manage-bde.exe
Summary
BitLocker Drive Encryption management command-line tool - configures encryption, manages recovery keys, and controls BitLocker protection.
manage-bde.exe is the 331st most commonly executed Windows program in EchoTrail's dataset, observed 27,164 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by cmd.exe.
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- 38f20a75e04bb9a53c563152a90a5b29ab689aff58d6abd3e005d156ee4e4c7353.25%
- 7c4d5e3ce3b97ebf2533c8529789ee4b1fcb846c95d21dcc9ec87eb1309a5bc925.34%
- 5be37eab49ceee5c5245fd7c002672b0540c8f27af74bb98e4cd109418b7615020.54%
- 9715505eea453f6fb4458cfe9c95ef9f048885b944dcbdb82b517a99c8ae09420.72%
- 11eb6aa4901b82014a5f6966ebe555fa9606d6f8bac5a8ae375b083a6b73176b0.07%
- bf4f6592de9f4f04a7d2f671621b9f8df5013a0b2d08d302d0cd18cbbcda602e0.03%
- cb4b9af3f8127e7a7bc7f5364cc8aef9e2315cc153bb651abd2e8a9cbfbfd65a0.02%
- 3d4b4179402559996e13c385bf77248965cbf98cf7759e4c1401c52a2ffc29bb0.01%
- caa33128ee279b42656eed89e638d0404de13a1e4deb96883d9b58f244f86376<0.01%
Process Ancestry
Top Grandparents
- explorer.exe4.32%
- RuntimeBroker.exe0.15%
Top Parents
- cmd.exe99.97%
- powershell.exe0.03%
Top Children
- conhost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does manage-bde.exe normally do?
Used by IT administrators to manage BitLocker encryption on endpoints. Common in enterprise disk encryption deployments.
When is manage-bde.exe suspicious?
Disabling BitLocker protection. Changing recovery keys without IT approval. Encrypting drives with attacker-controlled keys.
How do attackers abuse manage-bde.exe?
Ransomware operators have abused BitLocker to encrypt victim drives with attacker-controlled passwords, effectively using a legitimate OS feature as the encryption mechanism.
Detection guidance
Monitor for manage-bde -on or -changepassword operations. Alert on BitLocker configuration changes outside of IT management tools.
False positive notes
Enterprise IT routinely uses manage-bde for disk encryption management. SCCM/Intune may invoke it during compliance checks.
Related Processes
Ask Rocky about manage-bde.exe
Rocky answers questions about manage-bde.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.