Looking for info regarding the reg entry to prevent auto device encryption

hsehestedt · Tuesday at 6:06 PM

@garlin , I suspect that you know the answer to this...

Unfortunately, I have only a single system that will auto encrypt, but I simply cannot reinstall on it now so I have no way to test this. There are a number of posts regarding a registry entry that is used to prevent automatic device encryption. Unfortunately, this information does not tell me if I need to integrate this registry entry into the boot.wim or if I can run it early in the installation process.

Just for clarification, the registry entries that are used to bypass Windows 11 system requirements can be loaded very early on. For example, at the very first static screen during setup, the appropriate registry changes can be loaded. What I need to know is if I can do the same for the entry to prevent encryption. My intention is to add it to my answer files but before I modify a whole bunch of these files, I simply need to know if this will work and that is difficult without a machine to test on.

Here is the registry file that makes the appropriate change assuming that it works this early in the setup process:

Code:

Windows Registry Editor Version 5.00

; This file will (hopefully) prevent auto device encryption when installing Windows from scratch.
; To use: Copy this file to the root of your Windows installation media making sure to name it so
; that it has a .reg extension. Boot from it to begin the Windows installation process. At the
; first static screen, open a command prompt by pressing SHIFT + F10 and run the .reg file. Proceed
; with installation as normal. After installation, open an elevated command prompt and run the
; command "manage-bde - status c:". Is the drive completely decrypted?

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BitLocker]
"PreventDeviceEncryption"=dword:00000001

Why does this matter?

Yes, I know that I could simply allow encryption to happen and then decrypt after installation, but my situation is a little different. I'll save the long explanation, just trust that there is a good reason for what I am doing

garlin · Tuesday at 6:34 PM

You can change the registry value, but Unattended mode supports the same option:

Code:

<component name="microsoft-windows-securestartup-filterdriver-" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
      <PreventDeviceEncryption>true</PreventDeviceEncryption>
</component

hsehestedt · Tuesday at 6:53 PM

garlin said:
You can change the registry value, but Unattended mode supports the same option:

Code:

<component name="microsoft-windows-securestartup-filterdriver-" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS"> <PreventDeviceEncryption>true</PreventDeviceEncryption> </component

But that still doesn't clarify for me WHERE in the answer file to put this. Based on some more recent research I'll starting to think it needs to go in OOBE. I also got this response from Copilot:

XML:

<settings pass="oobeSystem">
    <component name="Microsoft-Windows-SecureStartup-Configuration" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
        <EnableSecureBoot>false</EnableSecureBoot>
        <PreventDeviceEncryption>true</PreventDeviceEncryption>
    </component>
</settings>

garlin · Tuesday at 7:09 PM

Adding this to offlineServicing pass guarantees it's embedded. I believe Device Encryption doesn't turn on until the specialize pass.

Don't ask AI. That's like asking answers.microsoft.com for help.

hsehestedt · Tuesday at 8:22 PM

garlin said:
That's like asking answers.microsoft.com for help.

LOL. Love it!

Apologies for all the questions regarding this. I just don't have any systems that seem to auto encrypt (except one that I simply cannot wipe right now) so I have no means of actually testing any of this. That simply makes me want to get it right the first time

Thanks for all the help. Much appreciated.

garlin · Tuesday at 8:29 PM

Obviously if you're in an upgrade scenario, setting the reg value on a live system can help prevent Device Encryption from unexpectedly triggering.

XxXxX · Tuesday at 10:11 PM

maybe having a look Rufus and see how Rufus disables bitlocker before it burns the ISO.
i believe Rufus disables the bitlocker service so that bitlocker wont run automatically after a clean install.

best of luck, Steve ..

garlin · Tuesday at 10:28 PM

Rufus does the same thing, it writes those exact lines to an unattended file.

Code:

        if (flags & UNATTEND_DISABLE_BITLOCKER) {
            uprintf("• Disable bitlocker");
            fprintf(fd, "    <component name=\"Microsoft-Windows-SecureStartup-FilterDriver\" processorArchitecture=\"%s\" language=\"neutral\" "
                "xmlns:wcm=\"http://schemas.microsoft.com/WMIConfig/2002/State\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" "
                "publicKeyToken=\"31bf3856ad364e35\" versionScope=\"nonSxS\">\n", xml_arch_names[arch]);
            fprintf(fd, "      <PreventDeviceEncryption>true</PreventDeviceEncryption>\n");
            fprintf(fd, "    </component>\n");
            fprintf(fd, "    <component name=\"Microsoft-Windows-EnhancedStorage-Adm\" processorArchitecture=\"%s\" language=\"neutral\" "
                "xmlns:wcm=\"http://schemas.microsoft.com/WMIConfig/2002/State\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" "
                "publicKeyToken=\"31bf3856ad364e35\" versionScope=\"nonSxS\">\n", xml_arch_names[arch]);
            fprintf(fd, "      <TCGSecurityActivationDisabled>1</TCGSecurityActivationDisabled>\n");
            fprintf(fd, "    </component>\n");
        }

Looking for info regarding the reg entry to prevent auto device encryption

hsehestedt

Well-known member

My Computers

System One System Two

garlin

Well-known member

My Computer

System One

hsehestedt

Well-known member

My Computers

System One System Two

garlin

Well-known member

My Computer

System One

hsehestedt

Well-known member

My Computers

System One System Two

garlin

Well-known member

My Computer

System One

XxXxX

Well-known member

My Computers

System One System Two

garlin

Well-known member

My Computer

System One

Similar threads

Latest Support Threads

Latest Tutorials