You can use BitLocker Drive Encryption to help protect your files on an entire drive. BitLocker can help block hackers from accessing the system files they rely on to discover your password, or from accessing your drive by physically removing it from your PC and installing it in a different one. You can still sign in to Windows and use your files as you normally would.
New files are automatically encrypted when you add them to a drive that uses BitLocker. However, if you copy these files to another drive or a different PC, they’re automatically decrypted.
BitLocker can encrypt the drive Windows is installed on (the operating system drive) as well as fixed data drives (such as internal hard drives). You can also use BitLocker To Go to help protect all files stored on a removable data drive (such as an external hard drive or USB flash drive).
If you like, you can configure the Control use of BitLocker on removable drives group policy setting that controls the use of BitLocker on removable data drives. When this policy setting is enabled you can select property settings that control how users can configure BitLocker. Choose “Allow users to apply BitLocker protection on removable data drives” to permit the user to run the BitLocker setup wizard on a removable data drive. Choose “Allow users to suspend and decrypt BitLocker on removable data drives” to permit the user to remove BitLocker Drive encryption from the drive or suspend the encryption while maintenance is performed. If you do not configure this policy setting, users can use BitLocker on removable disk drives. If you disable this policy setting, users cannot use BitLocker on removable disk drives.
This tutorial will show you how to enable or disable the ability to configure and use BitLocker on removable data drives for all users in Windows 7, Windows 8, and Windows 10.