Solved Surprised at no auto bitlocker encryption after Win 10 to Win 11.

timbobit · Oct 23, 2021

handy commands from admin terminal window or powershell

manage-bde -status

manage-bde -off C:

manage-bde -on C:

Winuser · Oct 23, 2021

BaJohn said:
As somebody said on here in another thread MS is business orientated, which means they want total security for the data, hence TPM etc.
Presumably in early releases the default was encrypt to suit business machines, and then the insiders complained (I am not an insider).
This means normal Home and Pro users whom also require TPM etc to upgrade are having to meet a spec that MAY be impossible when they don't really need to meet the spec at all, as they are not bothered about data security in the same way.
Does that make sense?

I started using Win 11 when the leaked build was available in a VM. I upgraded my desktop running Win 10 on day one of MS releasing Win 11 to the Insiders and never had any files encrypted.

han jansen · Oct 23, 2021

I did a clean install as dual boot, that is the cause.
On my second system I did an update and no bitlocker was started.

Winuser · Oct 23, 2021

Devlin1888 said:
It was provided by Brink in that forum post, So is he lying or...

Brink was only stating what MS said. MS may still decide to stop noncompliant devices from getting updates in the future.

Bree · Oct 23, 2021

Devlin1888 said:
It was provided by Brink in that forum post, So is he lying or...

Winuser said:
Brink was only stating what MS said. MS may still decide to stop noncompliant devices from getting updates in the future.

It's open to interpretation.....

The exact wording of the statement from Microsoft is that "Devices that do not meet these system requirements will no longer be guaranteed to receive updates, including but not limited to security updates" (my bold)

I read this to mean that MS reserve the right to stop updates for unsupported devices at any time, though I suspect they won't exercise that right any time soon, if ever. But some time in the future they may want to add functions to the OS that can only work on supported devices. Rather than crashing all the unsupported ones they could pull the plug on updates. They would be able to point to that original statement should anyone complain saying 'don't say we didn't warn you'.

The one thing I can be certain of is that so far my unsupported machine has had all the same updates as my supported ones.

BaJohn · Oct 24, 2021

timbobit said:
handy commands from admin terminal window or powershell

manage-bde -status

manage-bde -off C:

manage-bde -on C:

Never seen that before - Thanks

BaJohn · Oct 25, 2021

On a different thread, I have been recommend to do a clean install.
I will do that ASAP and hope that bitlocker doesn't kick in during the install.

barman58 · Oct 25, 2021

TPM in some form or another have been part of systems available since 2013 or even earlier and secure boot around the same time

The main stumbling block for updators is the CPU requirement. All of the Processors listed as compatible are those with a newer architecture required for protection against Spectre and similar malware. This major recoding of the processor architecture also allows possible future changes that cannot be accepted by earlier processors.

Microsoft has allowed older spec Processors to be used to run Windows 11 and there is also a Microsoft downloadable Registry update that allows the running on systems without TPM and Secure Boot.

Microsoft has simply stated that at some future time that systems that do not meet any or all of these requirement MAY not be able to have the OS upgraded any further - As the upgrades to the OS would not work with the Non compliant system spec

As far as Bitlocker is concerned Bitlocker does not require a TPM to be enabled and a TPM will do it's hardware security tasks without Bitlocker being active - If you choose to activate Bitlocker with A TPM present, then the TPM will be used to store the Bitlocker Key

BaJohn · Oct 26, 2021

I have been concerned that doing a clean install of Windows 11 MAY cause the OS drive to be encrypted, which I don't want.
I've just discovered that using Win 11 'Control Panel' -> 'System Information' is the following:
PCR7 Configuration Binding Not Possible
Device Encryption Support Reasons for failed automatic device encryption: PCR7 binding is not supported, Hardware Security Test Interface failed and the device is not Modern Standby, Un-allowed DMA-capable bus/device(s) detected.

Thought this might be useful information about why some PCs auto encrypt and others do not.
My PC was created June 2020 so I would have thought it would have all the modern 'bells and whistles'.
For me this is actually a good thing, although it would have been nice to have the choice and not use it.

semce2 · Oct 31, 2021

From what I've read Bitlocker is only available for Pro or Enterprise versions, not for Home version of Windows.

BaJohn · Oct 31, 2021

semce2 said:
From what I've read Bitlocker is only available for Pro or Enterprise versions, not for Home version of Windows.

Mine is Win 11 Pro - See 'My Computer'.

barman58 · Oct 31, 2021

I have not heard of any cases where this happened with the RTM release, though there was some mention of this type of issue on early Dev versions.

would suggest that you just go ahead and upgrade when you want to but suggest that you make an offline backup of Win 10 before you go ahead.

If you have bitlocker on when you are ready to upgrade I suggest that you disable it before you upgrade but also keep a copy of your decryption key off line also

Bree · Oct 31, 2021

barman58 said:
have not heard of any cases where this happened with the RTM release....

I had it with a clean install of RTM 11 Pro on a laptop that supports Modern Standby, seems to be the default to turn on Bitlocker. I wouldn't expect it to be turned on by an upgrade though.

Bree said:
have just clean installed W11 Pro using a USB made by the MCT on a laptop with Modern Standby. That too had bitlocker encrypted drives by default.

Oddly, at no time was I asked to save any key, nor did Control Panel say that bitlocker was turned on. The properties for C: however showed it was encrypted, and the command Manage-bde –off had Control Panel showing 'Decrypting...' for quite some time until it was done.

Actually, this PC had an OEM W10 Pro on it when I bought it, and that too was in the same state - bitlocker encrypted drives, but Control Panel still saying 'Turn on Bitlocker'.

Dav · Oct 31, 2021

If you are going to upgrade I agree with Barman.
I upgraded two of my laptops and I disabled Bitlocker on both for the upgrade and then re-enabled it after the upgrade and all worked well.

I used the following:
Disable
Elev Cmd Prmpt
Manage-bde –Protectors –Disable C: -RebootCount 15

Resume
Elev Cmd Prmpt
Manage-bde –Protectors -Enable C:

Note: "In the command, the -RebootCount allows you to specify how many times your computer can restart before BitLocker will re-enable automatically. You can use values 0 through 15, while zero suspends BitLocker until you resume the protection manually."

Manage-bde –Protectors –Disable C: -RebootCount 0

Also you can check the status: for example to see percentage of encryption or just status
Manage-bde -Status C:

Volume C: [Windows]
[OS Volume]

Size: 237.24 GB
BitLocker Version: 2.0
Conversion Status: Fully Encrypted
Percentage Encrypted: 100.0%
Encryption Method: XTS-AES 256
Protection Status: Protection On
Lock Status: Unlocked
Identification Field: Unknown
Key Protectors:
TPM And PIN
Numerical Password

RTeeL · Oct 31, 2021

@barman58 @Dav Hi Guys, I use Bitlocker on my two Desktops and did not suspend/disable it when I upgraded from Win 10 to Win 11. During the upgrade it will be disabled as part of the process. Here's a screenshot from my X570-P on the 6th. Oct. The only time I do suspend Bitlocker is when I upgrade the BIOS.

barman58 · Oct 31, 2021

Thanks for that, good to hear that it worked for you without issue (which should be a given).

Personally when dealing with any form of security, especially encryption, I will always take the safest route. I have seen a small number of bad outcomes with security systems in the past forty years in IT, and the switch off, backup and copy of the encryption key is a safe method that i Have not seen fail

Solved Surprised at no auto bitlocker encryption after Win 10 to Win 11.

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Moderator

My Computers

Well-known member

My Computer

Active member

My Computer

Well-known member

My Computer

Moderator

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Moderator

My Computers

Similar threads