How to encrypt USB drive

Summary

This guide helps you troubleshoot and resolve: How to encrypt USB drive. Follow the steps below to fix the issue.

Common Causes

Problem

You need to encrypt a USB flash drive to protect sensitive company data in case the drive is lost or stolen.

Why encrypt?

• Protects confidential data if the USB is lost or stolen
• Required by many company security policies
• Prevents unauthorised access to business files

Solutions

Method 1: Use BitLocker (recommended for Windows 11)

Check if BitLocker is available

1. Insert the USB drive.
2. Right‑click the drive in File Explorer.
3. If you see Turn on BitLocker, the feature is available.
4. If not, your edition of Windows may not support BitLocker To Go, or a Group Policy may be blocking it.

Encrypt the USB with BitLocker

1. Right‑click the drive and select Turn on BitLocker.
2. Choose Use a password to protect the drive and enter a strong password (refer to the company password policy for requirements).
3. Save the recovery key – print it or store it in Azure AD, your Microsoft account, or another secure location separate from the USB.
4. Select Encrypt entire drive (more secure, slower).
5. Choose Compatible mode if the drive will be used on older Windows versions.
6. Click Start encrypting and wait for the process to finish.

Using the encrypted USB

1. Insert the USB into any company computer.
2. Enter the password when prompted.
3. Access your files normally.

Troubleshooting BitLocker

• Option not visible: Verify that you are running a Windows edition that includes BitLocker To Go (Pro, Education, Enterprise). Check gpedit.msc for Turn on BitLocker To Go policy settings.
• TPM requirements: BitLocker on removable drives does not require a TPM, but some corporate policies may enforce TPM‑based checks. Contact IT if you encounter TPM‑related errors.
• Write‑protected drive: Ensure the USB switch (if present) is set to write‑enable, and that the drive is not marked read‑only in Disk Management.
• Recovery key retrieval: In Azure AD‑joined devices, the recovery key is automatically backed up to Azure AD. Retrieve it via the My Devices portal. For personal Microsoft accounts, visit the Microsoft account devices page.
• Group Policy restrictions: Some organisations disable BitLocker for removable media. If you suspect a policy is blocking the feature, open a ticket with IT.

Method 2: Use Windows built‑in encryption (EFS) – not recommended for removable drives

EFS only works on NTFS‑formatted volumes and the encrypted files are tied to the user account that performed the encryption. Removable drives formatted as FAT32 or exFAT cannot be encrypted with EFS, and the data will not be accessible on other computers.

Method 3: Use company‑approved encryption software

1. Open the Company Portal (Software Center) and look for approved tools such as “ESET Endpoint Encryption” or “McAfee Complete Data Protection”.
2. If no tool is listed, Open a Ticket to request the appropriate software.
3. Follow the vendor’s documentation to encrypt the USB drive.

Method 4: Use 7‑Zip (third‑party option)

1. Download 7‑Zip from the official website.
2. Right‑click the files or folders on the USB, choose 7‑Zip → Add to archive.
3. Set “Archive format” to “zip”.
4. Enter a password (minimum 12 characters recommended).
5. Check “Encrypt file names” for additional security.
6. Click OK to create the encrypted archive.
7. To access the files, extract the archive and provide the password.

Best practices for USB encryption

• Use strong passwords (12+ characters, mixed case, numbers, symbols) in line with the company password policy.
• Never store the password on the same USB drive.
• Keep the recovery key in a secure location separate from the device (Azure AD, Microsoft account, or a physical safe).
• Only use USB drives approved by IT for sensitive data.
• When travelling, keep encrypted USBs with you – not in checked luggage.
• Consider formatting to NTFS only if you need compatibility with very old Windows versions; otherwise, FAT32 or exFAT are acceptable for BitLocker.

For broader guidance on Windows security features, see How to protect your PC with built‑in Windows security features.

Need more help?

If you need a company‑approved encryption tool, are unsure which method to use, or require assistance with the encryption process, please Open a Ticket.

Still Having Issues?