How to fix “BitLocker Drive Encryption cannot be applied to this drive”
This means the drive is missing something BitLocker needs, usually a separate system partition or an enabled TPM. Preparing the drive or enabling the TPM fixes it. Jump to your situation below or work through the methods in order.
By Neeraj Singh ~7 min Updated Jun 2026 87% found this helpful
Error message
BitLocker Drive Encryption cannot be applied to this drive.
Summary
The error BitLocker Drive Encryption cannot be applied to this drive means the drive does not meet BitLocker's structural requirements. The two usual reasons are a missing separate system partition, BitLocker needs a small unencrypted system partition to boot from, and a TPM that is disabled or absent, which BitLocker uses to store keys on the operating system drive. It can also appear on an unsupported or removable drive, or one with a damaged or non-standard partition layout. The fix is to enable TPM 2.0 in the firmware, make sure a proper system partition exists, and if it does not, prepare the drive with BdeHdCfg, which creates the partition BitLocker needs. For removable drives, BitLocker To Go applies instead. Once the drive has a system partition and the TPM is available, BitLocker can turn on.
What this error means
BitLocker has structural needs. On the operating system drive it requires a small separate system partition to boot from before the encrypted volume unlocks, and it relies on the TPM to hold its keys. If either is missing, it cannot set itself up and reports that it cannot be applied.
So the message is about the drive's layout and the platform, not a fault in your files. Creating the system partition (BdeHdCfg does this automatically) and enabling the TPM give BitLocker the structure it needs. Removable drives use the separate BitLocker To Go path.
Common causes
There is no separate system partition.
The TPM is disabled or not present.
The drive is removable or unsupported for standard BitLocker.
The partition layout is damaged or non-standard.
The drive is the wrong type for the BitLocker mode chosen.
Expert insight
“This message is BitLocker telling you the drive is not laid out the way it needs. The two big causes are no system partition and a TPM that is switched off. So I enable TPM 2.0 in the BIOS, then run BdeHdCfg, which quietly carves out the little system partition BitLocker boots from. After that it almost always applies. If it is a USB stick rather than the system drive, that is BitLocker To Go, a slightly different door.”
Manager, Tech Support & Operations · 19+ years fixing Windows and system errors
✓ How to fix it
Method 1
Enable TPM 2.0 in firmware
1Enter the UEFI firmware and enable the TPM (Intel PTT or AMD fTPM).
2BitLocker uses the TPM to store keys on the system drive.
3Confirm it is ready in tpm.msc, then retry.
Method 2
Prepare the drive with BdeHdCfg
1From an elevated prompt, prepare the drive so it has the system partition BitLocker needs:
BdeHdCfg -target default
2This creates the separate system partition automatically.
3Then turn BitLocker on.
Method 3
Confirm a system partition exists
1In Disk Management, check there is a small System Reserved or EFI system partition.
2If it is missing, BdeHdCfg creates one.
3BitLocker needs this partition to boot before the encrypted volume unlocks.
Method 4
Use BitLocker To Go for removable drives
1If this is a USB or removable drive, use BitLocker To Go rather than standard BitLocker.
2Right-click the drive in Explorer and choose Turn on BitLocker.
3Removable drives do not need a system partition.
Method 5
Allow BitLocker without a compatible TPM (if needed)
1If the PC has no usable TPM, a policy can allow BitLocker with a startup key instead, set Require additional authentication at startup, and allow BitLocker without a compatible TPM.
2Then use a USB startup key.
3Enabling the TPM is preferable where possible.
This error means the drive lacks something BitLocker needs, usually a system partition or an enabled TPM. Enable TPM 2.0 in firmware and run BdeHdCfg to create the system partition automatically. Use BitLocker To Go for removable drives, and a startup-key policy only when the PC genuinely has no TPM.
Frequently asked questions
Why does BitLocker say it cannot be applied to this drive?
Because the drive does not meet BitLocker's structural needs, usually a missing separate system partition or a disabled or absent TPM, or because it is a removable or non-standard drive.
How do I fix it?
Enable TPM 2.0 in firmware and run BdeHdCfg -target default from an elevated prompt to create the system partition BitLocker needs, then turn BitLocker on.
What is BdeHdCfg?
It is the BitLocker drive preparation tool. BdeHdCfg -target default creates the small separate system partition that BitLocker requires to boot before the encrypted volume unlocks.
Why does BitLocker need a system partition?
BitLocker boots from a small unencrypted system partition, then unlocks the encrypted operating system volume. Without that partition it has nowhere to boot from, so it cannot apply.
Can I use BitLocker without a TPM?
Yes, with a policy that allows BitLocker without a compatible TPM and a USB startup key, but enabling the TPM is the better path where the hardware supports it.
What about a USB drive?
Use BitLocker To Go for removable drives. Right-click the drive in Explorer and choose Turn on BitLocker; removable drives do not need a system partition.
Still not working?
If a system partition exists and the TPM is on but it still cannot apply, the partition layout may be non-standard or the boot configuration damaged. Verifying the EFI system partition and repairing the boot files often clears it. You can also submit your error to us for a tailored fix.
