Skip to main content
If a laptop is lost or stolen, full-disk encryption decides whether it is lost hardware or a reportable data breach. The Telivy agent checks the encryption state of every disk on the Windows and Mac devices it runs on and raises a finding for each disk that is not actually protected, including disks the user believes are encrypted.

​
What Telivy checks

During its scan, the agent asks the operating system for each volume’s encryption state: the provider, the encryption method, the percentage encrypted, and whether protection is currently active. If a volume is not protected, Telivy raises an Unencrypted Disk Per Device finding for it. The agent collects disk encryption data once a day per device.

​
Why it matters

HIPAA, state breach notification laws, and most cyber insurers treat data on an unencrypted device as exposed once the device leaves the owner’s hands. With encryption, a stolen laptop is lost hardware. Without it, it is a notification event with legal costs. Many insurers also ask for confirmation that endpoints are encrypted, and Telivy’s daily check gives you evidence for that answer. The fix is usually cheap. BitLocker and FileVault are built in, free, and invisible to the user once on. Most findings come from devices where encryption was never turned on, was suspended for an update and never resumed, or covers the system drive but not the data drive.

​
How detection works

A volume counts as encrypted when either:
  1. The OS reports protection status On, meaning the volume is encrypted and protection is active, or
  2. The OS reports protection status Unknown and the volume is Locked, meaning it is an encrypted volume that has not been unlocked yet.
Everything else raises a finding, including protection Off, protection Unknown on an unlocked volume, and encryption that is suspended or paused. Telivy creates one finding per unprotected volume, so a laptop with an encrypted C: drive and an unencrypted D: drive gets one finding, for D:.
The agent reads BitLocker status from manage-bde. If manage-bde is not available, it falls back to the BitLocker WMI provider. For each volume it records:Telivy does not collect BitLocker key protector details, such as which TPM or recovery key protectors are set up.From WMI, the encryption method is a number:From manage-bde, it is plain text, for example AES 128.The rule is: encrypted if ProtectionStatus = 1, or if ProtectionStatus = 2 and LockStatus = 1. Anything else is a finding.The rule depends on whether protection is on, not on the percentage. A volume that is 100% encrypted but has protection Off, for example because BitLocker is suspended, is not treated as encrypted, because its data can still be read in that state. A partial percentage usually means encryption is paused or still running, or was interrupted by hibernation or disk errors.
The agent reads FileVault status from macOS and reports the method as FileVault. The same rule applies: FileVault on and active counts as encrypted, and FileVault off or paused does not.
Linux is not covered. The agent does not check LUKS or dm-crypt, so Linux devices never produce this finding. If a client needs encryption evidence for Linux servers, track it as a manual control.

​
The finding

Telivy’s recommendation is to turn on BitLocker or FileVault on every device, store the recovery keys somewhere managed (Entra ID, Intune, Jamf, or a password manager), and confirm that encryption is active, not just configured.

​
Working through the findings

Filter the assessment’s findings to Unencrypted Disk Per Device and group them by hostname. An unencrypted C: drive is the system volume and comes first. An unencrypted D: or external drive often holds working files. All of these findings are Critical, so prioritize by who uses the device. Owners, finance, HR, and anyone with access to PHI or PII come first. Servers in a locked rack can wait for a planned window. Check hypervisor findings before acting on them (see below). Then fix them through your usual endpoint tooling:
  • Windows devices managed by Intune or Group Policy: push BitLocker by policy and store keys in Entra ID.
  • Macs managed by Jamf or Kandji: turn on FileVault with a configuration profile and escrow the recovery key.
  • Unmanaged or personal devices: use the finding to start a conversation with the client about device management.
The next agent scan closes the finding once the volume is protected.

​
Known limitations and false positives

Hypervisors and virtual machines can look unencrypted from inside the guest. The guest OS only reports on its own disks. If encryption happens at the host or storage layer, Telivy cannot see it from inside the VM. Check these findings by hand before you remediate.
  • Suspended is not encrypted. When BitLocker is suspended for a Windows update and has not resumed, the volume reports protection off. Fix it with manage-bde -protectors -enable C: or let Windows resume protection after the next restart. There is no need to re-encrypt.
  • Partial percentages are temporary. Below 100% usually means encryption is running, paused, stopped manually, or affected by hibernation or bad sectors. Go by protection status and the BitLocker event log, not the percentage.
  • Removable drives. USB drives connected during the scan may be reported, and ones that were not connected will not be. Handle removable media with a policy and user training.

​
FAQ

BitLocker can be set up while protection is off. The most common cause is BitLocker suspended after a firmware or feature update. Run manage-bde -status. If it says Protection Status: Protection Off, the volume is not protected even though encryption is set up.
No. There is one finding per unencrypted volume. A laptop with an encrypted C: and an unencrypted D: has one finding, for D:.
No. Disk encryption is one control among many in HIPAA, PCI DSS, and NIST CSF. A clean result is good evidence for that control, but the client still needs a written encryption policy, key escrow, and a device inventory.