# Windows - BitLocker Policy is created and assigned
Without a properly configured and assigned BitLocker policy in Intune, threat actors can exploit unencrypted Windows devices to gain unauthorized access…
Source: https://maester.dev/docs/tests/ZTA.24550
## Overview
Without a properly configured and assigned BitLocker policy in Intune, threat actors can exploit unencrypted Windows devices to gain unauthorized access to sensitive corporate data. Devices that lack enforced encryption are vulnerable to physical attacks, like disk removal or booting from external media, allowing attackers to bypass operating system security controls. These attacks can result in data exfiltration, credential theft, and further lateral movement within the environment.
Enforcing BitLocker across managed Windows devices is critical for compliance with data protection regulations and for reducing the risk of data breaches.
## Remediation
Use Intune to enforce BitLocker encryption and monitor compliance across all managed Windows devices:
- [Create a BitLocker policy for Windows devices in Intune](https://learn.microsoft.com/intune/device-configuration/endpoint-security/encrypt-bitlocker-windows?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-and-deploy-policy)
- [Assign policies in Intune](https://learn.microsoft.com/intune/device-configuration/assign-device-profile?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#assign-a-policy-to-users-or-groups)
- [Monitor device encryption with Intune](https://learn.microsoft.com/intune/device-management/monitor-encryption?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | High |
| Impact on users | Low |
| Pillar | Devices |
| Category | Device management |
| Product | [Intune](/docs/tests/products/intune) |
| Feature | Endpoint security |
| Area | Devices and endpoints |
| ATT&CK | [T1005](/docs/tests?mitre=T1005) Data from Local System, [T1006](/docs/tests?mitre=T1006) Direct Volume Access |
| Licence | INTUNE_A |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.