WINDOWS SERVICE
BDESVC: BitLocker Drive Encryption Service
Hosts the BitLocker Drive Encryption service. Microsoft says it lets BitLocker prompt users for actions related to their volumes when they are mounted, and unlocks volumes automatically without user interaction.
TECHNICAL SUMMARY
| Service name | BDESVC |
|---|---|
| Display name | BitLocker Drive Encryption Service |
| Runs from | C:\Windows\System32\svchost.exe |
| Command line | svchost.exe -k netsvcs -p |
| Runs as | LocalSystem |
| Verdict | Leave it alone |
Paths, signer and service account observed on Windows 11 build 26300 on 12 November 2026. Run the commands below to check your own PC.
Should you touch it?
Leave it aloneMicrosoft states that stopping or disabling the service prevents users from using this functionality, and its guidance for Windows 10 and 11 IoT Enterprise rates it Don't disable. Its default startup type is Manual: on the PC used for this page it was stopped, with a trigger registered to start it.
What PC Tweaker does with it
PC Tweaker does not change this service. No control in the catalogue stops it, disables it or edits its start type.
Check it yourself
See its state and start type
PowerShellGet-Service BDESVC | Format-List Name, DisplayName, Status, StartType sc qc BDESVC
Common questions
What does the BDESVC service do?
Hosts the BitLocker Drive Encryption service. Microsoft says it lets BitLocker prompt users for actions related to their volumes when they are mounted, and unlocks volumes automatically without user interaction. It runs C:\Windows\System32\svchost.exe (svchost.exe -k netsvcs -p) as LocalSystem.
Can I disable BDESVC?
Leave it alone. Microsoft states that stopping or disabling the service prevents users from using this functionality, and its guidance for Windows 10 and 11 IoT Enterprise rates it Don't disable. Its default startup type is Manual: on the PC used for this page it was stopped, with a trigger registered to start it.
How do I see whether BitLocker is protecting my drives?
Run manage-bde -status from an administrator prompt. Microsoft documents it as the command that provides information about all drives on the computer, whether or not they are BitLocker-protected. The state of this service does not tell you that: it is a Manual service.
How do I check that it is the real service?
On Windows 11 build 26300 it is registered as svchost.exe -k netsvcs -p, runs as LocalSystem and loads C:\Windows\System32\bdesvc.dll, signed by Microsoft Windows. It has no dependencies.