if decryption didn’t complete. Boot to Windows, enter the recovery key, and check the BitLocker status. If it still shows encrypted, run manage-bde -status C: in Command Prompt (admin) to see the encryption state.
• Cannot suspend because of Group Policy: Some organizations enforce a policy that disables suspension. You’ll need to contact your IT admin.
• Error 0x80070057 during decryption: This often indicates a corrupted BitLocker metadata. Run repair-bde with the recovery key, or use manage-bde -unlock first.

Frequently Asked Questions

What’s the difference between suspend and disable?

Suspend temporarily pauses encryption protection without decrypting the drive. It’s useful for short tasks and automatically resumes after a reboot. Disable fully decrypts the drive, removing encryption permanently.

How long does decryption take?

It depends on drive size and speed. A 256GB SSD might take 30-60 minutes, while a 1TB HDD could take several hours. You can continue using the computer during decryption, but performance may be slower.

Will I lose my files when I disable BitLocker?

No, disabling BitLocker only decrypts the drive—your files remain intact. However, it’s always wise to back up important data before making major changes.

Can I disable BitLocker without admin rights?

No, you need administrator privileges. If you’re on a work or school computer, contact your IT department.

Is it safe to suspend BitLocker for a BIOS update?

Yes, that’s one of the recommended uses. Suspend protection before the update, and Windows will resume it automatically after reboot. This prevents the system from asking for the recovery key during the update.

What happens if I lose my recovery key?

If you can’t log in and don’t have the key, you may be locked out of your data. The key is often stored in your Microsoft account (account.microsoft.com/devices/recoverykey) or in Active Directory if it’s a domain-joined PC.

Related

• WSUS Server & Computer Reports: Step-by-Step
• Nights in the Forest Events Schedule
• Gaming Tips for Beginners: Start Strong