Securing Windows 11 Desktop

I was watching videos on people bypassing and resetting passwords using Hirens Boot CD and a bootable usb drive.

I thought that the windows 11 requirement of TPM was supposed to prevent that. If it does not prevent it, then how do I secure my pc against these hacks?
I do have all my drives bitlocked, secure boot enabled and a password on the bios. Is there anything I am missing?

Note: I'm not computer smart, so take it easy on me...

This scenario is exactly one of the reasons why BitLocker should be used to protect a system drive.

An attacker with physical access to your PC may attempt to boot off an USB instance of Windows or Linux, and mount the system drive. Because they can't retrieve the BitLocker key from TPM, your copy of Windows is unreadable. The same goes if they remove your drive and temporarily move it to another PC they control.

Also, the best protection against such hacks is BitLocker with a pre-boot PIN or other protection mechanisms. There is no well-publicised way around it.

duecks said:

I was watching videos on people bypassing and resetting passwords using Hirens Boot CD and a bootable usb drive.

Click to expand...

It can only bypass an useless local account password, MSA is secure by default.

To lock down a windows pc, the best things to do in order are:

1.) Set a bios password so that any changes to boot media require that password. Ensure that only your main drive with windows is set to boot and nothing else.

2.) Enable bitlocker/device encryption. If you have Windows 11 pro, adjust bitlocker so that a password / pin is required to boot windows.

3.) Use a microsoft account, not a local account. This protects your data and sign in from password reset tools.


Despite all this, it is important to know that anyone with access to the computer for a long time will most likely find a way in. But this makes it much harder for them.

TairikuOkami said:

It can only bypass an useless local account password, MSA is secure by default.

Click to expand...

A specific Tool, don't remember which, in Sergei Strelec can also convert a Microsoft account to local account and then remove the password. But this is only if the hacker has stolen your laptop and has physical access to it and if the disk is unencrypted. If the disk is encrypted all they can do is wipe it and reinstall Windows. Surely, they can sell your laptop, but at least any sensitive information is not accessible with an encrypted drive. This is also a warning for the user! If you encrypt the drive and forget the password, then say goodbye to your data. There is NOTHING you can do, (unless you had connected your Microsoft account with the locked system and can unlock from there).

spapakons said:

A specific Tool, don't remember which, in Sergei Strelec can also convert a Microsoft account to local account and then remove the password. But this is only if the hacker has stolen your laptop and has physical access to it and if the disk is unencrypted.

Click to expand...

That must have been some old or vulnerable version, system files are always encrypted, even if disk is not.
But yes, Bitlocker provides an additional protection, still I would never trust a local password for safety.

TPM 2.0 Flaw (CVE-2025-2884) - This means a malicious actor with local access could extract sensitive TPM data by abusing this flaw, or potentially disrupt the security module through a denial-of-service (DoS) attack. The TPM is central to processes like system authentication, disk encryption, and credential storage—so even partial access can have severe implications for OS integrity and data privacy.

Click to expand...

TairikuOkami said:

That must have been some old or vulnerable version, system files are always encrypted, even if disk is not.
But yes, Bitlocker provides an additional protection, still I would never trust a local password for safety.

Click to expand...

That's is the standard method of removing a password if one of my clients forgot it. Boot with Serget Strelec WinPE and run the appropriate unlock utility. For a local account, just remove the password or change it with a new password. Obviously the old password is not required to do that. If it is a Microsoft account, convert it to local account first and then remove the password or change it. Again the original password is not required. If the drive is encrypted and requires a key to unlock, and there is no Microsoft account connected to that device to unlock it, the only solution is to kiss goodbye any data, wipe it and reinstall Windows. That's why I recommend to NEVER forget your password or avoid locking your system just in case. I understand that you prefer a laptop or tablet encrypted so nobody can access your data if stolen, but I find it a little too much to lock a desktop computer, especially if you are the only one using it at home. Yes, I could create a second user account and put a password so that my son or wife cannot access my own data, but encrypting the entire drive is too much and risky if I forget the password, so I would rather avoid it.