Solved All partitions are Bitlocker on Win 11 Home SL?

Just made a clean install on a M.2 NVMe on a Samsung Book X30
It says that all data partitions are Bitlocker encrypted.
- Its a Win 11 Home SL
-Never set any Bitlocker encryption.
What´s going on?

Hello Luiz,

This is most likely Device Encryption instead since this is the Home edition.

It gets turned on automatically when you set up Windows with a Microsoft account.

Thanks Brink,
The computer was set as Local account since the installation and never had a MS account.
The strange is that I was able to access the data on both drives under Win PE.
Had some problems trying to set a drive image using Macrium Reflect.
I´m disabling device encryption and will report back.

Before I did a clean install I booted from a Win PE and made an image with Macrium Reflect of the old installation so I could retrieve the data and eventually all system.
The Image build went normal and afterwords I did a verification. No problems.
When I retrieved the data all folders were empty. I mounted the image and the files were there but couldn't open any, all were corrupted.
Thankfully my friend had made a copy of all her data to an external drive
So BEWARE everyone. If you make Images with Device Encryption enabled, you may find that they are useless.

I did not understand how Device Encryption work. There is no encryption key. There is no owner.
For me and for my friend we found out that it's better to be disabled.

Megahertz said:

I did not understand how Device Encryption work. There is no encryption key. There is no owner.
For me and for my friend we found out that it's better to be disabled.

Click to expand...

This is rather incorrect. The encryption key is stored on the TPM and is automatic.

I am pretty sure Macrium Reflect can handle device encryption.

cereberus said:

This is rather incorrect. The encryption key is stored on the TPM and is automatic.

I am pretty sure Macrium Reflect can handle device encryption.

Click to expand...

If you boot from a WinPE and run Macrium Reflect, how can it handle a encrypted drive?

@Megahertz

As cereberus said the key/s are stored in the TPM. You can also save it to a file. You may see my first post in this thread How to Partition bitlocker encrypted System drive C: on my OEM PC? - Windows 10 Help Forums
It is also saved in the Microsoft account. One can login and get it.

Macrium Reflect WinRE rescue flash drive: When you create the rescue flash drive, click on "Advanced" and put a checkmark in both
" Add Bitlocker Support" and " Automatically unlock Bitlocker Volumes". The keys will be read from the TPM and saved in the files in the rescue media.This will be used to unlock the volumes when you backup using the recovery media..

jumanji said:

@Megahertz

As cereberus said the key/s are stored in the TPM. You can also save it to a file. You may see my first post in this thread How to Partition bitlocker encrypted System drive C: on my OEM PC? - Windows 10 Help Forums
It is also saved in the Microsoft account. One can login and get it.

Macrium Reflect WinRE rescue flash drive: When you create the rescue flash drive, click on "Advanced" and put a checkmark in both
" Add Bitlocker Support" and " Automatically unlock Bitlocker Volumes". The keys will be read from the TPM and saved in the files in the rescue media.This will be used to unlock the volumes when you backup using the recovery media.View attachment 79988.

Click to expand...

Thanks Jumanji for the helpful explanation.
I built the Macrium Reflect WinRE rescue flash drive on my computer, that has no TPM. This probably explain why the files on the image created from my friend computer (with Device Encryption) are "corrupted".

A Tale of Two cities ..

(At present in my Dell Inspiron 3280 (upgraded from Windows 10 Home Single Language to Windows 11 Home Single Language), I have disabled Device Encryption. If anytime I enable Device Encryption, I have to recreate the MacriumReflect Rescue flash drive with "Add Bitlocker Support" and "Automatically unlock Bitlocker Volumes" enabled. Unlike the standard bitlocker, Device Encryption - which is a toned down version of the standard bitlocker - will automatically encrypt all the internal disks and volumes in it - subject to Modern standby present, login with Microsoft Account and TPM enabled in the system)

Megahertz said:

Thanks Jumanji for the helpful explanation.
I built the Macrium Reflect WinRE rescue flash drive on my computer, that has no TPM. This probably explain why the files on the image created from my friend computer (with Device Encryption) are "corrupted".

Click to expand...

Yeah - it is generally advisable that the Rescure Flash Drive is created on the pc it is to be used on to avoid missing drivers (can be added later though). However, I have never thought about bitlocked drives, where you must create Rescue Drive on same PC.

Living and learning. Never thought the possibility of Bitlocker on a Win11 Home SL.

Megahertz said:

Living and learning. Never thought the possibility of Bitlocker on a Win11 Home SL.

Click to expand...

Even I did not know anything about it, till I set up the PC in Dec 2019. When I opened Disk Management I saw the 1TB System disk (HDD) C: saying it is BitLocker encrypted. Opening the Control Panel, I saw "Device Encryption". Clicking on it opened the Device Encryption Window where I can switch it on or off, Also a Bitlocker settings link which opened a window where I can save the key to a file.

(Now Control Panel > Device Encryption straightaway opens the page to save the keys as shown below




Device Encryption on/off has been shifted to Start > Settings > Privacy & security as shown in my last post, post #9)

So we all learn when we encounter it and/or listening to user experiences, me included .

I shall continue with my post #9 tomorrow . I have more information for the users to listen to .

To illustrate the work flow on creating a Macrium Reflect WinRE Rescue Flash drive, I first turned on Device Encryption ( since I had turned it OFF long ago)

( It took about two hours to encrypt all volumes in my 1TB SSD)

Once you know that all volumes in the Internal disks are bitlocker encrypted - you can check it in Windows Disk Management- proceed to save the Recovery keys of each volume to a file,

Control Panel > Device Encryption, straightaway opens the page to save the keys as shown below. ( this part is not obvious for the first timer and he may miss it and may later wonder where the recovery keys are). When that page opens, click on every volume, and then "Back up your recovery key" and save it to a file on an external media..



Now you are ready to create your Macrium Reflect WinRE rescue flash drive. During the process click on Advanced > Options and check that
"Add Bitlocker Support" and "Automatically unlock BitLocker Volumes" are enabled. Proceed to "Build" your recovery drive.



Now when you boot from the recovery drive the bitlocked volumes will be automatically unlocked for imaging.

The following screenshots are just for information. You need not check on this when booting the Rescue drive and start imaging.

1. When the MacriumReflect Main page appears after successful boot, you can click on MacriumReflect PE Explorer in the task bar and then open Boot (X:) to explore. ( X: is the RAM drive where the WinPE is loaded). There you can see all the recovery key files are listed.. You can even click on them to open and see the recovery key.



2. You can find the Recovery keys in your Microsoft account. Log into your Microsoft account, click on the "Devices" Tab > Manage recovery keys." It will open a page where all the drives and the respective Recovery keys are listed.



That's all for the day.

Interesting thread, I thought only Dell computers with Windows Home originally had the bitlocker turned on like mines did which I turned off....
When I goto Settings -> Privacy & Security -> Device Encryption, I don't even have the Device encryption option available even though bitlocker is turned off. Is there a way to turn off the encryption settings managed by BitLocker?



and when I click on BitLocker driver encryption, I get:



Read in Turn On or Off Device Encryption in Windows 11 Tutorial as I have modern standby disabled which may be why I don't have the Device Encryption toggle.

Almighty1 said:

Interesting thread, I thought only Dell computers with Windows Home originally had the bitlocker turned on like mines did which I turned off....
When I goto Settings -> Privacy & Security -> Device Encryption, I don't even have the Device encryption option available even though bitlocker is turned off. Is there a way to turn off the encryption settings managed by BitLocker?

View attachment 80324

and when I click on BitLocker driver encryption, I get:
View attachment 80326


Read in Turn On or Off Device Encryption in Windows 11 Tutorial as I have modern standby disabled which may be why I don't have the Device Encryption toggle.

Click to expand...

Sure, Modern Standby is one of the many essential requirements for Device Encryption.

From what I see from your screenshots, your system has standard BitLocker Drive Encryption which you may want to turn on. From my view point standard BitLocker Drive Encryption is all hassles and I haven't tried or turned it on though the PC from which I am typing this post runs Windows 11 Pro. I also don't know why Device Encryption shows up in Privacy and security in your PC. My windows 11 Pro PC does not show anything Device Encryption. Screenshots below.





If you want to turn on BitLocker Drive Encryption and manage it



For any further queries/questions on BitLocker Drive Encryption you may start a new thread to take on other experts familiar with it .

Not an expert by any means but it is my understanding that for any device using modern standby, Device Encryption is now automatically enabled when Home is installed. Yes, normally we think modern standby is for laptops as all new ones come factory shipped with modern standby. However, depending on the UEFI bios of a PC, some PCs can also use modern standby. I have found this to be especially true for for all-in-ones which use laptop motherboards.

Device encryption encrypts ALL FIXED drives whereas with standard bitlocker offered in PRO, the user has the option to choose which drives to encrypt.

The user must be aware that if any external drive is recognized by the system as FIXED (and some of them do get recognized as such), that drive will also be automatically encrypted if device encryption is enabled. If that external drive gets used on another machine, the files can not be accessed without the recovery key from the machine where the drive was encrypted.

Edited to fix terminology

glasskuter said:

........... for any device using modern standby, Bitlocker Drive Encryption is now automatically enabled when Home is installed.

Click to expand...

That should read as " for any device using modern standby, Device Encryption is now automatically enabled when Home is installed."

glasskuter said:

.........BLDE encrypts ALL FIXED drives whereas with standard bitlocker, the user has the option to choose which drives to encrypt.

Click to expand...

To differentiate between BitLocker Device Encryption and BitLocker Drive Encryption, that should read as " Device Encryption encrypts ALL FIXED drives whereas with standard bitlocker, the user has the option to choose which drives to encrypt."

With those modifications , everything you said is correct and unambiguous. .

Have you tried at cmd prompt

manage-bde -protectors C: -get

SIW2 said:

Have you tried at cmd prompt

manage-bde -protectors C: -get

Click to expand...

To whom is it addressed to? And in what connection?

On my Dell Iinspiron 3280 AIO running Windows 11 Home, I have recently switched on Device Encryption (for the 22nd time in four years ) . I have no problems. I will turn off Device encryption only before updating BIOS if any comes through via Dell SupportAssist. (The recovery Keys for all the drives in it are stored safely on two media, in case I need it. No need to use bde commands)

On my Beelink Sei12 Mini PC running Windows 11 Pro, I can switch on BitLocker Drive encryption on any drive. I am not doing it since there is no need for it and drive encryption is a big hassle..

To whom is it addressed

Click to expand...

To you. See what the command outputs.