Is there a way to prevent Windows from activating BitLocker automatically?

This is annoying the living crap out of me. Every time I install Windows 11 Pro or 10 Pro recently even, the first thing I noticed upon logging in is Windows is encrypting my disk which I know how to stop and disable but is there a way to prevent this from happening automatically so I don't need to manually stop it for every machine I install Windows on?

Are you in a domain environment where this might be getting pushed to your system via a policy?

I have never ever seen a standalone machine simply start BitLocking a drive on it's own.

hsehestedt said:

Are you in a domain environment where this might be getting pushed to your system via a policy?

I have never ever seen a standalone machine simply start BitLocking a drive on it's own.

Click to expand...

No man, at home.
Happens to me on every one of my machines that has an SSD and TPM support. This has started recently with the last build of Windows 10 and now on 11 obviously. Only happens on Windows Pro or Enterprise, not on Home edition installs

I see you're using Windows 11 Pro for Workstations. If I'm not mistaken, the default is to have BitLocker turned ON.

Actually the same happened to me on my Windows 11 Home edition yesterday when my separate I terabyte HDD drive was invisible to start with after a fresh genuine WIndows 11 install from iso so I have to unencrypt t as well as assign a new drive letter to it.
This has happened on a number of occasions and no logic behind it; totally random.

paulhatton said:

This has happened on a number of occasions and no logic behind it; totally random.

Click to expand...

It is and is freakin' annoying man! See I work in a computer company and we have a service where we teak and tune the computers of customers. I have to do this decrypting for every freakin' laptop that's why I'm saying this is annoying and not particular to my laptop. Happens 90% of the time now and sometimes it doesn't as if Windows has a mind of its own.

I wish there was entry or script to have in the Windows install Flash Disk to disable Encryption completely.

hsehestedt said:

I have never ever seen a standalone machine simply start BitLocking a drive on it's own.

Click to expand...

I have. A clean install of 10 or 11 Pro on a machine with a TPM will automatically encrypt the drive by default. I have also seen this on a Dell laptop that came with its OEM installed W10 Pro, and have also seen this on another Dell laptop after resetting it with its official Dell factory reset ISO (which installed Windows 10 Pro version 1809).

In all cases Bitlocker is not turned on though, but the drives are encrypted all the same.

yeah I always back up my "D drive" to an external hard drive before ever attempting a fresh install and yet with the same Windows 11 iso from Microsoft on the same Dell Inspiron 7700 AIO factory spec it has NEVER ever gone the same any time whenever I have reinstalled the system at all. Once both hard drives were encrypted no idea how and I was left with an operating system but with no initial way to access either hard drive weird or what !

I just checked my new Dell XPS 15 9510.
BitLocker was turned ON.
I'll be damned!
I just turned it OFF.

What does BitLocker do to disk speed?

Bree said:

I have. A clean install of 10 or 11 Pro on a machine with a TPM will automatically encrypt the drive by default. I have also seen this on a Dell laptop that came with its OEM installed W10 Pro, and have also seen this on another Dell laptop after resetting it with its official Dell factory reset ISO (which installed Windows 10 Pro version 1809).

In all cases Bitlocker is not turned on though, but the drives are encrypted all the same.

Click to expand...

Every single machine I have has a physical TPM which is enabled in the BIOS with the exception of my 10+ year old laptop. BitLocker does not self-enable on ANY of those systems. Ever. Period. I had to manually choose to BitLocker encrypt my drives every single time.

The one and only exception that I can see to this is possibly if you have self-encrypting drives installed in your system. I remember a discussion a few years ago about some rather severe vulnerabilities in some of those drives and I think Microsoft no longer "trusted" those drives. It may be that they used BitLocker to override the self-encryption on those drives but that is something I'll have to research.

TraderGary said:

I just checked my new Dell XPS 15 9510.
BitLocker was turned ON.
I'll be damned!
I just turned it OFF.

What does BitLocker do to disk speed?

Click to expand...

On modern hardware, it does nothing to the speed. Maybe a 1 or 2 percent performance hit on a bad day.

Ah hah!

TraderGary said:

What does BitLocker do to disk speed?

Click to expand...

Had I had not owned a Mac computer before, I would've never known. I had a MacBook Pro 16 last year and when you first go through the initial setup wizard, it asks you of you want to encrypt the disks for security which I stupidly did. I started using MacOS for the first time and everything was jerky and slow I thought that's how it is but knew something was off as it didn't coincide with all the online reviews I saw. Boot time was slow, system snappiness was not there. I then thought of turning off encryption and I swear it's like I just bought a new machine! Everything I described changed 180 degrees.

Same goes with Windows, I know how fast and snappy a new computer is because I deal with them every day for years. Only recently had I started noticing something was seriously wrong and when I checked, disk encryption was on and the moment you turn it off everything comes back to life.

Not to mention, we've had hundreds of tech support tickets of users who had lost their data after they formatted their C: partition thinking everything was safe on D: After the format, they had no way of accessing their old encrypted data as they didn't have the backup key.

This is a serious issue and Microsoft has no right enabling Encryption by default without the user giving consent and knowing what he's getting into.

hsehestedt said:

Every single machine I have has a physical TPM which is enabled in the BIOS with the exception of my 10+ year old laptop. BitLocker does not self-enable on ANY of those systems. Ever. Period. I had to manually choose to BitLocker encrypt my drives every single time.

The one and only exception that I can see to this is possibly if you have self-encrypting drives installed in your system. I remember a discussion a few years ago about some rather severe vulnerabilities in some of those drives and I think Microsoft no longer "trusted" those drives. It may be that they used BitLocker to override the self-encryption on those drives but that is something I'll have to research.

Click to expand...

90% of the time I see this happening to machines that have a Samsung SSD by the way.

The first thing I do now when I am on a new computer trying to tweak things is run the following command in an elevated command prompt, if the disk wasn't encrypted you'll get a message notifying of that. If it was encrypted, the decryption starts. But this is just wrong to start of with and I wish there was some tweak to do to the Windows installer so this doesn't happen regardless of the computer or hardware in it.

(replace c: with any other partition letters that may be present and run the command again)

Spartan said:

This is a serious issue and Microsoft has no right enabling Encryption by default without the user giving consent and knowing what he's getting into.

Click to expand...

It's not Microsoft. Your hardware vendor decided they wanted device encryption turned on...

I'm no longer encrypted. Let's see if I can tell the difference.

hsehestedt said:

BitLocker does not self-enable on ANY of those systems. Ever. Period. I had to manually choose to BitLocker encrypt my drives every single time.

Click to expand...

Yes, as I said, bitlocker was not turned on but Device encryption was - the drives were encrypted anyway, without any bitlocker key being provided. This appears to be the default when installing 10/11 Pro. Discussed at length in @NavyLCDR's thread here.


Both @ashleyg in post #80 (with screenshots) and myself in post #85 and post #95 reported exactly the same thing.

Ah mine has been turned off by default for me since changing to win 11 last june/july

In my case I recently purchased a new Lenovo IdeaPad laptop that came with Win11. I've had the laptop for about a week and I've done quite a few Win11 clean installs because I like to tinker. Anyhow, to answer your question, if i DISABLE SECURE BOOT in the bios Win11 will not encrypt the drive after a clean install. If I ENABLE SECURE BOOT in the bios Win11 will encrypt the drive after a clean install every time.

I've ran CRYSTAL DISKMARK with encryption ENABLED and DISABLED and there is no performance hit. If you have a modern system I'd recommend letting Win11 encrypt the drive so that your data is protected.

My opinions are mine and mine alone. Take it for what it's worth.