TCGSecurityActivationDisabled Registry entry

Hi.

In Windows 11 Pro Registry, there are these registry entries in several locations: "TCGSecurityActivationDisabled"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Storage\EnhancedStorageDevices]
"admxMetadataDevice"=hex:30,31,3d,01,00,00,00,00,32,3d,00,00,00,00,00,00
"Behavior"=dword:00000060
"mergealgorithm"=dword:00000003
"policytype"=dword:00000001
"RegKeyPathRedirect"="Software\\Policies\\Microsoft\\Windows\\EnhancedStorageDevices"
"RegValueNameRedirect"="TCGSecurityActivationDisabled"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EnhancedStorageDevices]
"TCGSecurityActivationDisabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows\EnhancedStorageDevices]
"TCGSecurityActivationDisabled"=dword:00000000

I don't have encryption enabled in my PC. Therefore, value of this reg entry "TCGSecurityActivationDisabled" must be 1. But it is 0 in my Windows 11 installation in strict conflict with Microsoft Article: TCGSecurityActivationDisabled

Does anyone have an explanation about why I have a 0 value for this reg entry ?

Could it be because my PC has been upgraded on and on since 2019 from Windows 10 Pro to Windows 11 Pro ?

its to do with drive encryption.
a value of 1 .. drive does not auto encrypt
a value of 0 .. drive auto encrypts
a value of 0 is the default value

i would leave the registry value at the default setting.
best of luck, Steve ..

I have it set to '1' on Windows Home.
BitLocker was disabled during the Windows installation and no eHDDs either.

Sometimes, enabling secure boot to install Windows 11 has a unexpected consequences- people start seeing that the Bitlocker automatically turns ON and starts encrypting their drive without their permission.

Click to expand...

suatcini54 said:

I don't have encryption enabled in my PC.

Click to expand...

MS enables it automatically lately. I always disable encryption, yet updates enabled it and stole my files.
Note that there is Bitlocker and then there is Device Encryption. You can check it via command as admin:

you can disable bitlocker in the services and then leave the registry as default.
thats they way i have on my system, but i hasten to add i have C:drive encrypted with veracrypt.

best of luck, Steve ..

XxXxX said:

you can disable bitlocker in the services and then leave the registry as default.
thats they way i have on my system, but i hasten to add i have C:drive encrypted with veracrypt.

best of luck, Steve ..

Click to expand...

Thanks.

But sometimes it may be better to avoid encrytion altogether during clean-installation of Windows. Otherwise, one has to decrypt encryption once Windows is installed. Therefore, adding the registry entries into Windows installation disk may prove beneficial for those taking the burden to add reg entries into install.wim file.

suatcini54 said:

Thanks.

But sometimes it may be better to avoid encrytion altogether during clean-installation of Windows. Otherwise, one has to decrypt encryption once Windows is installed. Therefore, adding the registry entries into Windows installation disk may prove beneficial for those taking the burden to add reg entries into install.wim file.

Click to expand...

You can disable automatic device encryption from the unattended file. Rufus does that.

garlin said:

You can disable automatic device encryption from the unattended file. Rufus does that.

Click to expand...

Thanks @garlin

Appreciate the info. I will check it when I actually need to clean-install Windows.