Solved Turn off BitLocker - Does it come back?

No problem and thanks!

cheaterslick said:

And so far, every OEM device I've bought supports BitLocker. It seems to be standard, nowadays.

Click to expand...

For laptops, yes, that is the standard. Prebuilt desktops maybe/probably. For custom builds (me), the end user (builder) decides.

TraderGary said:

I use only laptops and they come with BitLocker active. I prefer it that way in case of loss or theft.

Click to expand...

Same here - on both being active out the box and preferring it that way (for laptops).

TraderGary said:

My BitLocker key is stored in both my TPM 2.0 and in my Microsoft Account. I also keep a copy in my OneDrive Personal Vault. I'm secure.

Click to expand...

For clarity, and to quell thoughts that you can simply extract it from the TPM chip. You can't. That's not how it works, so don't lose your key!!! Been there, done that. But yeah, I keep mine in my Microsoft Account as well as my OneDrive Personal Vault.

I know you know this Gary, just FYI for others

cheaterslick said:

Why not just manually turn off bitlocker and then use a group policy template to prevent automated bitlocker from turning itself on? If such a thing is possible?

Click to expand...

Yes, thats what i have done.

But the question i had was what will happen next time i reinstall the computer, not if BitLocker will re-activate next week on the current install. IOW, what trigger BitLocker to auto-activate, is there something in the BIOS, something in the computer hardware or what? I created install media using Rufus yesterday and noticed that there is an option to prevent BitLocker to auto-encrypt the device.

If the system drive only is encrypted it´s easy and fast to solve, but i added extra storage drives, approx 32 TB. So if all disks are encrypted though i have not asked for it it will take more time.

glasskuter said:

The difference in the 2 explained here Difference between Device Encryption and BitLocker

Click to expand...

Extract from this article: "Your PC needs to meet the below hardware requirements if you want to use Device Encryption on your PC,

• The device contains a TPM (Trusted Platform Module), either TPM 1.2 or TPM 2.0.
• UEFI Secure Boot is enabled.
• Platform Secure Boot is enabled
• Direct memory access (DMA) protection is enabled"

Following @glasskuter instructions in #13: - My HP desktop machine runs Win 11 Pro and when I check I see 'Failed automatic device encryption....' so I assume the drives are not encrypted since I haven't encrypted it manually. I am signed in to MS account. Other than that the device is working fine but should I worry that the machine is not encrypted? It is a static desktop so does not get taken out and about.

I wrote a simple program for myself that scrambles my BitLocker recovery key in a very simple manner. I can easily take that scrambled key and unscramble it by hand without needing access to any computer. This allows me to place the scrambled key in plain site with no fear that it can be compromised. For example, I can put it in a card in my wallet or I can simply put it on a sticker on the underside of my laptop. The program also maintains a list of my keys.

As an example, below is an actual portion of my file showing several scrambled keys. I'm so confident in this that these are my actual real scrambled keys:

---------------------------------------------------------------------------
Key saved on 01-07-2024 at 12:50:25
Comment: ThinkBook
Drive Identifier: A0AB96F6-A00D-47F2-B966-7C425D068A35
Scrambled Key: 776454-432624-252666-424969-214475-144381-530998-100919
---------------------------------------------------------------------------

---------------------------------------------------------------------------
Key saved on 01-08-2024 at 12:16:46
Comment: ASUS Laptop
Drive Identifier: B6176A85-D149-40A7-90B7-E265F0B8D802
Scrambled Key: 508198-553251-220634-369539-312794-635783-706077-686503
---------------------------------------------------------------------------

---------------------------------------------------------------------------
Key saved on 01-14-2024 at 17:59:27
Comment: Silicon Power 4TB SSD
Drive Identifier: 04FEC6E2-8159-4EAC-8147-058BF351C15F
Scrambled Key: 114035-214286-625028-459255-158134-138792-384699-649072
---------------------------------------------------------------------------

Thing is, I use a local account so Bitlocker doesn't automatically turn itself on since I'm not signing into anything. I have no need for Bitlocker but I also don't want it to somehow turn itself on without my permission the next time an update comes.

But I also have a separate work laptop that I travel with where it is turned on and is set to accept a pin number on bootup, and that too also uses a local account. I deliberately turned it on because my job requires me to.

wiganken said:

should I worry that the machine is not encrypted? It is a static desktop so does not get taken out and about.

Click to expand...

To encrypt or not is a personal choice depending on ones' own situation. I use a PC as well. My choice is no encryption.There's not a darn thing on this computer that is of any benefit to anyone but me. No passwords are saved in my browsers (I use a password manager protected by an 18 digit master password) and the few important personal files that have any sensitive information in them are stored in the cloud. (not onedrive different cloud with different account and pw) To my way of thinking, it makes no sense for me to encrypt, plus I'm old school and want to be 100% in control of my drives and data with no interference from the tpm.

As far as "accidental or automatic encryption by some booger in my machine" I do not worry about that either. In the very unlikely chance of it happening, the BL key should be in my MS account. If it wasn't, I could recover within 10 minutes by restoring one of the regular images I make.

I know a lot of folks would disagree with me, but I have never been paranoid about security. I believe in common sense and practicing safe computing habits but I do not take it so far as to worry about it to the point where my computing is no longer enjoyable. If we are concerned by "what ifs" we'll drive ourselves nuts. In the computing world, there are just too many of them.

glasskuter said:

There's not a darn thing on this computer that is of any benefit to anyone but me.

Click to expand...

It's funny how many different ways people use their computers. For me, my entire life is on my computer. I have important documents, my entire software collection with license keys including purchase details, etc.. All my private e-mail is on a local file on my PC, scans of important documents like my passport, etc. are also there. So, for me, it is entirely the opposite. I'm ultra paranoid about security

However, where we operate the same is that we are both good about having backups readily available so if we were to lose anything we could easily recover.

glasskuter said:

To encrypt or not is a personal choice depending on ones' own situation.

Click to expand...

It is not if you buy a prebuilt machine from let´s say HP. All those computers comes with encryption on by default on the system disk without giving the end user any chance to say "no" during install, not even any info that the system drive will be encrypted. In all the info on HP´s site about the HP Workstations Z4 G5 there is no info such as "We have added an extra layer of security with BL because..." and that´s one of the biggest concern IMHO.

I was locked out from my own computer only because i added a new GPU, a PCIe card with M.2 sticks and one SATA SSD. I was forced to type in the recovery key for BitLocker. I did that and all was good, but if i for some reason couldn´t access it i had only one option - reinstall and delete everything on the system drive. At that time i have had the computer for two hours and had not written down the recovery key.

The main issue IMHO is the lack of choises and the lack of information for the end users. Many non-tech end users have one (1) disk and that´s the system disk. Then all it take is that BitLocker require the recovery key one day, the key that the non-tech end user never wrote down and they have forgot their MS account password. *Boom*, the only way out is to wipe the disk and reinstall Windows and all private data is lost. Unless they have a backup very much valuable data will be lost. And we all know that the non-techs don´t have backups.

So it´s not a personal choice. :)

TraderGary said:

My BitLocker key is stored in both my TPM 2.0 and in my Microsoft Account. I also keep a copy in my OneDrive Personal Vault. I'm secure.

Click to expand...

Except from Microsoft of course, even in OneDrive!

Wow lots of posts but as far as I can tell nobody has simply answered your original question.

If you turn off bitlocker, it goes not come back.

Even if it did e.g. on a reinstall, it only takes a minute or so to turn it off again.

2112 said:

The question i have now is, when i do a new fresh install in the future, will the system drive by default be encrypted this time as well?

Click to expand...

To answer my own question:
If i do a clean install using install media downloaded from MS without any modifications, the computer/disk/s did not got encrypted.