Solved Device Encryption Windows 11 Home 24H2.

Mitch · May 18, 2024

Hello. Would be grateful if Insiders on 24H2 could clarify the position about Bitlocker/Encryption being auto enabled. We have 2 pc's running W11 Home 23h2. Both are setup with a MS Administrator account plus a Local Standard User account which we use. Device encryption is turned off in the MS Admin account and does not show in the Local account. After a clean install, encryption was turned on automatically but I turned it off and a Recovery Key was shown in MS Account. It's reported that in 24H2, Bitlocker (and I assume Device Encryption ) will be activated on a clean install or repair install? Will this apply to W11 Home and if so would it also apply to Local non MS Accounts and where would the Recovery Key be located? Thanks.

Brink · May 18, 2024

Hello Mitch,

Device encryption is available and automatically turned on by default on devices (ex: tablet or 2-in1) that support Modern Standby and running any Windows 11 edition.

If device encryption is turned off, it will no longer automatically enable itself in the future. You must enable it manually (if wanted) in Settings.

Turn On or Off Device Encryption in Windows 11

This tutorial will show you how to turn on or off device encryption on a Windows 11 PC. Device encryption is a Windows feature that enables BitLocker encryption automatically for the Operating System drive and fixed drives. It’s particularly beneficial for everyday users who want to ensure...

www.elevenforum.com

If Device Encryption is turned on with a local account, you would need to manually back up the BitLocker Recovery Key since it doesn't have a Microsoft account to auto backup to.

Mitch · May 18, 2024

Thanks Shawn. In the Local Accounts on our 2 pc's we are not signed on as Administrators, which is why I assume Device Encryption doesn't show. Device Encryption only shows on the MS Admin accounts and the Recovery Key is backed up to the account. Is it likely in 24H2 that the need to be signed in as administrator for device encryption (which we don't need or want) on Local Accounts would change? Our Local Accounts don't have Admin privileges and we wouldn't change that. If we did, for some reason, decide to turn on encryption for our Local Accounts, where would the key be located if it's not backed up to a MS account? Thanks a lot. Mitch.

Brink · May 18, 2024

Correct. You must be signed into an administrator account (local or Microsoft) to see the Device Encryption setting.

The BitLocker recovery key is not backed up for a local account unless you manually do so and select where.

Backup BitLocker Recovery Key in Windows 11

This tutorial will show you how to back up the BitLocker recovery key for a drive in Windows 10 and Windows 11. BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or...

www.elevenforum.com

Mitch · May 18, 2024

Thanks for clearing that up Shawn.
Mitch.

Brink · May 18, 2024

You're most welcome. :shawn:

garlin · May 18, 2024

Brink said:
If Device Encryption is turned on with a local account, you would need to manually back up the BitLocker Recovery Key since it doesn't have a Microsoft account to auto backup to.

I think this would be 24H2's most egregious flaw (if they don't change it before GA), is there isn't a post-install task prompting non-MSA users to backup the key offline. I get they're trying to market MSA's ability to silently backup recovery keys. but still...

cereberus · May 18, 2024

Brink said:
You're most welcome.

Actually things may be more complicated when 24H2 is released as MS are relaxing need for modern standby to enable device encryption.

I believe this has already rather quietly "slipped" in to Insider versions but I have yet to test it. I would have to disable modern standby on my laptop to test if I can enable device encryption without modern standby (or use another laptop).

Brink · May 18, 2024

cereberus said:
Actually things may be more complicated when 24H2 is released as MS are relaxing need for modern standby to enable device encryption.

I believe this has already rather quietly "slipped" in to Insider versions but I have yet to test it. I would have to disable modern standby on my laptop to test if I can enable device encryption without modern standby (or use another laptop).

Microsoft has indeed.

Starting with Windows 11 build 25905, Microsoft have adjusted the prerequisites (removal of Modern Standby/HSTI validation and untrusted DMA ports check) for enabling device encryption so that it is automatically enabled when doing clean installs of Windows 11.

Mitch · May 19, 2024

Morning. Sorry to raise this one again but just to clarify, does auto-enablement of Bitlocker/Device Encryption for W11 home in 24h2 apply to repair installs, either using MCT/ISO or the Windows Update recovery feature in Settings, as well as clean installs. The point of repair installs is that "your Settings will be preserved" but......This has the potential to cause real problems especially if using a Local Account and no prompt to back the key up. Mitch.

cereberus · May 19, 2024

Mitch said:
Morning. Sorry to raise this one again but just to clarify, does auto-enablement of Bitlocker/Device Encryption for W11 home in 24h2 apply to repair installs, either using MCT/ISO or the Windows Update recovery feature in Settings, as well as clean installs. The point of repair installs is that "your Settings will be preserved" but......This has the potential to cause real problems especially if using a Local Account and no prompt to back the key up. Mitch.

The key is automatically backed up to the TPM I understand.

BruceR · May 20, 2024

Mitch said:
This has the potential to cause real problems especially if using a Local Account and no prompt to back the key up. Mitch.

garlin said:
I think this would be 24H2's most egregious flaw (if they don't change it before GA), is there isn't a post-install task prompting non-MSA users to backup the key offline.

Automatic device encryption is not activated for a local account. The system disk may be encrypted but no key will be required as protection is suspended until an administrator signs in with a Microsoft Account, which then saves the recovery key automatically:

! Note

BitLocker automatic device encryption starts during Out-of-box (OOBE) experience. However, protection is enabled (armed) only after users sign in with a Microsoft Account or an Azure Active Directory account. Until that, protection is suspended and data is not protected. BitLocker automatic device encryption is not enabled with local accounts, in which case BitLocker can be manually enabled using the BitLocker Control Panel.

BitLocker automatic device encryption

If the device isn't Microsoft Entra joined or Active Directory domain joined, a Microsoft account with administrative privileges on the device is required. When the administrator uses a Microsoft account to sign in, the clear key is removed, a recovery key is uploaded to the online Microsoft account, and a TPM protector is created. Should a device require the recovery key, the user is guided to use an alternate device and navigate to a recovery key access URL to retrieve the recovery key by using their Microsoft account credentials

If a device uses only local accounts, then it remains unprotected even though the data is encrypted

Device encryption

Mitch · May 20, 2024

Thanks for the information. We have both an MS and a Local non admin account on our PC. We use the MS account for updates etc and the Local account for everything else. Device Encryption for our 2 W11 Home 23h2 is off in our MS Account and doesn't show in the Local account. The last Recovery Key showing in our MS account was when I did I clean install of W11 in December, Encryption was auto enabled and when installed I turned off Dev Encryption. We have no need to turn on Encryption ourselves and it would only happen in the event of a clean install or if forced on us in 24h2 - not sure if a repair install in 24h2 would turn Encryption on automatically? Hope not. Thanks again.

TechnologyInThe · Aug 6, 2024

good thread.
QUESTION
I have new computer windows 11 home. I WANT BITLOCKER., I have 4 other machines, all upgraded to windows 11 pro. specifically for bitlocker.
for the NEW COMPUTER, will I AUTOMATICALLy GET Bitlocker with next release update of 24H2?
and if so, will i have ability to ENABLE the BITLOCKER PRE-BooT PIN ENTRY (so i'm entering my bitlocker code on the blue Boot-Up screen?
or do i still need windows 11 pro to get that feature?
any clarification is appreciated

Brink · Aug 6, 2024

TechnologyInThe said:
good thread.
QUESTION
I have new computer windows 11 home. I WANT BITLOCKER., I have 4 other machines, all upgraded to windows 11 pro. specifically for bitlocker.
for the NEW COMPUTER, will I AUTOMATICALLy GET Bitlocker with next release update of 24H2?
and if so, will i have ability to ENABLE the BITLOCKER PRE-BooT PIN ENTRY (so i'm entering my bitlocker code on the blue Boot-Up screen?
or do i still need windows 11 pro to get that feature?
any clarification is appreciated

Hello, and welcome.

Since this is the Home edition, you'll have "Device Encryption" instead of the full BitLocker.

You would need to use step 2 in option 2 of the tutorial below to enable BitLocker to Unlock OS drive at Startup with PIN and USB.

Enable or Disable BitLocker to Unlock OS drive at Startup with PIN and USB in Windows 11

This tutorial will show you how to enable or disable BitLocker to unlock the operating system drive at startup with a PIN or USB flash drive in Windows 10 and Windows 11. BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats...

www.elevenforum.com

You will then be able to use option 2 in the tutorial below to change how to unlock your OS drive encrypted by Device Encryption with a PIN.

Change how BitLocker Unlocks OS Drive at Startup in Windows 11

This tutorial will show you how to choose how to unlock your operating system drive at startup with a PIN, USB flash drive, or automatically with TPM in Windows 11. BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of...

www.elevenforum.com

BruceR · Aug 6, 2024

Brink said:
Since this is the Home edition, you'll have "Device Encryption" instead of the full BitLocker.

You would need to use step 2 in option 2 of the tutorial below to enable BitLocker to Unlock OS drive at Startup with PIN and USB.

Enable or Disable BitLocker to Unlock OS drive at Startup with PIN and USB in Windows 11

This tutorial will show you how to enable or disable BitLocker to unlock the operating system drive at startup with a PIN or USB flash drive in Windows 10 and Windows 11. BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats...

www.elevenforum.com

You will then be able to use option 2 in the tutorial below to change how to unlock your OS drive encrypted by Device Encryption with a PIN.

Change how BitLocker Unlocks OS Drive at Startup in Windows 11

This tutorial will show you how to choose how to unlock your operating system drive at startup with a PIN, USB flash drive, or automatically with TPM in Windows 11. BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of...

www.elevenforum.com

But are those available on Home with Device Encryption?

And why would anyone need to use both tutorials?

TechnologyInThe · Aug 6, 2024

so, to clarify
Bitlocker (name in PRO), and "Device encryption (name in HOME) are essentially same encryption with different names.

In windows "X" pro, I've used the GPEDIT options to have bitlocker use the PIN at login. with HOME editions, i am essentially doing the same settings, through the registry, i just don't get the GPEDIT easier interface (I'm famiiar with that, i have all my screenshots, etc)

In windows "X" home, I can STILL encrypt multiple attached drives (example, "D:" if partioned, and "P: attached external drive), and ican set them up to all log in automatically at startup, if the correct bitlocker PIN is entered ?

if htat is the case, then i can hold off on upgrading to PRO, because the bitlocker (encrypted disk) features are the main things i need/desire

AND, your tutorial is great also

additional question, when will 24H2 be released?

comments
I back up hte recovery keys of bitlocker. bitlocker forces me to use a USB stick, which is a pain. I've tried to back it up to OneDrive; bitlocker says "can't do this, this is encrypted". I try to back to local "C: drive, same message. or to any external encrypted drive.
I WANT ABILITY to back it up anywhere i want, because I THEN copy it to multiple sites, and into my password manager program, so that i have it stored in several places. There should be a disclaimer of "I understand the world may blow up if i don't do it the way micorosoft recommends....." so that i can do it the way i want to ....

anyway, again, info is appreciated.
nick

Brink · Aug 6, 2024

BruceR said:
But are those available on Home with Device Encryption?

And why would anyone need to use both tutorials?

Yes.

You would need to use both. One to enable the ability to use a PIN, and the other to set up the PIN.

Brink · Aug 6, 2024

TechnologyInThe said:
so, to clarify
Bitlocker (name in PRO), and "Device encryption (name in HOME) are essentially same encryption with different names.

In windows "X" pro, I've used the GPEDIT options to have bitlocker use the PIN at login. with HOME editions, i am essentially doing the same settings, through the registry, i just don't get the GPEDIT easier interface (I'm famiiar with that, i have all my screenshots, etc)

In windows "X" home, I can STILL encrypt multiple attached drives (example, "D:" if partioned, and "P: attached external drive), and ican set them up to all log in automatically at startup, if the correct bitlocker PIN is entered ?

if htat is the case, then i can hold off on upgrading to PRO, because the bitlocker (encrypted disk) features are the main things i need/desire

AND, your tutorial is great also

additional question, when will 24H2 be released?

comments
I back up hte recovery keys of bitlocker. bitlocker forces me to use a USB stick, which is a pain. I've tried to back it up to OneDrive; bitlocker says "can't do this, this is encrypted". I try to back to local "C: drive, same message. or to any external encrypted drive.
I WANT ABILITY to back it up anywhere i want, because I THEN copy it to multiple sites, and into my password manager program, so that i have it stored in several places. There should be a disclaimer of "I understand the world may blow up if i don't do it the way micorosoft recommends....." so that i can do it the way i want to ....

anyway, again, info is appreciated.
nick

Correct, you'll just need to use the REG option instead to set the policy since you don't have GPEDIT in Home.

Device Encryption is basically a lite version of BitLocker. You can only encrypt the OS drive with Device Encryption and not any internal (data) or external (removable) drives.

The recovery key for Device Encryption is backed up the same way as with BitLocker below. It is recommended to back up to your Microsoft account to make it easier, but either option below will do.

Backup BitLocker Recovery Key in Windows 11

This tutorial will show you how to back up the BitLocker recovery key for a drive in Windows 10 and Windows 11. BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or...

www.elevenforum.com

TechnologyInThe · Aug 6, 2024

BruceR said:
But are those available on Home with Device Encryption?

And why would anyone need to use both tutorials?

just as a clarification - in Windows 11 PRO, the Group Policy editor provides an easy interface to set the "BITLOCKER" preferences. but it is essentially controlling the REGISTRY entries that the "WINDOWS "X" HOME section of the tutorial is doing. it just does not have the easier interface to do this . The tuturoal makes it easy to see which registry entries are used.

Solved Device Encryption Windows 11 Home 24H2.

Well-known member

My Computer

Administrator

My Computers

Well-known member

My Computer

Administrator

My Computers

Well-known member

My Computer

Administrator

My Computers

Well-known member

My Computer

Well-known member

My Computer

Administrator

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

New member

My Computer

Administrator

My Computers

Well-known member

My Computer

New member

My Computer

Administrator

My Computers

Administrator

My Computers

New member

My Computer

Similar threads