Need advice on my recent Dell purchase

TraderGary said:

I've had close to a dozen Dell computers over the past several decades and I've never had any of them that came pre-logged in with a local Owner account. I installed every one of them with a brand-new setup of Windows and I log in with my own login and password. I've also had several Microsoft Surface computers and every one of them also starts with a brand-new setup of Windows.

Nope, I've never had this happen.

I remove all trial ware as I use Microsoft Security (Defender).

I only buy my computers with Windows Pro. I've never owned a computer with a Home edition of Windows.

I'm apparently an outlier on this forum as I use BitLocker and I'm a Microsoft 365 subscriber. My terabyte of OneDrive is a key component of my 3-2-1 backup strategy.

Click to expand...

I'm with you Gary. My Dell runs Win 11 Pro, BitLocker is enabled, and I use OneDrive all the time.

Step 1: Disable Device Encryption via Settings​

If it's still active:

• Go to Settings > Privacy & Security > Device Encryption
• Toggle Device Encryption off
• Wait for decryption to complete (this may take time depending on disk size)

This only disables it temporarily—it can re-enable itself after updates or policy changes unless further steps are taken.

Step 2: Remove the Encryption Key from TPM​

To prevent reactivation via TPM-stored key:

1. Open Command Prompt as Administrator
2. Run:
   manage-bde -protectors -delete C: -type TPM
   This removes the TPM-bound protector from the volume.
3. Optionally, clear TPM entirely (if you're not using it for other features):
   • Run:
     tpm.msc
   • Choose Clear TPM (requires reboot and confirmation)

This ensures no residual key material remains in TPM that BitLocker or Device Encryption could reuse.

Step 3: Set Registry Flag to Block Re-encryption​

This is the permanent prevention step:
reg add hklm\system\currentcontrolset\control\bitlocker /v PreventDeviceEncryption /t reg_dword /d 1 /f
This registry key tells Windows to never auto-enable Device Encryption again, even after updates or hardware changes.

Optional: Remove Encryption-Related Services​

If you're going full scorched-earth:

• Disable the Device Encryption Service:
  
  Code:

  sc config "DeviceEncryptionService" start= disabled
  sc stop "DeviceEncryptionService"

• Disable BitLocker Drive Encryption Service (if present):
  
  Code:

  sc config "BDESVC" start= disabled
  sc stop "BDESVC"

These steps are more aggressive and may interfere with future BitLocker use—only do this if you're sure.

Verify Status​

Run:
manage-bde -status

You should see:

• Conversion Status: Fully Decrypted
• Protection Status: Protection Off
• Key Protectors: None

If you're curious whether orphaned protection keys are still hanging around in the cloud, you can check here:
This page shows any BitLocker recovery keys tied to your account. If you see one listed for your device, it means the key was backed up to the cloud during the encryption.
Even though your drive(s) is/are decrypted now, the presence of a backed-up key doesn’t pose a risk—but it’s good hygiene to know what’s floating around. You just got to make sure that you don't lock yourself out by accidentally removing a backup of a key that you still need. That's why, before you remove a backup of a key from the cloud, you should verify the status always first, by running the command above—and don’t pick the wrong device from the list in the cloud if you own multiple computers.

Even if the registry setting gets accidentally removed and Device Encryption gets silently re-enabled somehow, the actual encryption doesn't begin before a proper backup of the key is made. Immediately as soon as Device Encryption is enabled/re-enabled, a new key protector is created and stored in the TPM, as old key protectors aren't reused. Next, if you log in with a Microsoft account, a new backup of the key is made but any existing backups aren't automatically removed. So, turning Device Encryption off causes existing backups to be orphaned immediately, regardless of whether you run the command from Step 2.2 above, and regardless of whether the backups are in the cloud or are stored elsewhere—or both.

hdmi said:

Step 2: Remove the Encryption Key from TPM​

To prevent reactivation via TPM-stored key:

1. Open Command Prompt as Administrator
2. Run:
   manage-bde -protectors -delete C: -type TPM
   This removes the TPM-bound protector from the volume.
3. Optionally, clear TPM entirely (if you're not using it for other features):
   • Run:
     tpm.msc
   • Choose Clear TPM (requires reboot and confirmation)

This ensures no residual key material remains in TPM that BitLocker or Device Encryption could reuse.

Click to expand...

Well I never signed into an account on this machine, so if it created a key, it was without my knowledge.

Are there any ramifications towards doing this with TPM?

hdmi said:

Step 3: Set Registry Flag to Block Re-encryption​

This is the permanent prevention step:
reg add hklm\system\currentcontrolset\control\bitlocker /v PreventDeviceEncryption /t reg_dword /d 1 /f
This registry key tells Windows to never auto-enable Device Encryption again, even after updates or hardware changes.

Click to expand...

Yeah, but I heard a future update could possibly remove that key, so it's semi-permanent I guess...

hdmi said:

Optional: Remove Encryption-Related Services​

If you're going full scorched-earth:

• Disable the Device Encryption Service:
  
  Code:

  sc config "DeviceEncryptionService" start= disabled
  sc stop "DeviceEncryptionService"

• Disable BitLocker Drive Encryption Service (if present):
  
  Code:

  sc config "BDESVC" start= disabled
  sc stop "BDESVC"

Click to expand...

Yeah, I read about this one somewhere else. I don't know how permanent that would be, either.

hdmi said:

Verify Status​

Run:
manage-bde -status

You should see:

• Conversion Status: Fully Decrypted
• Protection Status: Protection Off
• Key Protectors: None

If you're curious whether orphaned protection keys are still hanging around in the cloud, you can check here:

Click to expand...

Thanks for the info but I removed OneDrive immediately using Revo, so no cloud there. Not to mention, I never signed in and I have not moved any personal files over to My Documents, Video, Downloads folders, etc... Those folders contain nothing.

hdmi said:

This page shows any BitLocker recovery keys tied to your account. If you see one listed for your device, it means the key was backed up to the cloud during the encryption.

Click to expand...

When I first started up the machine, I immediately went to BitLocker and it was already turned off by default. I did have to manually turn off file encryption, though. I never did click on the option to create a key.

hdmi said:

Even if the registry setting gets accidentally removed and Device Encryption gets silently re-enabled somehow, the actual encryption doesn't begin before a proper backup of the key is made. Immediately as soon as Device Encryption is enabled/re-enabled, a new key protector is created and stored in the TPM, as old key protectors aren't reused. Next, if you log in with a Microsoft account, a new backup of the key is made but any existing backups aren't automatically removed. So, turning Device Encryption off causes existing backups to be orphaned immediately, regardless of whether you run the command from Step 2.2 above, and regardless of whether the backups are in the cloud or are stored elsewhere—or both.

Click to expand...

The TPM option looks the most promising. Yes?

I'd also look at going into services.msc as an administrator and see what services are running for it in the background and disable anything in there as well, although some future update my turn it back on. Even in Windows 10, I occasionally would pop in to services.msc and see what was turning itself back on since I can't fully trust Microsoft with their updates. However, for the last year or so, I haven't found anything in there that was reversed.

This whole thing should be an option for people. I believe in choice. For some who want it, go for it. For those that don't, they shouldn't have to put up with it. Where there's a will, there's a way.

cheaterslick said:

Are there any ramifications towards doing this with TPM?

Click to expand...

Not if you can be certain that Device Encryption is disabled and that you are not using the TPM for anything else, but that’s the problem... Windows 11 Home (or Pro or whatever) can use the TPM for a lot of other stuff. AFAIK clearing the entire TPM should not be necessary to prevent Device Encryption silently turning itself back on, anyway in the first place.

Unless you really want to read another chapter or two (or three or four or five), I suggest to skip this step. As long as you don’t skip the step that removes the key protectors from the TPM with manage-bde, I think you should be fine. Personally, I haven’t cleared my entire TPM, and I have yet to come across problems with Device Encryption turned off. I am running Windows 11 Home version 24H2 latest build on two different laptops with Device Encryption off. If Windows Update causes one of 'em to explode and I still survive, I’ll make sure that you’ll be the first to hear about it.

cheaterslick said:

Yeah, but I heard a future update could possibly remove that key, so it's semi-permanent I guess...

Click to expand...

cheaterslick said:

but I removed OneDrive

Click to expand...

It makes no difference. The keys are backed up to a space in the cloud that is separate from OneDrive so both OneDrive and it are tied to the same Microsoft account but are tied separately to it. These backed up keys are behind an official webpage from Microsoft (see the link I posted) that requires the user to sign in first, before the user can access them.

cheaterslick said:

When I first started up the machine, I immediately went to BitLocker and it was already turned off by default.

Click to expand...

Do you mean Device Encryption already turned off by default? BitLocker (BitLocker Drive Encryption) is not available on Windows 11 Home.

cheaterslick said:

I did have to manually turn off file encryption, though.

Click to expand...

Encrypting File System (EFS) for individual files and folders is not available on Windows 11 Home either.

cheaterslick said:

I never did click on the option to create a key.

Click to expand...

The key protector is created (and stored in the TPM) automatically as soon as Device Encryption turns on. The proper backup of the key is created (in the cloud) automatically as soon as you log in to Windows with your Microsoft account.

cheaterslick said:

The TPM option looks the most promising. Yes?

Click to expand...

Do you mean the option to disable Device Encryption via Settings, then wait for the drive(s) to be decrypted fully, and then verify the satus before you use the manage-bde command to remove the key protector(s) from the TPM? That’s the option I use. AFAIK it should be adequate. With or without taking extra steps to prevent Device Encryption going rogue on you while you weren’t looking, if the SSD fails and you didn’t make a backup image of your Windows partition plus a (separate) backup of all your important data, you still lose anyway in the first place. As crude as this may sound, there is a reason why they still call it Mickeysoft...

cheaterslick said:

I'd also look at going into services.msc as an administrator and see what services are running for it in the background and disable anything in there as well, although some future update my turn it back on. Even in Windows 10, I occasionally would pop in to services.msc and see what was turning itself back on since I can't fully trust Microsoft with their updates. However, for the last year or so, I haven't found anything in there that was reversed.

This whole thing should be an option for people. I believe in choice. For some who want it, go for it. For those that don't, they shouldn't have to put up with it. Where there's a will, there's a way.

Click to expand...

It rubs the lotion on its skin. It does this whenever it is told.

if you are considering standalone encryption software that keeps everything including keys on the system
have a look at VeraCrypt which is open source encryption software.

if you do decide to use it to encrypt C:drive just go into the BIOS
and set the VeraCrypt boot manager as the first boot option.

best of luck, Steve ..

hdmi said:

It makes no difference. The keys are backed up to a space in the cloud that is separate from OneDrive so both OneDrive and it are tied to the same Microsoft account but are tied separately to it. These backed up keys are behind an official webpage from Microsoft (see the link I posted) that requires the user to sign in first, before the user can access them.

Click to expand...

Again, never signed in. There's no email address associated with it, although that will soon change when I import Office Home and Student edition and have to use my email account to do so. But that's only for the instillation of Office. I do not use Office 365 and I plan on staying logged off when I create documents.

hdmi said:

Do you mean Device Encryption already turned off by default? BitLocker (BitLocker Drive Encryption) is not available on Windows 11 Home.

Click to expand...

No, but both of them are available on the 24H2 Pro edition. I've been using only Pro editions of Windows ever since Windows 2000.

That's what? 25 years now...

I use mostly business Latitude laptops and they all come with Pro as standard.

hdmi said:

Encrypting File System (EFS) for individual files and folders is not available on Windows 11 Home either.

Click to expand...

Again, both BitLocker and device encryption come with 24H2 Pro, and they are two different settings.

I think that was a recent change Microsoft did.

hdmi said:

Do you mean the option to disable Device Encryption via Settings, then wait for the drive(s) to be decrypted fully, and then verify the satus before you use the manage-bde command to remove the key protector(s) from the TPM? That’s the option I use. AFAIK it should be adequate. With or without taking extra steps to prevent Device Encryption going rogue on you while you weren’t looking, if the SSD fails and you didn’t make a backup image of your Windows partition plus a (separate) backup of all your important data, you still lose anyway in the first place. As crude as this may sound, there is a reason why they still call it Mickeysoft...

Click to expand...

I probably will only do your Steps 1 & 3 for now and leave TPM alone.

But if for some reason I have to do your Step 2 TPM, then I can do that as a last resort in case Microsoft deletes those Step 1 & 3 settings.

cheaterslick said:

I probably will only do your Steps 1 & 3 for now and leave TPM alone.

But if for some reason I have to do your Step 2 TPM, then I can do that as a last resort in case Microsoft deletes those Step 1 & 3 settings.

Click to expand...

My advice is to skip Step 2.3 to avoid the potential risk of ramifications. However, Step 2.2 assures that the old key protectors (if present) can never be reused when Device Encryption reactivates. If they get reused, you run the risk of locking yourself out permanently. You certainly don’t want that. Of course if neither Device Encryption nor BitLocker Drive Encryption has ever been enabled, there should be no old key protectors. Even so, better safe than sorry IMO. Running the manage-bde -status command can never hurt, it is a very easy way to be sure.

hdmi said:

My advice is to skip Step 2.3 to avoid the potential risk of ramifications. However, Step 2.2 assures that the old key protectors (if present) can never be reused when Device Encryption reactivates. If they get reused, you run the risk of locking yourself out permanently. You certainly don’t want that. Of course if neither Device Encryption nor BitLocker Drive Encryption has ever been enabled, there should be no old key protectors. Even so, better safe than sorry IMO.

Click to expand...

So run this?

1. Open Command Prompt as Administrator
2. Run:
manage-bde -protectors -delete C: -type TPM
This removes the TPM-bound protector from the volume.

Click to expand...

And then run this as well?

hdmi said:

Running the manage-bde -status command can never hurt, it is a very easy way to be sure.

Click to expand...

Those are safe?

Run manage-bde -status first (in an elevated command window), to view the status. It shows all BitLocker volumes in the system. Conversion Status: Fully Decrypted means the volume has been decrypted fully. If a volume is encrypted (or partially), then if you choose to disable Device Encryption via Settings, the volume gets decrypted but takes some patience until the volume will be decrypted fully. To check, you can run the command again as many times as you like. Protection Status: Protection Off means the volume is either unencrypted, partially encrypted, or the encryption key is available in the clear on the hard disk. Key Protectors: None means no key protectors exist for the volume.

So, if a key protector is still present (in the TPM) for the volume, then if the conversion status of the volume is fully decrypted and the protection status of the volume is protection off, it means that it’s now safe to delete (from the TPM) the key protector of the volume by running
manage-bde -protectors -delete C: -type TPM (where C is the drive letter of the volume). To view a list of all the key protectors for a volume, you can run manage-bde -protectors -get C: (where C is the drive letter of the volume). Additionally, you can always run manage-bde -status again to see if everything checks out. Here is an example of how that may look like:
As you can see, my volume C and D are fully decrypted, protection off, and, neither volume C nor volume D has a key protector.

glasskuter said:

I strongly suggest that you keep Dell Command Update to keep your drivers updated. You can set it to do so automatically or do like I do. I stop it from autostarting and run it manually every month or two. It's a fantastic tool and has never failed me. Dell updates bios quite often so I depend on Dell Command Update for bios and drivers update. IT IS NOT A BLOAT APP.

Click to expand...

I agree and will keep it for the time being.

glasskuter said:

If you choose to do as I do, you would want to disable include drivers with windows update. Windows update tends to load old drivers and I darn sure don't want WU updating my bios. Enable or Disable Include Drivers with Windows Updates in Windows 11

Click to expand...

I did the group policy option

pseymour said:

I should point out that glasskuter and TraderGary mentioned Dell Command | Update, while garioch7 mentioned Dell Update. These have some things in common, but they are not the same. Dell Update is for consumer machines, while DCU is for business machines.*

That being said, I agree with these two amigos. I have DCU on thousands of devices and have done so for more years than I can recall; nary a problem in sight.

Click to expand...

Some of these are what Dell calls Support Assist plug-ins. Here is what Revo has picked up:



So everybody, what here do you think I should keep and what should I get rid of?

DJNelson said:

The Dell Precision in my specs came with the most bloated software set I've ever seen

Click to expand...

All manufacturers do that.

As soon as the warranty is over, back up your drivers. You can use a freeware called double driver. Next, partition your disk as mentioned above. Then do a fresh install using MCT (Media Creation Tool) without any access to the internet. Re-install the drivers that you have backed up.

Once you are done, install whatever programs you want, including an office suite. Clean up your system. Just use a free cleaner if you are not confident of doing it yourself.

After trimming your Windows (SSD I presume), go online and do a reboot. Your Windows will be automatically licensed after that. Your license key is embedded somewhere on the motherboard.

You will get a slim and trimmed Windows with a much faster bootup time.

Now back up your ‘new’ OS to your D Drive or even better, an external drive with one of the backup software suggested.

You can then proceed to experiment all you want and trying out the various software that catches your eye, knowing full well you can always rely on the image you have created in case things go wrong.

That’s my take on it!

cheaterslick said:

I agree and will keep it for the time being.



I did the group policy option



Some of these are what Dell calls Support Assist plug-ins. Here is what Revo has picked up:

View attachment 146950

So everybody, what here do you think I should keep and what should I get rid of?

Click to expand...

I don't use Winaero Tweaker. Winaero Tweaker is a third-party utility developed by Sergey Tkachenko that allows users to customize and tweak various hidden settings in Windows. Winaero Tweaker is not maintained or supported by Microsoft. While it's popular among power users for its ability to simplify registry edits and system modifications, Microsoft has taken a cautious stance. While it's not illegal or explicitly banned, it operates outside Microsoft's ecosystem and could affect system stability depending on how it's used.

TraderGary said:

I don't use Winaero Tweaker. Winaero Tweaker is a third-party utility developed by Sergey Tkachenko that allows users to customize and tweak various hidden settings in Windows. Winaero Tweaker is not maintained or supported by Microsoft. While it's popular among power users for its ability to simplify registry edits and system modifications, Microsoft has taken a cautious stance. While it's not illegal or explicitly banned, it operates outside Microsoft's ecosystem and could affect system stability depending on how it's used.

Click to expand...

Hello Gary and thanks...

Yes, I use Winaero Tweaker and installed it, but I more was asking about all those Dell programs that appear there and was wondering if anybody thinks some of them are redundant or not. That there may be some duplication of services. I'm looking for opinions on those and was wondering if I can delete them or not.

Or I may bring it up as another topic in another thread if need be.

Thanks to all

cheaterslick said:

Hello Gary and thanks...

Yes, I use Winaero Tweaker and installed it, but I more was asking about all those Dell programs that appear there and was wondering if anybody thinks some of them are redundant or not. That there may be some duplication of services. I'm looking for opinions on those and was wondering if I can delete them or not.

Or I may bring it up as another topic in another thread if need be.

Thanks to all

Click to expand...

As I said in the thread previously, I've owned more than a dozen Dell computers over the years. Because of my experience with Dell, I don't remove any of the programs Dell includes with their computers. It's my experience that the Dell engineers know what they are doing, and the included Dell programs are there for a reason. I use SupportAssist and Dell Command | Update frequently. SupportAssist is invaluable as it includes instant Dell Chat, and the Dell tech then knows everything he/she needs to know about my computer.

Sergey Tkachenko, the developer behind Winaero Tweaker, is based in Penza, Russia. He founded Winaero in 2011 and continues to maintain the site and its suite of Windows customization tools.

TraderGary said:

Sergey Tkachenko, the developer behind Winaero Tweaker, is based in Penza, Russia. He founded Winaero in 2011 and continues to maintain the site and its suite of Windows customization tools.

Click to expand...

lol, - - I learned about Winaero Tweaker here in this forum. Never heard of it before then.

Is it not recommended here in the elevenforum anymore?

If Winaero Tweaker turns out to be a security issue, then I'll definitely remove it.

Winaero tweaker is great for users that are somewhat experienced and not noobs.
It is still recommended here, but it is not supported by Microsoft.
Always make a current image of your computer before using any 3rd party tweaking apps, like Winaero in case things don't go as planned.

If you trust Brink's tutorials, you can trust WinaeroTweaker, they're pretty much a mirror of each other.
As far as security is concerned, the app collects some machine data, that's about it.
That being the case, then MS itself is probably more of a security threat than WinaeroTweaker!