Two Microsoft tools, two different failures

Find My Device is a location and remote-lock feature. Microsoft Support says it can help you locate a Windows 10 or Windows 11 device if it is lost or stolen. You must sign in with a Microsoft personal account. The setting has to be on before you need it. The account type must be Administrator. Location must be on for the device. Microsoft also warns that any time you try to locate the device, people using it will see a notification.

BitLocker is volume encryption. Microsoft Learn (updated July 29, 2025) says BitLocker addresses data theft or exposure from lost, stolen, or badly decommissioned devices. A thief can boot attack tools or move the drive into another computer. BitLocker is meant to make that data inaccessible. Device encryption is the simpler automatic form of the same idea on qualifying PCs.

If you only turn on Find My Device, a skilled thief can still clone an unlocked disk. If you only turn on BitLocker and never back up the recovery key, you can lock yourself out of your own files. If you turn on neither, the laptop is a map with no lock and a disk with no lock.

Related setup work belongs in the six Windows 11 settings to change first. That list already says to confirm device encryption. This page adds the lost-laptop path: Find My Device, remote lock, and the recovery key.

What published Microsoft pages agree on

TPM is a Trusted Platform Module. It is a small security chip. Microsoft Learn says BitLocker is strongest with a TPM 1.2 or later. The TPM helps check that the PC was not tampered with while it was off. Without a TPM, BitLocker can still encrypt the system drive, but you must use a startup key on a USB drive. A password-only option exists and is discouraged. Microsoft says it is not secure against brute force and is disabled by default.

Device encryption is BitLocker turned on automatically for some PCs. Microsoft Learn says it is available on all Windows versions that meet the hardware rules. It encrypts the OS drive and fixed drives. It does not encrypt USB drives. The default method is XTS-AES 128-bit. Starting in Windows 11 version 24H2, Microsoft removed the old DMA and HSTI / Modern Standby prerequisites, so more PCs qualify. If the PC only has local accounts, Microsoft Learn says it remains unprotected even though the data is encrypted, because the recovery key is not backed up to an online account.

How Find My Device actually works

Microsoft’s steps are short. Sign in on the laptop with a personal Microsoft account that is an Administrator. Open Find my device settings and turn the feature on. Keep location on. That setting still works even if other people on the PC turned location off for their apps.

After a loss, use a different device. Go to account.microsoft.com/devices. Open the Find My Device tab. Pick the laptop. Select Find to see a map. If you want to lock it, select Lock, then Next. Microsoft says that once it is locked, you can reset your password for added security.

The notification warning matters. If the laptop is in a thief’s hands and still online, a locate ping can tell them you are watching. That does not mean you should skip Find My Device. It means a locate is not a silent sting. Microsoft also tells you to report the theft. The serial number lives on the same devices page under Info and support.

Find My Device does not decrypt a BitLocker volume for a stranger. It also does not replace a recovery key for you. Different lock, different key.

Work or school accounts are a different map. The Find My Device support page is written around a Microsoft personal account. If the laptop is an Entra-joined work PC, the recovery key story on Microsoft’s BitLocker page is the org’s backup, not the consumer Find My Device tab. Do not mix those portals.

How BitLocker still helps when the chassis is gone

Encryption does not beep. It does not show a map. It makes the bytes on the drive unreadable without the protectors Windows expects. Microsoft Learn describes the threat: someone runs attack tools, or they move the drive to another machine. BitLocker is the counter to that second case.

On a consumer Windows 11 PC, device encryption may already be running. Check Settings → Privacy & security → Device encryption, which is the path on the settings article. Microsoft Learn says the Settings app will not show device encryption as on until encryption finishes. A yellow warning icon on the drive in Explorer can appear while a clear key still exists, before the TPM protector and recovery backup are done.

If you sign in with a Microsoft account that has admin rights, Microsoft Learn says the clear key is removed, a recovery key is uploaded to that Microsoft account, and a TPM protector is created. If you only use a local account, the volume can be encrypted and still lack that online backup. That is the “encrypted but unprotected” line. It is easy to miss.

If Windows later cannot unlock the drive, it asks for a BitLocker recovery key. Microsoft Support says that key is a 48-digit number. Hardware changes and security risks can trigger the prompt. Microsoft Support cannot recreate the key. Starting in Windows 11 version 24H2, the recovery screen can show a hint of the Microsoft account that holds the key. From another device you open aka.ms/myrecoverykey, sign in, and match the recovery key ID. Write down the first eight digits of that ID when the locked PC shows it.

If the laptop was ever signed into work or school, the key might be in that org instead. Microsoft’s consumer recovery article points to aka.ms/aadrecoverykey for that case.

Resetting the device because you lost the key will remove files. Microsoft says that outright. Encryption without a stored key is a shredder you cannot reverse.

Three situations after the laptop leaves the house

Situation 1: The laptop is still online, and you have Find My Device already on

Use a phone. Open account.microsoft.com/devices. Find the PC. Microsoft’s locate step shows a map. Microsoft’s lock step can lock the device. People using the PC will have seen a notification if you located it. Report the theft to police and insurance. Copy the serial number from Info and support.

Encryption still matters here. A lock screen is not the same as an encrypted volume. If device encryption was never finished, a disk clone can still be readable. Do not wait for the map before you check encryption on any laptop you still have at home.

Situation 2: The laptop is offline, or Find My Device was never enabled

Microsoft Support says the feature must be on first. There is no retroactive map. Police still get the serial number if you saved it. Insurance still gets a report. The remaining protection is whatever encryption was already on the drive.

If BitLocker or device encryption was on, and the recovery key is in your Microsoft account, the thief has a brick for your files even if they never see a map. If encryption was off, treat the files as exposed. Change passwords from another device for every account that stayed signed in: Microsoft, Google, work VPN, password manager. Find My Device would not have fixed that either.

This is why the settings article puts encryption in the first-week list. Lost-laptop features do not time-travel.

Situation 3: You still have the PC, but Windows is asking for a 48-digit key

This is not a theft. It is the recovery prompt. Microsoft Support says to note the recovery key ID, then retrieve the matching key from the Microsoft account, a work account, a printout, or a USB file. Windows 11 24H2 may hint which Microsoft account to try.

If you cannot find the key, Microsoft says you may have to reset the PC and lose the files. Do not format first in a panic if the key might be in another person’s Microsoft account — the one who set the PC up. Microsoft’s recovery article flags that case.

Keep the 48-digit key somewhere that is not only on the encrypted disk. A password manager on a phone is fine. A printed sheet in a drawer is what Microsoft still describes.

How to apply this tonight on a laptop you still hold

Sign in with a personal Microsoft account that is an Administrator. Local-only is the path Microsoft Learn calls unprotected even when encryption ran.

Turn on Find My Device. Keep location on. Open the devices page once so you know what the list looks like. Confirm the serial number is visible under Info and support.

Confirm device encryption or BitLocker. On many home PCs the Settings toggle is enough. On Windows 11 Pro you may also see BitLocker in Control Panel. The sibling BitLocker vs device encryption page is the edition map. This page only needs the outcome: the OS drive is encrypted, and a recovery key exists off the machine.

Open aka.ms/myrecoverykey from a phone. Confirm a 48-digit key is listed for this PC. If the list is empty, encryption may still be in the “clear key” window, or the PC may not have qualified, or you used a local account. Fix that before the laptop travels.

If the PC is work-joined, ask IT where the key lives. Do not assume the consumer Find My Device tab is the work portal.

Do not turn device encryption off to “speed up” the disk. Microsoft Learn recommends leaving it on. If you do turn it off, Microsoft says it will not turn itself back on automatically. You would have to enable it again in Settings.

Mistakes that look like security

Mistake one: enabling Find My Device and skipping encryption. A map does not scramble a disk.

Mistake two: enabling encryption and never storing the 48-digit key. Microsoft cannot recreate it.

Mistake three: using only a local account and thinking the yellow drive icon means you are done. Microsoft Learn says that consumer backup path needs a Microsoft account with admin rights.

Mistake four: locating the device every five minutes. Each locate can notify whoever is using it.

Mistake five: calling Microsoft Support for the recovery key. They will not have it. The aka.ms/myrecoverykey page is the consumer path.

Mistake six: encrypting a USB backup drive in your head. Device encryption does not cover external USB drives. If the backup of tax PDFs is on a stick, that stick needs its own plan.

Mistake seven: waiting until 24H2 because you heard more PCs qualify. That change helps new setups. It does not encrypt a disk you never turned on.

Mistake eight: posting the 48-digit key in a screenshot. Treat it like a password. The recovery key ID is the short handle. The key is the secret.

Who this page is for, and who should skip it

This page is for a person with a Windows 11 home or small-office laptop, a Microsoft personal account, and a real risk of a bag going missing. It is also for the person who already lost the PC and needs the Microsoft sequence in one place: map, lock, police, recovery key, password reset.

Skip this page if you need a full BitLocker enterprise rollout. Microsoft Learn’s BitLocker overview is written for IT. Skip it if you are choosing between Home and Pro encryption SKUs — that is the BitLocker vs device encryption article. Skip it if you want a product tracker tag review. Find My Device is a Microsoft account feature, not a third-party gadget.

If the laptop is already gone and Find My Device was off and encryption was off, this page cannot create a map or scramble the past. Change passwords. Call the police. Use the serial number if you have an old receipt. Then do the checklist on the next PC the same day you unbox it.

FAQ

Can I turn on Find My Device after the laptop is stolen?

Microsoft Support says it needs to be turned on before you can use it. If it was off, there is no locate step to open.

Does locking the PC with Find My Device encrypt the drive?

No. Lock is a remote lock. BitLocker or device encryption is the volume encryption. You want both, and you want them before the loss.

Where is the BitLocker recovery key for a home Microsoft account?

Microsoft Support points to aka.ms/myrecoverykey on another device. Match the recovery key ID. Microsoft cannot recreate a lost key.

What if I only have a local Windows account?

Microsoft Learn says a device that uses only local accounts remains unprotected even if the data is encrypted, because the consumer recovery backup is not in place. Add a Microsoft account with admin rights, then confirm the key exists online.

Should I still call the police if I can see the laptop on a map?

Microsoft recommends reporting a stolen device to local law enforcement and your insurance company. The serial number is on the devices page under Info and support.

Did Windows 11 24H2 change who gets device encryption?

Yes. Microsoft Learn says 24H2 removed DMA and HSTI / Modern Standby prerequisites, so more devices can get automatic or manual device encryption. Check System Information for “Device Encryption Support: Meets prerequisites.”

Sources

• Find or lock a lost Windows device — Microsoft Support
• BitLocker overview — Microsoft Learn (updated July 29, 2025)
• Find your BitLocker recovery key — Microsoft Support