A systems administrator deploys BitLocker to all devices.

BitLocker Drive Encryption in Windows requires aTrusted Platform Module (TPM)to encrypt the boot drive securely. The TPM is a dedicated microcontroller designed to secure hardware through integrated cryptographic keys. It validates system integrity during boot and securely stores the encryption keys. If BitLocker cannot find a TPM or it is disabled in BIOS/UEFI, drive encryption cannot proceed.

BitLocker can function without TPM using a USB startup key, but this compromises some security and is not recommended for managed enterprise environments.