Yellow exclamation mark on the C drive in Windows 11/10: what it means

What the yellow warning means

Microsoft explains this icon in its BitLocker documentation. After a clean installation of Windows, device encryption starts encrypting the system drive with a clear key, which Microsoft describes as equivalent to BitLocker’s suspended state. In that state, the drive shows a warning icon in File Explorer. The yellow icon goes away once Windows creates a TPM protector and backs up the recovery key.

In plain terms, your data is encrypted but the lock isn’t engaged. Anyone who took the drive out could still read it, because the key sits next to the data. Some users see the drive described as BitLocker waiting for activation when they hover over it or check its status.

Microsoft lists the reasons it stays this way. On a personal PC, the clear key is only removed when an administrator signs in with a Microsoft account, so the recovery key can be uploaded. On a PC that only uses local accounts, Microsoft says the device remains unprotected even though the data is encrypted. Since Windows 11 version 24H2 removed some hardware prerequisites, more PCs qualify for automatic encryption, so more people are noticing the icon on new installs.

The other common cause is plain suspension: protection was paused for a firmware update or by an administrator and never resumed. Our guide to BitLocker suspended covers that state in more depth.

Check which state your drive is in

Open Command Prompt as administrator and run:

manage-bde -status C:

Look at three lines. Conversion Status tells you whether the drive is fully encrypted or still encrypting. Protection Status shows whether protection is on or off. Key Protectors lists what protects the key; if it shows none, or no TPM entry, you’re in the clear-key state described above. In PowerShell, Get-BitLockerVolume C: | fl shows the same information.

• Still encrypting: leave the PC on and plugged in. Microsoft notes encryption can pause while you’re using the PC or on battery.
• Protection off, no TPM protector: follow the Home or Pro fix below.
• Protection off, protectors listed: protection is suspended; resume it.

Fix on Windows 11/10 Home: sign in with a Microsoft account

This is the route Microsoft designed. Sign in to Windows with a Microsoft account that is an administrator on the PC, or add one under Settings > Accounts > Your info with Sign in with a Microsoft account instead. Windows then uploads the recovery key to that account, adds the TPM protector and removes the clear key.

You can also go to Settings > Privacy & security > Device encryption and make sure it’s On. Microsoft’s support page notes that device encryption isn’t turned on automatically for local accounts. If the Device encryption page is missing, open System Information (msinfo32) and check Device Encryption Support; it should say Meets prerequisites.

Fix when protection is suspended

On Pro, Enterprise and Education, open Control Panel, go to System and Security > BitLocker Drive Encryption and select Resume protection next to the C drive. The PowerShell equivalent, in an admin window, is:

Resume-BitLocker -MountPoint "C:"

If resuming fails or does nothing, the drive probably has no TPM protector yet, which means you’re in the clear-key state; use the next section.

Fix on Pro with a command

If you don’t want to use a Microsoft account, you can add the protectors yourself with manage-bde. This sequence is built from Microsoft’s documented -protectors options:

manage-bde -protectors -add C: -tpm
manage-bde -protectors -add C: -recoverypassword
manage-bde -protectors -enable C:

The second command prints a 48-digit recovery password. Write it down or save it somewhere other than the C drive before you continue. Microsoft describes -enable as removing the unsecured key so the protectors are enforced. Run manage-bde -status C: again afterwards; protection should show as on, and the yellow icon should disappear after a refresh or restart.

Confirm your recovery key is saved

Before and after any fix, check that the key exists where you expect it. For a Microsoft account, sign in at aka.ms/myrecoverykey and look for an entry dated around when you set up the PC. In the BitLocker control panel you can also choose Back up your recovery key to save it to your account, a file on another drive, a USB stick or paper. Microsoft says its support staff can’t recover a lost key, and our recovery key guide covers where else to look.

Should you turn BitLocker off instead?

Several sites suggest manage-bde -off C: to make the icon go away. That works, but it fully decrypts the drive, which takes time and leaves your data unencrypted if the laptop is lost. Microsoft also notes that once device encryption is turned off, it won’t switch itself back on later. Unless you have a specific reason, finishing the setup is the better choice. If you do decide to decrypt, our guide to unencrypting files and drives walks through it. Running CHKDSK or disk repair tools won’t change the icon, because nothing is wrong with the disk.

Related guides

• BitLocker suspended: what it means and how to resume protection
• Dell BitLocker recovery key: where to find it and why it appears
• How to unencrypt files in Windows 11 and 10 (EFS, BitLocker and more)
• How to clear the TPM in Windows 11 and 10 (and what you lose)

Official sources

• BitLocker overview: device encryption (Microsoft Learn)
• Device encryption in Windows (Microsoft Support)
• manage-bde protectors (Microsoft Learn)