What you’re seeing
- The Intune encryption report shows devices as "Not encrypted" weeks after the policy was assigned.
- Users see a prompt asking them to start encryption instead of it happening silently in the background.
- The policy reports errors such as a TPM not being available or not ready, or the recovery key failing to back up.
- Some laptop models encrypt correctly while others in the same group never do.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- The TPM is disabled, not ready, or the device is running in legacy BIOS mode instead of UEFI with Secure Boot.
- Silent encryption requires settings that suppress user prompts and allow standard users to start encryption, and one of them is missing.
- Encryption method or startup authentication settings in the policy conflict with each other, or with another profile.
- The policy requires the recovery key to be stored in Entra ID before encryption starts, and that backup is failing.
- Third-party disk encryption or an earlier partial BitLocker setup is already present on the drive.
- The Windows recovery partition is missing or too small, which blocks BitLocker from preparing the drive.
Why it matters
An unencrypted laptop turns a routine theft or loss into a potential data breach. Without BitLocker, anyone with the device can remove the drive and read customer records, financial files and saved passwords. Many state breach-notification laws, industry regulations and cyber insurance policies treat encrypted devices very differently from unencrypted ones, so a policy that looks assigned but is not actually working can leave the business exposed without anyone realizing.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Will turning on BitLocker slow our computers down?
On modern hardware, the performance impact is negligible for everyday work. The initial encryption runs in the background and users can keep working.
What happens if someone gets locked out after encryption?
That is exactly why recovery keys must be safely stored in Entra ID before encryption completes. Confirming that key backup works is part of resolving this issue.
Do we need to touch every laptop individually?
Usually not. Most causes are fixed in the policy or firmware settings and applied centrally, with only a few devices needing individual attention.