Solved Turn off BitLocker - Does it come back?

2112 · Jan 17, 2024

I bought a new HP workstation and the system drive with Win 11 is encrypted with BitLocker, as expected. When i had configured the system i swapped GPU and added another PCIe card for M.2 sticks. Next restart the computer promted for the recovery key to BitLocker and i could recover it so all was good. (this time...)

But, i am going to turn off BitLocker since it is too easy to be locked out if one do upgrades. I am the owner of the computer and don´t expect to be locked out cause MS want to push all kinds of security bla-bla on the end users.

The question i have now is, when i do a new fresh install in the future, will the system drive by default be encrypted this time as well?

ThrashZone · Jan 17, 2024

Hi,
Some oem's are making it mandatory to use bitlocker especially on Home versions
There have been some reports on oem pro versions to.

Microsoft re enables bitlocker, locked my computer and deleted the windows hello pin after installing 23H2.

brother bought a new laptop, got his old one and wiped it. fresh W11 Pro installation, manually disabled bitlocker and checked a couple times that it is actually disabled. (wasn't the first time i found it to be enabled again after a couple weeks) yesterday it installed 23H2 and it restarted for...

www.techpowerup.com

Hell latest bios for my asus z490 apex won't let me disable PTT=tpm setting
So I had to switch to bios 2 where I'm on an older bios that I can.

glasskuter · Jan 17, 2024

2112 said:
when i do a new fresh install in the future, will the system drive by default be encrypted this time as well

Most workstations use Pro. I clean installed Windows 11 Pro last night on an Optiplex. No, bitlocker was not turned on by default.

2112 · Jan 18, 2024

glasskuter said:
Most workstations use Pro. I clean installed Windows 11 Pro last night on an Optiplex. No, bitlocker was not turned on by default.

O.k, do you know if OEM´s such as HP/Dell/etc are forced by Microsoft to have all their new computers BitLocker activated.

I want to know where this nonsense to relaese new computers with BitLocker activated without telling the end user that it is activated and that one can be locked out of your own computer actually comes from. Who did advocate for that?

glasskuter · Jan 18, 2024

2112 said:
O.k, do you know if OEM´s such as HP/Dell/etc are forced by Microsoft to have all their new computers BitLocker activated.

I can not say if they're "forced to" but I can say that with devices using modern standby (usually on laptops but being used more and more in desktops these days too) the OEM's do usually turn on device encryption by default. Whereas full Bitlocker encryption is offered in PRO version, Device Encryption is available on both Home and Pro. Device Encryption encrypts all drives whereas with Bitlocker the user can choose which drives to encrypt.
The difference in the 2 explained here Difference between Device Encryption and BitLocker

ThrashZone · Jan 18, 2024

2112 said:
O.k, do you know if OEM´s such as HP/Dell/etc are forced by Microsoft to have all their new computers BitLocker activated.

I want to know where this nonsense to relaese new computers with BitLocker activated without telling the end user that it is activated and that one can be locked out of your own computer actually comes from. Who did advocate for that?

Hi,
Just remembered a user here got hit too

All partitions are Bitlocker on Win 11 Home SL?

Just made a clean install on a M.2 NVMe on a Samsung Book X30 It says that all data partitions are Bitlocker encrypted. - Its a Win 11 Home SL -Never set any Bitlocker encryption. What´s going on?

www.elevenforum.com

cheaterslick · Jan 21, 2024

Why not just manually turn off bitlocker and then use a group policy template to prevent automated bitlocker from turning itself on? If such a thing is possible?

glasskuter · Jan 21, 2024

cheaterslick said:
Why not just manually turn off bitlocker and then use a group policy template to prevent automated bitlocker from turning itself on?

Yes there is a GPO setting for Bitlocker in Pro. But this is not to be confused with device encryption in Home which is different that standard bitlocker. According to Brink, there is no GPO setting for device encryption in PRO nor does Home have group policy to begin with. It is standard for OEMs to have device encryption enabled by default, especially on modern standby devices using Home.
See this

Turn On or Off Device Encryption in Windows 11

This tutorial will show you how to turn on or off device encryption on a Windows 11 PC. Device encryption is a Windows feature that enables BitLocker encryption automatically for the Operating System drive and fixed drives. It’s particularly beneficial for everyday users who want to ensure...

www.elevenforum.com

cheaterslick · Jan 22, 2024

glasskuter said:
According to Brink, there is no GPO setting for device encryption in PRO nor does Home have group policy to begin with. It is standard for OEMs to have device encryption enabled by default, especially on modern standby devices using Home.
See this

Turn On or Off Device Encryption in Windows 11

This tutorial will show you how to turn on or off device encryption on a Windows 11 PC. Device encryption is a Windows feature that enables BitLocker encryption automatically for the Operating System drive and fixed drives. It’s particularly beneficial for everyday users who want to ensure...

www.elevenforum.com

Yeah, I read that tutorial. I don't have Home, I have Pro.

So just to clarify, no group policy template (concerning BitLocker) for Pro exists?

TraderGary · Jan 22, 2024

I use only laptops and they come with BitLocker active. I prefer it that way in case of loss or theft.

My BitLocker key is stored in both my TPM 2.0 and in my Microsoft Account. I also keep a copy in my OneDrive Personal Vault. I'm secure.

cheaterslick · Jan 22, 2024

TraderGary said:
My BitLocker key is stored in both my TPM 2.0

Silly question, but how do you access the key in there?

TraderGary · Jan 22, 2024

cheaterslick said:
Silly question, but how do you access the key in there?

Whenever I log in to my computer, the BitLocker key is accessed in the TPM. That's why BitLocker is transparent to the user.

glasskuter · Jan 22, 2024

cheaterslick said:
So just to clarify, no group policy template (concerning BitLocker) for Pro exists?

Wrong. There are policy settings for Bitlocker in PRO, just not for device encryption (according to Brink's answer to the question posted in the remarks at the end of his tutorial).
Not all devices will have device encryption as an option. You have to understand that Bitlocker and Device Encryption are 2 different options.
Standard bitlocker lets the user choose which drives to encrypt. Device encryption automatically encrypts all fixed drives.
PRO can have either just Bitlocker option or on certain devices PRO can have both Bitlocker and device encryption options.
Here's MS statement.

If your device doesn't support BitLocker, you may be able to use Windows Device Encryption instead.

To see if you can use Windows device encryption

In the search box on the taskbar, type System Information, right-click System Information in the list of results, then select Run as administrator. Or you can select the Start button, and then under Windows Administrative Tools, select System Information.
At the bottom of the System Information window, find Device Encryption Support. If the value says Meets prerequisites, then device encryption is available on your device.

cheaterslick · Jan 22, 2024

glasskuter said:
Wrong. There are policy settings for Bitlocker in PRO, just not for device encryption (according to Brink's answer to the question posted in the remarks at the end of his tutorial).
Not all devices will have device encryption as an option. You have to understand that Bitlocker and Device Encryption are 2 different options.
Standard bitlocker lets the user choose which drives to encrypt. Device encryption automatically encrypts all fixed drives.
PRO can have either just Bitlocker option or on certain devices PRO can have both Bitlocker and device encryption options.
Here's MS statement.

If your device doesn't support BitLocker, you may be able to use Windows Device Encryption instead.

To see if you can use Windows device encryption

In the search box on the taskbar, type System Information, right-click System Information in the list of results, then select Run as administrator. Or you can select the Start button, and then under Windows Administrative Tools, select System Information.

At the bottom of the System Information window, find Device Encryption Support. If the value says Meets prerequisites, then device encryption is available on your device.

Well I was asking a question, not making a statement. And so far, every OEM device I've bought supports BitLocker. It seems to be standard, nowadays.

Sounds like bitlocker has a template you can use but Device Encryption is baked into the OS and can't be modified beyond either turning it on or off. Is that correct?

glasskuter · Jan 22, 2024

cheaterslick said:
Sounds like bitlocker has a template you can use but Device Encryption is baked into the OS and can't be modified beyond either turning it on or off. Is that correct?

For devices that have the device encryption option, that is the way I understand it.

TraderGary · Jan 22, 2024

BitLocker encryption is not baked into the OS. BitLocker uses AES 128-bit encryption.

cheaterslick · Jan 22, 2024

TraderGary said:
BitLocker encryption is not baked into the OS. BitLocker uses AES 128-bit encryption.

No, I was referring to "Device Encryption" up above, not BitLocker.

TraderGary · Jan 22, 2024

The only information I can find is that Windows 11 Home uses BitLocker Light. Whatever that is.

cheaterslick · Jan 22, 2024

I was referring to what @glasskuter said in Post #13

TraderGary · Jan 22, 2024

I was just trying to be helpful by adding to the discussion.

Solved Turn off BitLocker - Does it come back?

Well-known member

My Computer

Minor Threat

My Computer

aka Mama Glass

My Computers

Well-known member

My Computer

aka Mama Glass

My Computers

Minor Threat

My Computer

Well-known member

My Computers

aka Mama Glass

My Computers

Well-known member

My Computers

Stock Market Wizard

My Computers

Well-known member

My Computers

Stock Market Wizard

My Computers

aka Mama Glass

To see if you can use Windows device encryption ​

My Computers

Well-known member

To see if you can use Windows device encryption ​

My Computers

aka Mama Glass

My Computers

Stock Market Wizard

My Computers

Well-known member

My Computers

Stock Market Wizard

My Computers

Well-known member

My Computers

Stock Market Wizard

My Computers

Similar threads

To see if you can use Windows device encryption

To see if you can use Windows device encryption