how to enable bitlocker

Hello,

Thank you for reaching out.

The error 0x80310031 indicates that the C: drive already has a TPM protector enabled.

The Enable-BitLocker cmdlet is used for the initial encryption of an unprotected drive. Since a TPM protector is already present, the command fails because it cannot add a duplicate one. You must decrypt the drive first and then re-encrypt it with the new settings.

1. Check Current Status: Verify the drive's status. You will likely see ProtectionStatus is On.

      Get-BitLockerVolume -MountPoint "C:"Get-BitLockerVolume -MountPoint "C:"
   

2. Decrypt the Drive: Disable BitLocker to start the decryption process. Ensure you have your BitLocker Recovery Key backed up.

      Disable-BitLocker -MountPoint "C:"
   

3. Re-enable BitLocker with the New Method: Once the drive is fully decrypted, run your original command to enable the desired encryption method.

      Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmProtector
      Resume-BitLocker -MountPoint "C:"
   

If you find this helpful, please accept the answer.

Best regards.

Control Panel\All Control Panel Items\BitLocker Drive Encryption also show the status of bitlocker.