Open Command Prompt as Admin, and run the following command to enable BitLocker encryption. Follow the prompts to save the recovery key to a USB drive, and then select the encryption mode.

If you see This PC doesn't support entering a BitLocker recovery password during startup, enable WinRE, tweak Group Policy, verify TPM, recreate the recovery partition, etc.