We bought new HP EliteBook 840 G8 laptops with SSDs running Windows 11 and wanted to enable their self encryption with password or fingerprint authentication at boot-up, but without the need for additional tools. Since I couldn't find any suitable guide on the Internet, I thought I'm gonna summarize the instructions here since the set up is a bit weird with HP laptops — at least, in comparison to other vendors like Lenovo.
HP offers two different options: DriveLock and Automatic DriveLock. While DriveLock is best for single-user devices, Automatic DriveLock was designed for multi-user devices. Please note that these two alternatives are not only mutually exclusive, but also cannot be switched once one of them has be set up — at least, switching from one to the other didn't work on our laptops!
Setting up SSD encryption on HP EliteBook 840 G8
- Activate BitLocker on Windows — it was enabled, but not activated. (Even HP Support missed this crucial step.) Make sure to backup the recovery key!
- Reboot and enter UEFI/BIOS by pressing ESC repeatedly and then F10.
- Go to "Security" → "Hard Drive Utilities" → "DriveLock/Automatic Drive Lock".
- Select you SSD.
- Select "Enable DriveLock" and set a administrator password. Caution: Backup this password! The administrator password is required to disable DriveLock again.
- Set a user password. The user password is required to unlock the drive at boot time.
- Save and exit UEFI/BIOS.
- Now you will be prompted for the BitLocker recovery key (see step 1). Confirm it by pressing enter.