Windows 11 encrypted my drive automatically

Had the shock of my life on suddenly seeing this bitlocker dialog on rebooting to win11 after some partition changes in linux.
Never knew MS turns ON bitlocker on their own with no real notice to user. Have installed win11 around 7-8 times by now and never saw this.

Luckily, found this topic on searching and was relieved i haven't screwed up everything and need to re-install !
Had just re-installed to win11 22000.282 beta channel from insider 2 days back (to try Android/WSA)

Though the key was there in MS account but it wasn't needed finally. I restored the boot order in UEFI back to win boot mgr from grub2 that i had been using. And it booted back fine. Turned off bitlocker.
It was booting fine to win/lin using grub2 with secure boot, TPM etc on till yesterday (using shim for linux boot).
Maybe I'll turn it on again on Sunday and see why that came up. Quite a few people seem to have it come up randomly and then disappear in next boot or after some time.

Hi,
11 is doing some weird permissions stuff to shared disk for sure.
If it writes anything to a disk it takes ownership of it even a simple folder creation
On another machine running win-11 reflect winpe couldn't write to the folder just a little while ago.

ThrashZone said:

Hi,
11 is doing some weird permissions stuff to shared disk for sure.
If it writes anything to a disk it takes ownership of it even a simple folder creation
On another machine running win-11 reflect winpe couldn't write to the folder just a little while ago.

Click to expand...

Reflect 8 ? That possibly started my Bitlocker saga, so I reinstalled 7.

tonyw said:

Reflect 8 ? That possibly started my Bitlocker saga, so I reinstalled 7.

Click to expand...

Hi,
winpe is from win-10 1909 I believe not sure which version reflect created it since I'm not using reflect only the winpe recovery media when windows is not active.

Same here. Couldn't believe my eyes and thought I was going senile. Yes Windows 11 will without telling or asking Bitlock your %systemdrive% This is a good thing, guess.
For me it did this, I believe as nothing told me, as soon as I connected the laptop to my school account. Fortunately it does store the BitLocker key there as well. In that case.
1) go to Sign in to your account
2) logon with your school account
3) in your profile navigate to your devices and click the view Bitlocker keys (I changed the drive IDs so no risks here)

theking2 said:

Same here. Couldn't believe my eyes and thought I was going senile. Yes Windows 11 will without telling or asking Bitlock your %systemdrive% This is a good thing, guess.
For me it did this, I believe as nothing told me, as soon as I connected the laptop to my school account. Fortunately it does store the BitLocker key there as well. In that case.
1) go to Sign in to your account
2) logon with your school account
3) in your profile navigate to your devices and click the view Bitlocker keys (I changed the drive IDs so no risks here)

View attachment 17438

Click to expand...

I just did a clean install of Windows 11 last week and my machine was never BitLockered. I did a clean install when Windows 11 was released on Oct 5, and during that install Windows 11 never BitLockered the drive then. Here you can see some old keys from old builds. Dru2 is the PC in question here, and as you see by the dates Windows 11 never used BitLocker on this or my other machines...



I don't know.

Perhaps because my machines are custom built desktops. Though I have to say my laptop (Yoga) also didn't get auto BitLocker.

I think this is going back to having Modern Standby being available amongst other settings. I don't have Modern Standby and this is what shows on my account.

Fabler2 said:

I think this is going back to having Modern Standby being available amongst other settings. I don't have Modern Standby and this is what shows on my account.

Click to expand...

If the machine supports it (and a Modern Standby one will) then a clean install of W10 Pro or W11 Pro encrypts the drive(s) by default, without telling you or providing a Bitlocker key.

Bree said:

I have recently seen three clean installs of Pro. One an OEM pre-installed Windows 10 Pro, as supplied by Dell from the factory. The second a clean install of Windows 11 Pro on the same machine. The third a factory reset on a different Dell using its Dell-supplied Windows 10 Pro recovery DVD. In each case the install only had a local account, so there was no Microsoft account involved at all.

In each case manage-bde -status showed 'Conversion status: used space only encrypted', 'Percentage encrypted: 100%' and 'Lock status: Unlocked'. So, my question is ... Where is my key? And why at no point in the clean install was I asked to save it, of even informed that Bitlocker was being used by default?

Click to expand...

Best business desktop? - post #145

I don't know... my machines are custom build machine by me. And none support Modern Standby (I "think" that's geared more towards laptops). In this none of my Windows 11 machines (or Windows 10) PC's have ever been auto BitLocker. That's both Windows 10 and 11. And my 2017 Windows 10 Lenovo laptop, upgraded to Windows 11. That's me.

Anyway, the keys shown in my Microsoft account, are only there because that's where I told the BitLocker app to store them; Otherwise, mine would be blank as well

To clarify, perhaps it depends on the system and whether it's an end user custom build or store-bought system or laptop vs. desktop.

I just know none of my custom-built system were never auto BitLocker. And they'll all modern machines using UEFI with Secure Boot and FTPM enabled. My main rig (system one) is 100 percent qualified for Windows 11 as well.

Because I have had some trouble in the past with BL, I haven't been using it. I eventually found BL in "this pc" by right clicking on C drive. There was an invitation to turn BL back on.

Bree said:

Imagine my surprise and concern then. My clean install of 11 Pro that had bitlocker encrypted my drives without asking was done with a local account only. With no MS account and no record anywhere of the key I could really have been sitting on an accident waiting to happen.

Click to expand...

Excuse me, does this really happened?

xiaomantou said:

Excuse me, does this really happened?

Click to expand...

Yes, it's known as Device Encryption. See more here.....

Device encryption is available on all Windows versions, and it requires a device to meet either Modern Standby or HSTI security requirements.....

...When a clean installation of Windows is completed and the out-of-box experience is finished, the device is prepared for first use. As part of this preparation, device encryption is initialized on the OS drive and fixed data drives on the computer with a clear key that is the equivalent of standard BitLocker suspended state. In this state, the drive is shown with a warning icon in Windows Explorer. The yellow warning icon is removed after the TPM protector is created and the recovery key is backed up.

Click to expand...

Bree said:

See more here.....

BitLocker overview - Windows Security

Learn about BitLocker practical applications and requirements.

learn.microsoft.com

Click to expand...

It said, "In this state, the drive is shown with a warning icon in Windows Explorer. The yellow warning icon is removed after the TPM protector is created and the recovery key is backed up." So I think you should be able to get the key before something happened.