How to prevent automatic drive encryption in Windows 11?

Spartan · Apr 2, 2023

So I work for a company that sells computers and I do some tweaking to disable telemetry and whatnot for customers who choose to do so.

Some SSDs which support hardware encryption such as the Samsung 980 PRO and many of the new ones, the moment you create a Windows account you will notice that BitLocker status in control panel says "Encrypting". This does not happen while I am in OOBE only once the account is created.

I then saw the the developer of Rufus has added an option to disable automatic drive encryption when creating a Windows ISO so I asked him if there was a setting that I could change or registry entry to prevent this but his answer was:

You can find that from our Open Source code here.

Also, documented here.

I'm not sure how can I do that while in OOBE.

Another guy on Ten Forums also mentioned this registry entry but I'm not sure if it really works, When I am in:

HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Bitlocker

I see the following subfolders:

AutoDE
KeyBackupMonitor
RecoveryPasswordRotation

Do I need to create a DWORD in the root of the Bitlocker folder? "Value: PreventDeviceEncryption equal to True (1) (Default is False) Type: REG_DWORD"

Please help

FreeBooter · Apr 2, 2023

Turn On or Off Device Encryption in Windows 11 Tutorial

This tutorial will show you how to turn on or off device encryption on a Windows 11 PC. Device encryption (aka: BitLocker automatic device encryption) helps protect your data on the OS drive, and it's available on a wide range of Windows devices. If you turn on device encryption, the OS drive...

www.elevenforum.com

garlin · Apr 2, 2023

Rufus is using the answer file method of passing a registry flag, instead of updating the key directly in the install WIM's registry hive.
You can integrate it into the image, so Windows can't enable BitLocker on first boot.

1. DISM mount your WIM image.
2. reg load HKLM\TEMP C:\mountpath\Windows\System32\config\SYSTEM
3. reg add HKLM\TEMP\CurrentControlSet\Control\BitLocker /v PreventDeviceEncryption /t REG_DWORD /d 1 /f
4. reg unload HKLM\TEMP
5. DISM commit your changes.

Disable BitLocker automatic device encryption

Disable BitLocker automatic device encryption

OEMs can choose to disable device encryption and instead implement their own encryption technology on a device. To disable BitLocker automatic device encryption, you can use an Unattend file and set PreventDeviceEncryption to True. Alternately, you can update this registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BitLocker Value: PreventDeviceEncryption equal to True (1).

FreeBooter · Apr 2, 2023

The PreventDeviceEncryption value applies to Windows 8 not sure it will work with Windows 11.

garlin · Apr 2, 2023

The parent link is from BitLocker drive encryption in Windows 10 for OEMs.

Spartan · Apr 2, 2023

FreeBooter said:
Turn On or Off Device Encryption in Windows 11 Tutorial

This tutorial will show you how to turn on or off device encryption on a Windows 11 PC. Device encryption (aka: BitLocker automatic device encryption) helps protect your data on the OS drive, and it's available on a wide range of Windows devices. If you turn on device encryption, the OS drive...

www.elevenforum.com

did you even read the post??

that has nothing to do with how you can disable encryption to start in the first place.

Spartan · Apr 2, 2023

I made the reg file. Will test it on a brand new machine soon and let y'all know if it works to prevent automatic encryption.

cereberus · Apr 2, 2023

Spartan said:
I made the reg file. Will test it on a brand new machine soon and let y'all know if it works to prevent automatic encryption.

It worked when I tried it last week (regedit is on MS web page) But in the end, it is easier to just turn it off. Only worth doing this if rolling out to multiple devices.

bfunke · Apr 2, 2023

Typing encryption in the search bar brings up the settings for device encryption and bit locker. Seems easier than editing the registry.

hsehestedt · Apr 2, 2023

Rufus accomplishes this in 2 ways: They modify the actual boot.wim file when they can, but fallback to the answer file method when necessary. I only know this because I too have been in touch with the author

.

garlin · Apr 2, 2023

hsehestedt said:
Rufus accomplishes this in 2 ways: They modify the actual boot.wim file when they can, but fallback to the answer file method when necessary. I only know this because I too have been in touch with the author .

Are you sure Rufus modifies the boot.wim?
This GitHub feature request doesn't mention that option, and pbatard's commit only adds the answer file solution.

hsehestedt · Apr 3, 2023

garlin said:
Are you sure Rufus modifies the boot.wim?
This GitHub feature request doesn't mention that option, and pbatard's commit only adds the answer file solution.

Quoting from Pete Batard's e-mail to me:

"The only small exception is for the TPM/SB/RAM registry bypasses that are only done through unattend if we can't mount the boot.wim image to edit its registry directly.

The reason we prefer editing the boot.wim registry directly (i.e.
offline registry editing which you can accomplish after mounting an
image) is that doing the registry changes through unattend makes command prompt windows appear briefly during boot, which we thought would scare some users into thinking that Rufus was doing something with the images.
However, the app store version of Rufus does not allow offline registry editing so we have to use unattend regedit then, which is why we have 2 methods of accomplishing the same thing. Everything else is just through unattend."

The funny thing is that his observation is precisely one of the things that bothered me. When I was doing this via an unattended answer file, it bothered me that you would see those flashes. So after his above statement, I modified my procedure to update the BOOT.WIM file and I'm much happier because it is completely transparent to the user. There are no flashes and no answer file needed.

I thought it very kind that he responded to my inquires. No doubt, he's a busy person, but I'm always appreciative when someone takes time to respond like that. It certainly helped me greatly!

garlin · Apr 3, 2023

I downloaded his latest source code. While he has lines to set TPM Bypass keys in registry, I don't see him repeating this step for BypassRNO or PreventDeviceEncryption. Just be aware of that he's using the answer file for those features.

Spartan · Apr 3, 2023

cereberus said:
It worked when I tried it last week (regedit is on MS web page) But in the end, it is easier to just turn it off. Only worth doing this if rolling out to multiple devices.

Thanks a lot! Life saver! Now we can tweak the laptops we sell and use that registry file so Windows won't auto encrypt the SSDs when they create a user account! You don't know how many support tickets we receive about slow performance (due to BitLocker) or people who reinstalled the OS not even knowing that their SSD was encrypted

bfunke said:
Typing encryption in the search bar brings up the settings for device encryption and bit locker. Seems easier than editing the registry.

You didn't seem to read the thread did you? It's very to turn it off from Control panel but I don't want it to even start for laptops that we sell to customers.

Try3 · Apr 3, 2023

Spartan,

I've been following this thread because I'm about to buy a new laptop.
HP ENVY 17-cr0001na
Added later: Which turned out not to be able to use S3 Sleep after all and is being returned. Quite disconcertingly, its PowerCfg -a results confirmed that the Registry edit had enabled S3 Sleep. It was only when I tried using it that I found out that the computer froze instead of going into S3 Sleep.

If I have understood correctly, I can apply your post #7 .reg file during OOBE {by opening a cmd prompt using Shift-F10 during the OOBE region-keyboard selection dialogs}.
Is that right?

I appreciate that the Registry change is only required for devices that support S0 Modern standby.
- Mine probably does not have S0 Modern standby but that has not been guaranteed so I am going to have to behave as though it does until I can demonstrate otherwise.
- The best I could get was an HP tech sp saying that he thought it was an S3 Sleep computer but he could not find any documentation to confirm that.
- I will also try to avoid creating an MSAccount altogether by using the guidance in the Clean install tutorial to bypass the internet connection check steps. Belts & braces.

All the best,
Denis

kelper · Apr 11, 2023

hsehestedt said:
it is completely transparent to the user.

Ha ha; you mean it's completely opaque! If it were transparent, he would see it!

cereberus · Apr 11, 2023

kelper said:
Ha ha; you mean it's completely opaque! If it were transparent, he would see it!

The term gets used interchangeably.

kelper · Apr 11, 2023

cereberus said:
The term gets used interchangeably.

Not by me! Surely, transparent means hiding nothing? I think y'all confuse transparent with invisible.

cereberus · Apr 12, 2023

kelper said:
Not by me! Surely, transparent means hiding nothing? I think y'all confuse transparent with invisible.

Regrettably, not everybody has your evidently keen insight to the English Language.

Try3 · Apr 14, 2023

bfunke said:
Typing encryption in the search bar brings up the settings for device encryption and bit locker. Seems easier than editing the registry.

Thanks, I forgot all about this topic during OOBE. Sorry, Spartan.

I had made a system image before OOBE using my Acronis USB but could not make one after OOBE because the drive was reported as encrypted by Bitlocker.
- ~~I have enabled S3 Sleep~~ but it had used S0 Modern standby when OOBE was first completed so that was when & why the encryption happened.
- I then went to Settings, Privacy & security, Device encryption and turned it off.
- Despite a warning that it might take a long time, it has decrypted the disk within a couple of minutes.
And now it is happily making a new post-OOBE system image.

Added later: Which turned out not to be able to use S3 Sleep after all and is being returned. Quite disconcertingly, its PowerCfg -a results confirmed that the Registry edit had enabled S3 Sleep. It was only when I tried using it that I found out that the computer froze instead of going into S3 Sleep.

All the best,
Denis