How to configure MikroTik for a small business: a secure baseline step by step
Update RouterOS, replace the admin user, close management services, set up the firewall and a guest network — with ready-to-use commands.
Read articleLaptops get lost and stolen. Without disk encryption, anyone can remove the drive and read documents, saved passwords and email. BitLocker is built into Windows Pro, Enterprise and Education editions and protects the whole drive with practically no effect on daily work.
Before you start: you need Windows 10/11 Pro or higher and a TPM chip (present in almost all business laptops from recent years). Run the commands in an administrator Command Prompt or PowerShell.
Step 1. Check the current status
See whether the system drive is already encrypted.
manage-bde -status C:Step 2. Turn on BitLocker
Open Settings → Privacy & security → Device encryption or Control Panel → BitLocker Drive Encryption and turn it on for the system drive. Encryption runs in the background; the laptop can be used meanwhile. In a domain or Microsoft Intune environment, enable it centrally with a policy instead.
Step 3. Save the recovery key in the right place
Without the 48-digit recovery key, data cannot be recovered after a hardware change or a forgotten PIN. Store keys in Active Directory, Microsoft Entra ID / Intune or the company password manager — never only on the laptop itself or on a sticky note.
manage-bde -protectors -get C:Step 4. Encrypt removable drives too
USB drives with company data should be encrypted with BitLocker To Go. Consider a policy that blocks writing to unencrypted removable drives.
Also important
- Automatic screen lock after a few minutes.
- Strong sign-in: Windows Hello or a strong password.
- A procedure for lost devices: who is notified, which accounts are blocked.
With encryption, a stolen laptop is just a stolen laptop.
Need help with this? Contact CySec for a free consultation.