How to prevent automatic drive encryption in Windows 11?

TairikuOkami · Apr 15, 2023

Not sure, if it is possible in OOBE, but disabling/removing bitlocker/EFS services should prevent it 100%.

I do this post-setup: Disable decryption and decrypt, in case the disk is already encrypted.

Code:

reg add "HKLM\System\CurrentControlSet\Control\BitLocker" /v "PreventDeviceEncryption" /t REG_DWORD /d "1" /f
fsutil behavior set disableencryption 1
manage-bde -off C:
manage-bde -off D:
cipher /d /s:C:\
sc config EFS start= disabled
sc config BDESVC start= disabled

ThrashZone · Dec 4, 2023

TairikuOkami said:
Not sure, if it is possible in OOBE, but disabling/removing bitlocker/EFS services should prevent it 100%.

I do this post-setup: Disable decryption and decrypt, in case the disk is already encrypted.

Code:

reg add "HKLM\System\CurrentControlSet\Control\BitLocker" /v "PreventDeviceEncryption" /t REG_DWORD /d "1" /f fsutil behavior set disableencryption 1 manage-bde -off C: manage-bde -off D: cipher /d /s:C:\ sc config EFS start= disabled sc config BDESVC start= disabled

Hi,
Hate to be a necromunger but what if there is E & F partition ?

Code:

reg add "HKLM\System\CurrentControlSet\Control\BitLocker" /v "PreventDeviceEncryption" /t REG_DWORD /d "1" /f
fsutil behavior set disableencryption 1
manage-bde -off C:
manage-bde -off D:
manage-bde -off E:
manage-bde -off F:
cipher /d /e /f /s:C:\
sc config EFS start= disabled
sc config BDESVC start= disabled

TairikuOkami · Dec 4, 2023

ThrashZone said:
but what if there is E & F partition ?

Your posted code will do. cipher is only used do decrypt EFS files, I do not think it is enabled by default anymore.

ThrashZone · Dec 4, 2023

TairikuOkami said:
Your posted code will do. cipher is only used do decrypt EFS files, I do not think it is enabled by default anymore.

Hi,
Dude on TPU got bitlocked installing 23h2 :scream:

Microsoft re enables bitlocker, locked my computer and deleted the windows hello pin after installing 23H2.

brother bought a new laptop, got his old one and wiped it. fresh W11 Pro installation, manually disabled bitlocker and checked a couple times that it is actually disabled. (wasn't the first time i found it to be enabled again after a couple weeks) yesterday it installed 23H2 and it restarted for...

www.techpowerup.com

Marie SWE · Dec 6, 2023

The easiest way... and the safest way to always prevent windows update to screw up things (to restart things or reinstall things)... Is to look up the key files the program need to even be able to run.... Delete them, then create a new Ghost files in the exactly same name and then make sure the privileges for write/edit etc.. is set to you the user ONLY.. Then change the file to write protected.
The program can not run as it is an empty file... The system or the trusted installer can not replace the file with a working one, as it get access denied... and the program is dead forever...... or until you the user is delating the ghost-file and you let the system repair the program.

ThrashZone · Dec 12, 2023

Hi,
This is getting interesting OEM's are okaying activating bitlocker

God I love new rufus and looks like I'll never stop using it but will never get a large build like 23h2 from windows update

Microsoft re enables bitlocker, locked my computer and deleted the windows hello pin after installing 23H2.

Hi, Yeah can't let your guard down for even a second Funny I don't even have win-10 drivers form my new lappy. Have to contact acer and ask why. and why tpm access is locked to. But installing green 23h2 what were you thinking :confused:

www.techpowerup.com

Try3 · Dec 12, 2023

ThrashZone said:
OEM's are okaying activating bitlocker

That's device encryption not Bitlocker.
The two are different things.

All the best,
Denis

Megahertz · Dec 12, 2023

Try3 said:
That's device encryption not Bitlocker.
The two are different things.

All the best,
Denis

I had a bad experience with device encryption that I didn't know it could exist on Win 11 Home.
When you open Disk Manager it shows the partitions as Bitlocker encrypted.

All partitions are Bitlocker on Win 11 Home SL?

Just made a clean install on a M.2 NVMe on a Samsung Book X30 It says that all data partitions are Bitlocker encrypted. - Its a Win 11 Home SL -Never set any Bitlocker encryption. What´s going on?

www.elevenforum.com

Try3 · Dec 12, 2023

Luis,

Yes, device encryption has caused a lot of concern. There were quite a few threads about it in the Spring & Summer.

Unlike Bitlocker, you can just go to
Settings, Privacy & security, Device encryption
and turn it off without any password being involved at any stage.
Turn On or Off Device Encryption - ElevenForumTutorials
In the two Windows 11 Home computers in which I've experienced Device encryption upon Windows installation, turning it off caused a warning that it might take a long time but it actually only took a couple of minutes [my Earl Grey wasn't properly brewed].

There were suggestions in at least one ElevenForum thread that a particular Registry edit during installation would prevent unsolicited Device encryption but it didn't work in any of my cases.

All the best,
Denis

ThrashZone · Dec 16, 2023

Try3 said:
That's device encryption not Bitlocker.
The two are different things.

All the best,
Denis

Hi,
OEM and ms forcing the feature and the result is the same/ bitlocker used and ms forcing ms account usage to upload bitlocker key to.
Not exactly different at all.

Feel free to pick up from here

Microsoft re enables bitlocker, locked my computer and deleted the windows hello pin after installing 23H2.

I have a better one. I moved my MP700 to a different M2 slot and now Gamepass is asking me to reinstall Forza 8. I removed a 32gig kit from my motherboard and put in a 64gig kit and had to use phone to recert my key.

www.techpowerup.com

Try3 · Dec 17, 2023

Mike,

I do not need to look in your link to know that Device encryption is not the same as Bitlocker.
That link's claim that a key had to be uploaded somewhere is incorrect.
Device encryption does not involve any key.
You just decrypt without one.
- I have done this several times this year.
- The tutorial also makes this clear.

Merry Christmas,
Denis