How to Add or Remove BitLocker Context Menu Entries in Windows 11

While BitLocker is typically managed through the Control Panel or Settings, customizing the context menu provides quick access to its features, including unlocking and locking a drive. If you’re looking for ways to streamline your BitLocker experience, you’re in the right place.

This guide will walk you through ways to add or remove BitLocker-related context menu options in Windows 11, along with troubleshooting tips for known common issues.

Add or remove BitLocker options in the right-click menu

BitLocker Drive Encryption provides full-disk and removable drive encryption, forming a core security layer of security in supported Windows environments. However, when managing multiple endpoints, manually navigating BitLocker menus per device can be repetitive and time-consuming.

To speed up the process, you can deploy configurations across endpoints, ensuring BitLocker access through the Windows context menu. For administrators and technicians, context menu accessibility boosts their efficiency and consistency, especially when managing bulk encryption workflows.

Before you start, check if you meet the following prerequisites to ensure a smooth configuration process:

• Windows 11 Pro, Enterprise, or Education endpoint
• Administrator rights for registry edits
• Awareness of the current encryption status of drives
• Optional: backup of recovery keys before making changes

📌 Recommended deployment strategies:

Step 1: Add BitLocker context menu entries via the Registry Editor

The Windows Registry enables context menu customization, allowing administrators to control how BitLocker controls appear in the context menu. By leveraging Registry-based configuration, you gain high-level granularity, allowing you to add new context menu entries, restore removed ones, or adjust them for specific drive types.

💡 Note: Depending on your Windows build and existing policies, some BitLocker context menu keys may already be present by default.

📌 Prerequisite: Back up the Registry before proceeding. (See ⚠️ Things to look out for)

1. Press Win + R, type regedit, then press Enter.
2. Navigate to HKEY_CLASSES_ROOT\Drive\shell.
3. Right-click the shell key, select New > Key, then name it according to the entry you want to add; for example:

• • manage-bde: You can set this to open the BitLocker Control Panel.
  • lock-bde: Configure this to lock a BitLocker-encrypted drive.
  • unlock-bde: Unlock a BitLocker-protected drive using this option.

4. Under each created key, create a subkey and name it command, then set the BitLocker action in each corresponding subkey’s default value:

• • manage-bde: control.exe /name Microsoft.BitLockerDriveEncryption
  • lock-bde: manage-bde -lock %1
  • unlock-bde: manage-bde -unlock %1: -password

5. Close the Registry Editor, then restart your device to apply the change.

Step 2: Remove BitLocker context menu entries in Windows 11

Some users prefer a clean context menu, requiring the removal of custom context menu options, including BitLocker entries. Additionally, this method is ideal for undoing previous customizations you’ve added using Step 1.

📌 Prerequisites: Create a Windows Registry backup before deleting registry keys.

1. Press Win + R, type regedit, and press Enter.
2. Go to HKEY_CLASSES_ROOT\Drive\shell.
3. Right-click each custom BitLocker-related key and select Delete.
4. Confirm the deletion of the keys and then close the Registry Editor.
5. Restart your device to apply the changes.

Step 3: Verify BitLocker functionality after context menu changes

After adding or removing BitLocker-related context menu entries, it’s important to verify that your configuration works as intended. Through careful verification, you can ensure that your context menu shortcuts perform the target underlying encryption features.

1. Right-click an encrypted test drive, and then try to open the BitLocker Control Panel via the context menu option you added.
2. If applicable, test the lock and unlock features you added on the same test drive and verify that the actions execute successfully.
3. Test the suspension and resumption of BitLocker encryption and confirm if it applies successfully.
4. For removal workflows, ensure that the right-click options are disabled and verify that encryption and management actions still function normally.

Step 4: Leverage PowerShell scripts to automate and deploy the change

Manually adding or removing BitLocker entries in the Windows 11 context menu across multiple endpoints can be error-prone. One accidental key deletion can cause system instability that can significantly impact device performance.

Scripted automation helps you uniformly deploy BitLocker context menu entries at scale, while ensuring consistent implementation across endpoints. This prevents accidental disruptions during the configuration process, ensuring a safe, scalable, and controlled process for enterprise environments.

📌 Prerequisite: Existing RMM platform for centralized, remote deployment.

1. Press Win + R, type regedit, and press Ctrl + Shift + Enter to open an elevated PowerShell prompt.
2. Verify drive encryption and backup recovery status to ensure the drive is in the correct state for your change.
3. Enter the PowerShell script that adds or removes your target registry values, such as:

• • Add the manage-bde key and its corresponding command subkey:

New-Item -Path "HKLM:\Software\Classes\Drive\shell\manage-bde" -Force | Out-Null
New-Item -Path "HKLM:\Software\Classes\Drive\shell\manage-bde\command" -Force | Out-Null
Set-ItemProperty `
-Path "HKLM:\Software\Classes\Drive\shell\manage-bde\command" `
-Name "(Default)" `
-Value "control.exe /name Microsoft.BitLockerDriveEncryption"

• • Add the lock-bde key and its corresponding command subkey:

New-Item -Path "HKLM:\Software\Classes\Drive\shell\lock-bde" -Force | Out-Null
New-Item -Path "HKLM:\Software\Classes\Drive\shell\lock-bde\command" -Force | Out-Null
Set-ItemProperty `
-Path "HKLM:\Software\Classes\Drive\shell\lock-bde\command" `
-Name "(Default)" `
-Value "manage-bde -lock %1"

• • Add the unlock-bde key and its corresponding command key:

New-Item -Path "HKLM:\Software\Classes\Drive\shell\unlock-bde" -Force | Out-Null
New-Item -Path "HKLM:\Software\Classes\Drive\shell\unlock-bde\command" -Force | Out-Null
Set-ItemProperty `
-Path "HKLM:\Software\Classes\Drive\shell\unlock-bde\command" `
-Name "(Default)" `
-Value "manage-bde -unlock %1 -password"

• • Sample script to remove BitLocker-related context menu options:

$keys = @(
"HKLM:\Software\Classes\Drive\shell\manage-bde",
"HKLM:\Software\Classes\Drive\shell\lock-bde",
"HKLM:\Software\Classes\Drive\shell\unlock-bde"
)

foreach ($key in $keys) {
if (Test-Path $key) {
Remove-Item $key -Recurse -Force
}

4. Use your RMM platform to deploy scripts centrally to all target endpoints.

⚠️ Important: Test configurations on sample endpoints before rolling out across your environment. (See ⚠️ Things to look out for)

Step 5: Check backup and recovery keys after major changes

While adding or removing BitLocker-related context menu entries doesn’t change your encryption configuration, it still can impact how users interact with encrypted drives. Any change that alters access paths should be followed by verification of the recovery key, ensuring no encryption state is lost during cosmetic changes.

1. Open the BitLocker Drive Encryption interface and review all listed encrypted drives on the system.
2. Back up BitLocker recovery keys for all encrypted drives, either by storing them offline, in a secure vault, or within approved key escrow systems.
3. Document drive states, like encryption status, unlock behavior, and drive type, to establish a reference point in case behavior changes after customization.
4. Proceed with applying context only after recovery keys have been verified and documented to ensure a safe rollback if needed.

⚠️ Things to look out for

Manage BitLocker context menu options to match user preference

BitLocker context menu customization enables faster access to BitLocker management actions using simple registry edits or lightweight scripts. Through these methods, you can tailor local endpoints or environments to match user needs.

Additionally, NinjaOne can support configuration deployments through its remote script deployment capabilities, ensuring consistent BitLocker context menu entries at scale. Remember to always back up recovery keys and verify BitLocker functionality after making changes.

Related topics:

• How to Unlock a BitLocker Drive (Fixed or Removable) in Windows
• How to Enable or Disable Standard Users from Changing BitLocker PIN or Password in Windows
• How to Change the BitLocker Drive Encryption Method in Windows 11
• How to Suspend BitLocker with PowerShell