Skip to main content

Drive Encryption page in Nebula

Updated: 

The Monitor > Drive Encryption page in Nebula displays the encryption status for each Windows workstation and its drives. 

Encryption compliance

The Encryption Compliance widget at the top of the Drive Encryption page displays the percent of Windows endpoints that are fully encrypted. This helps quickly identify the organization's compliance with device security. 

Endpoint drives list

The following details are available for each drive on this page:

Column Description
Drive The drive letter on the endpoint.
Drive Status

The encryption status of the specific drive. 

  • Encrypted: The drive is encrypted, and BitLocker protection is active. 
  • Unencrypted: The drive is not encrypted. Endpoints with unencrypted drives are non-compliant.
  • In Progress: Encryption of the drive is in progress.
  • Unknown: Nebula has not received volume data from the agent for this drive. This typically occurs on newly enrolled endpoints that have not checked in with the agent. These machines are treated as non-compliant.
  • Restart Required: The endpoint must be rebooted before drive encryption can complete.
Drive type Operating System or Fixed data drive.
Encrypted at Date the drive was encrypted.
Encryption method

How the drive was encrypted:

  • XTS-AES-128: Strong encryption and faster performance on older hardware
  • XTS-AES-256: Maximum encryption strength; recommended for compliance-regulated environments (healthcare, payments, government)
Encryption scope

The sectors encrypted:

  • Full disk: Every sector is encrypted, including previously deleted data. Required by certain organizations and compliance regulations.
  • Used space only: Only sectors currently containing data are encrypted. Previously deleted files are not encrypted.
Endpoint Endpoint name
Endpoint Status

The endpoint's overall drive encryption status, derived from the state of all drives on the device.

  • Fully Encrypted: Every drive on this endpoint is encrypted.
  • Partially Encrypted: At least one drive is encrypted, but one or more are not.
  • Not Encrypted: No drives on this endpoint are encrypted by BitLocker or are pending encryption. 
  • Unknown: Nebula has not received the volume data from the agent for the drives on this endpoint.
Issue Problems encountered with the encryption on the endpoint.
Last Key Rotation Last time the BitLocker key was rotated. 
Policy The policy applied to this endpoint. 
Recovery Key

BitLocker recovery key linked to the Key ID for this drive. The following actions are available in this cell:

  • Reveal Key: Displays the recovery key. This action is logged on the Activity Logs > Audit Log page.
  • Copy key to clipboard: Copy the key so it can be pasted and sent.
  • Rotate key: Manually rotate the recovery key. To automatically rotate recovery keys after they've been used, check the Drive Encryption policy settings. 

Export recovery keys in bulk

Super Admins can export recovery keys from Nebula as a single CSV using the Bulk key export button, providing an offline backup of every key. This action is logged in the Activity Logs events. move this to the paragraph above. Choose from one of the following options:

  • Existing endpoints only: Export the recovery keys of all current endpoints on the Drive Encryption page.
  • Existing + deleted endpoints: Export the recovery keys of all current endpoints on the Drive Encryption page and previously deleted endpoints.

The exported CSV file includes one row per encrypted drive. A machine with multiple encrypted drives shows one row per drive. The report contains the following:

Column Description
Machine name The name of the endpoint as shown in Nebula
Drive Drive letter and type (e.g., C: OS Drive)
Key ID The 8-character Key ID displayed on the BitLocker recovery screen
Recovery Key The full 48-digit recovery password
Last rotation date When the recovery key was most recently rotated

Note: Treat the export as a highly sensitive credential. Anyone with access to the file and its password can decrypt any drive in your endpoints 

For information on how to encrypt and unlock devices, see the following:

Return to Drive Encryption guide.

Still have questions?

Support is available via chat, phone or by creating a ticket. You can also use our virtual assistant for guided assistance.

Learn more