Solved Turn off BitLocker - Does it come back?

I bought a new HP workstation and the system drive with Win 11 is encrypted with BitLocker, as expected. When i had configured the system i swapped GPU and added another PCIe card for M.2 sticks. Next restart the computer promted for the recovery key to BitLocker and i could recover it so all was good. (this time...)

But, i am going to turn off BitLocker since it is too easy to be locked out if one do upgrades. I am the owner of the computer and don´t expect to be locked out cause MS want to push all kinds of security bla-bla on the end users.

The question i have now is, when i do a new fresh install in the future, will the system drive by default be encrypted this time as well?

Hi,
Some oem's are making it mandatory to use bitlocker especially on Home versions
There have been some reports on oem pro versions to.


Hell latest bios for my asus z490 apex won't let me disable PTT=tpm setting
So I had to switch to bios 2 where I'm on an older bios that I can.

2112 said:

when i do a new fresh install in the future, will the system drive by default be encrypted this time as well

Click to expand...

Most workstations use Pro. I clean installed Windows 11 Pro last night on an Optiplex. No, bitlocker was not turned on by default.

glasskuter said:

Most workstations use Pro. I clean installed Windows 11 Pro last night on an Optiplex. No, bitlocker was not turned on by default.

Click to expand...

O.k, do you know if OEM´s such as HP/Dell/etc are forced by Microsoft to have all their new computers BitLocker activated.

I want to know where this nonsense to relaese new computers with BitLocker activated without telling the end user that it is activated and that one can be locked out of your own computer actually comes from. Who did advocate for that?

2112 said:

O.k, do you know if OEM´s such as HP/Dell/etc are forced by Microsoft to have all their new computers BitLocker activated.

Click to expand...

I can not say if they're "forced to" but I can say that with devices using modern standby (usually on laptops but being used more and more in desktops these days too) the OEM's do usually turn on device encryption by default. Whereas full Bitlocker encryption is offered in PRO version, Device Encryption is available on both Home and Pro. Device Encryption encrypts all drives whereas with Bitlocker the user can choose which drives to encrypt.
The difference in the 2 explained here Difference between Device Encryption and BitLocker

2112 said:

O.k, do you know if OEM´s such as HP/Dell/etc are forced by Microsoft to have all their new computers BitLocker activated.

I want to know where this nonsense to relaese new computers with BitLocker activated without telling the end user that it is activated and that one can be locked out of your own computer actually comes from. Who did advocate for that?

Click to expand...

Hi,
Just remembered a user here got hit too

Why not just manually turn off bitlocker and then use a group policy template to prevent automated bitlocker from turning itself on? If such a thing is possible?

cheaterslick said:

Why not just manually turn off bitlocker and then use a group policy template to prevent automated bitlocker from turning itself on?

Click to expand...

Yes there is a GPO setting for Bitlocker in Pro. But this is not to be confused with device encryption in Home which is different that standard bitlocker. According to Brink, there is no GPO setting for device encryption in PRO nor does Home have group policy to begin with. It is standard for OEMs to have device encryption enabled by default, especially on modern standby devices using Home.
See this

glasskuter said:

According to Brink, there is no GPO setting for device encryption in PRO nor does Home have group policy to begin with. It is standard for OEMs to have device encryption enabled by default, especially on modern standby devices using Home.
See this

Turn On or Off Device Encryption in Windows 11 Tutorial

This tutorial will show you how to turn on or off device encryption on a Windows 11 PC. Device encryption (aka: BitLocker automatic device encryption) helps protect your data on the OS drive, and it's available on a wide range of Windows devices. If you turn on device encryption, the OS drive...

www.elevenforum.com

Click to expand...

Yeah, I read that tutorial. I don't have Home, I have Pro.

So just to clarify, no group policy template (concerning BitLocker) for Pro exists?

I use only laptops and they come with BitLocker active. I prefer it that way in case of loss or theft.

My BitLocker key is stored in both my TPM 2.0 and in my Microsoft Account. I also keep a copy in my OneDrive Personal Vault. I'm secure.

TraderGary said:

My BitLocker key is stored in both my TPM 2.0

Click to expand...

Silly question, but how do you access the key in there?

cheaterslick said:

Silly question, but how do you access the key in there?

Click to expand...

Whenever I log in to my computer, the BitLocker key is accessed in the TPM. That's why BitLocker is transparent to the user.

cheaterslick said:

So just to clarify, no group policy template (concerning BitLocker) for Pro exists?

Click to expand...

Wrong. There are policy settings for Bitlocker in PRO, just not for device encryption (according to Brink's answer to the question posted in the remarks at the end of his tutorial).
Not all devices will have device encryption as an option. You have to understand that Bitlocker and Device Encryption are 2 different options.
Standard bitlocker lets the user choose which drives to encrypt. Device encryption automatically encrypts all fixed drives.
PRO can have either just Bitlocker option or on certain devices PRO can have both Bitlocker and device encryption options.
Here's MS statement.

If your device doesn't support BitLocker, you may be able to use Windows Device Encryption instead.

To see if you can use Windows device encryption ​

1. In the search box on the taskbar, type System Information, right-click System Information in the list of results, then select Run as administrator. Or you can select the Start button, and then under Windows Administrative Tools, select System Information.
2. At the bottom of the System Information window, find Device Encryption Support. If the value says Meets prerequisites, then device encryption is available on your device.

glasskuter said:

Wrong. There are policy settings for Bitlocker in PRO, just not for device encryption (according to Brink's answer to the question posted in the remarks at the end of his tutorial).
Not all devices will have device encryption as an option. You have to understand that Bitlocker and Device Encryption are 2 different options.
Standard bitlocker lets the user choose which drives to encrypt. Device encryption automatically encrypts all fixed drives.
PRO can have either just Bitlocker option or on certain devices PRO can have both Bitlocker and device encryption options.
Here's MS statement.

If your device doesn't support BitLocker, you may be able to use Windows Device Encryption instead.

To see if you can use Windows device encryption ​

1. In the search box on the taskbar, type System Information, right-click System Information in the list of results, then select Run as administrator. Or you can select the Start button, and then under Windows Administrative Tools, select System Information.
2. At the bottom of the System Information window, find Device Encryption Support. If the value says Meets prerequisites, then device encryption is available on your device.

Click to expand...

Well I was asking a question, not making a statement. And so far, every OEM device I've bought supports BitLocker. It seems to be standard, nowadays.

Sounds like bitlocker has a template you can use but Device Encryption is baked into the OS and can't be modified beyond either turning it on or off. Is that correct?

cheaterslick said:

Sounds like bitlocker has a template you can use but Device Encryption is baked into the OS and can't be modified beyond either turning it on or off. Is that correct?

Click to expand...

For devices that have the device encryption option, that is the way I understand it.

BitLocker encryption is not baked into the OS. BitLocker uses AES 128-bit encryption.

TraderGary said:

BitLocker encryption is not baked into the OS. BitLocker uses AES 128-bit encryption.

Click to expand...

No, I was referring to "Device Encryption" up above, not BitLocker.

The only information I can find is that Windows 11 Home uses BitLocker Light. Whatever that is.

I was referring to what @glasskuter said in Post #13

I was just trying to be helpful by adding to the discussion.