>

Re-Lock a BitLocker Drive with manage-bde -lock

Once unlocked, a BitLocker data drive stays open — manage-bde -lock is the forgotten command that re-secures it without rebooting.

WindowsbitlockeradminencryptionMedium risk
Run manage-bde -lock D: in an elevated prompt to remove the encryption keys from memory and re-lock the volume.

01Command

Command
$ manage-bde -lock D:

02What it does

Windows automatically unlocks BitLocker data drives after you enter the password and never re-locks them until reboot — anyone sitting at the machine keeps full access. manage-bde -lock clears the keys from memory immediately. It only works on data drives (not the OS drive) and fails if any program still has files open on the volume, so close Explorer windows first.

03Risk

RiskMedium risk
RequirementsRun in an elevated prompt; only works on fixed data drives that were unlocked with a password/smart card (not the OS drive)
!Warning: The lock fails while files on the drive are open by any process; close them first.

04Undo

Undo
$ manage-bde -unlock D: -Password

05Sources

  • manage-bde lock (Windows Commands)
    Microsoft Learn · vendor-doc · 2026-09-17
    Evidence: Documents manage-bde -lock re-locking a BitLocker-protected drive after it has been unlocked, and its limitations.

Last verified: 2026-09-17 · Category: Security & Privacy