Direct answer
Check the encryption and protection status of each relevant volume, compare it with the device policy, and verify that an authorized recovery process exists. An encrypted volume with suspended protection needs separate investigation.
Define which volumes need protection
Record the device owner, Windows edition and the operating system, fixed data and removable volumes in scope. A laptop with confidential offline data may have different requirements from a disposable test device. Determine the approved policy and who manages encryption before touching settings.
Read the actual volume state
On the authorized device, an administrator can use manage-bde -status or the BitLocker management interface to inspect conversion status, percentage encrypted and protection status for each volume. Capture the result and timestamp, but never copy recovery passwords into a general findings ticket.
Encryption in progress, an unencrypted volume and suspended protection are different states. Check for an approved maintenance window or deployment in progress before classifying a mismatch.
Reference: Microsoft: Troubleshoot BitLocker issues.
Confirm recovery readiness
Ask the designated recovery administrator to confirm that the correct device's recovery information is backed up in the organization's approved directory and that an authorized support process can retrieve it. Test the procedure under an approved plan without exposing the secret. Firmware or boot changes can trigger recovery.
Resolve and verify
Coordinate remediation with the device owner and follow the approved management policy. After encryption or a protection change, recheck each affected volume and note any remaining conversion activity or exception. Verify that the device still boots and that the recovery path is available before closing the issue.
Assessment limits
Drive encryption protects data at rest under particular conditions; it does not prevent a signed-in attacker from using data already accessible to a user. Device eligibility, management and volume type affect the available controls.
Frequently asked questions
Does an encrypted drive mean protection is active?
Not always. Check both conversion and protection status; protection can be suspended during maintenance.
Should recovery keys be included in a security report?
No. Record whether the approved recovery process was verified, and keep recovery secrets only in the authorized storage system.
Does BitLocker replace backups?
No. Encryption and recovery keys do not replace tested backups of important data.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.