Windows 11 encrypted my drive automatically

tonez4466 · Sep 9, 2021

After upgrades no drives are BITlocked on my /SYS win pro - new system totaly, uprgrade then.

lx07 · Sep 9, 2021

NavyLCDR said:
That is a serious issue to me considering how hard it can be to get into an encrypted drive. One example, my daughter's laptop failed to boot after an upgrade to Windows 10. I was able to remove the hard, connect it to my desktop, and use dism to revert pending changes

It really does astonish me the anti encryption sentiment on this forum.

Would you rather anyone can read your daughter's hard drive when she loses her laptop? Or her phone? I would not.

With bitlocker your backups aren't encrypted (unless you chose it) so you are trading minor convenience for complete lack of security.

Encryption should be opt out imo as it is with UAC. Protect people from their hope it doesn't happen to them by default. If they insist on saying "I'm the administrator of my PC, I can do whatever" or "No-one will ever steal my PC" then let'm. They are wrong but it's their choice.

Both iOS and Android have taken this approach for years and so does macOS which since T2 encrypts with a null password even if you turn filevault off.

Should they have mentioned it and given opportunity to backup the key? Sure, of course, it's a error. That's the only issue I can see but for me it's immaterial as all my devices have been encrypted for more than a decade.

TairikuOkami · Sep 9, 2021

I have learnt my lesson about MS, as soon as I install Windows, disabling this junk is part of my routine:

Code:

fsutil behavior set disableencryption 1
cipher /d /s:C:\
reg add "HKLM\Software\Policies\Microsoft\Windows\EnhancedStorageDevices" /v "TCGSecurityActivationDisabled" /t REG_DWORD /d "1" /f
sc config BDESVC start= disabled
sc config "EFS" start= disabled

lx07 said:
It really does astonish me the anti encryption sentiment on this forum.

What is the point of the whole disk encryption? I encrypt important files, more than once actually.

lx07 said:
Should they have mentioned it and given opportunity to backup the key? Sure, of course, it's a error.

LoL, that is like jumping out of a plane and then finding out, that they forgot to give you a parachute.
Encryption is a double edge sword, just like 2FA, once you are locked out, your life can be ruined, literally.
I have seen people loosing jobs, diploma, even family photos, because of those. And there are worse cases.

Superfly · Sep 9, 2021

TairikuOkami said:
I have learnt my lesson about MS, as soon as I install Windows, disabling this junk is part of my routine:

Code:

fsutil behavior set disableencryption 1 cipher /d /s:C:\ reg add "HKLM\Software\Policies\Microsoft\Windows\EnhancedStorageDevices" /v "TCGSecurityActivationDisabled" /t REG_DWORD /d "1" /f sc config BDESVC start= disabled sc config "EFS" start= disabled

What is the point of the whole disk encryption? I encrypt important files, more than once actually.

LoL, that is like jumping out of a plane and then finding out, that they forgot to give you a parachute.
Encryption is a double edge sword, just like 2FA, once you are locked out, your life can be ruined, literally.
I have seen people loosing jobs, diploma, even family photos, because of those. And there are worse cases.

Yep, Bitlocker can be compromised as well - it's not the sure-thing MS thinks it is - there are (I'm sure good reasons) the OEM's did not enforce TPM (as eg.) since whenever MS wanted them to..

This enforced 'security' stuff from MS grates me.

Almighty1 · Sep 9, 2021

In my case, my C drive has that exclamation mark, this is on a Dell XPS 15 9570 notebook which shipped with Windows 10 Home that was upgraded to Windows 11 Home that I posted about in another thread here: In File Explorer, is this icon how your C: drive shows up under This PC?

What was weird was that the bitlocker was paused so I tried to resume it and it kept complaining about TPM needs to be configured correctly and I ran the tpm.msc that said TPM is ready, etc. so the only way to even get bitlocker turned on was first use the bitlocker manager to unencrypt the drive and then encrypt the drive. This was before I upgraded to Pro from Home. I guess after reading this thread, it's safer to turn bitlocker off since my notebook leaves home about once every 4-5 years or longer.

Dru2 · Sep 9, 2021

Ghot said:
But from that article, I wonder IF being tied to a Microsoft account, is what's turning on BitLocker?

Two things...

1) I've been running Windows 10 since pre-release to now with a Microsoft Account and never ever had BitLocker auto turned on.
2) I'm currently running Windows 10 on my Lenovo laptop and BitLocker is off. Currently running Windows 11 build version 22449.1000. This is an insiders install. And yes, being used with a Microsoft Account (the same one used for 10).

Anyway, it's odd that this would happen without any notification as Navy is right that it could causes issues if one doesn't know their drive is now encrypted :eek:

That said, as one who is currently using BitLocker on my main system, I have no issues with it. But I do agree users need to be told if this is indeed happening when or after Windows 11 is installed.

GaryW · Sep 10, 2021

I have 4 W11 VM's, 2 Pros in the beta channel and 1 Pro and 1 Home in the Dev. One was created from scratch and later added to the Insider Program. The other three were all upgraded (?) from W10. None have Bit Locker enabled.

johnlgalt · Sep 11, 2021

FWIW, I've had Windows 10 give me the prompt to save my encryption key every single time I've cleanly installed it for the last couple of years. Even when BitLocker was not turned on. Even when I was only mold machine, Core i7 965 EE BIOS based X58 chipset, no TPM, MBR boot. It also did so on Windows 10 on my new (current) rig the last couple of times. I still have backups of each of the keys that were generated.

Also FWIW, Windows 11 has not prompted me once to do so. I've now cleanly installed it ... 3 times, including yesterday.

All throughout this time period, I've only enabled BitLocker once - on another machine (laptop, also connected to same Microsoft account, but a completely independent machine. So I'm confused why I was being asked to save an encryption key when I was not enabling BitLocker to begin with.

Also, in Win10, it was 3-4 days after install, every single time, when I would get prompted to do so.

Dru2 · Sep 11, 2021

johnlgalt said:
FWIW, I've had Windows 10 give me the prompt to save my encryption key every single time I've cleanly installed it for the last couple of years.

What encryption key are you asked to save?

I run both 64-bit editions of Pro and Education, done many installs, clean or otherwise, use BitLocker from time to time, including now, and I've never ever had Windows 10 out of the blue prompt me to save a BitLocker (or any other drive encryption key) unless I actually decided to use BitLocker. And I've been running Windows 10 since the pre-release days.

Perhaps you mean Device Encryption (usually associated with tablets and laptops)? From Brink's tutorial...

Device encryption is available on supported devices (ex: tablet or 2-in-1 laptop) running any Windows 10 edition. If you want to use standard BitLocker encryption instead, it is only available on supported devices running Windows 10 Pro, Enterprise, or Education. Some devices have both types of encryption. BitLocker is not available on Windows 10 Home edition.

Source: How to Turn On or Off Device Encryption in Windows 10

johnlgalt · Sep 11, 2021

No, this is most definitely NOT a portable device, it was my home built desktop.

I have copies of 5 of them, 4 from this machine, 1 from the previous machine and one from my laptop - all of them are .PFX files, 2566 bytes in length (except the laptop one), and the default name ends up being encryption-key.pfx

I *may* have enabled BitLocker once on the new rig when I built it, but I quickly turned it off for speed. The laptop may have had it one once (that is the other machine I referred to earlier). My old rig I turned it on once as well, but never after that, as it was simply not able to keep up with the speed if enabled. I've never used any other encryption method on my machines, ever, and BitLocker was not enabled when I installed Windows 10 in May, nor has it been enabled in Windows 11, neither during upgrade nor my subsequent upgrades and clean installs.

But every time I cleanly cleanly installed Windows 10, I was given a prompt to save my encryption key, both old rig and current rig. I have all 6 with me.

Dru2 · Sep 12, 2021

johnlgalt said:
But every time I cleanly cleanly installed Windows 10, I was given a prompt to save my encryption key, both old rig and current rig. I have all 6 with me.

Well that's weird as I've never seen that before. And I know I'm not the only one otherwise we'd of seen all sorts of threads on that. That said, I did see a post where someone thought the same but it turned out to be Device Encryption - Bitlocker turned itself on??? Never seen this b4 - Windows 10 Help Forums

lx07 · Sep 12, 2021

johnlgalt said:
I have copies of 5 of them, 4 from this machine, 1 from the previous machine and one from my laptop - all of them are .PFX files, 2566 bytes in length (except the laptop one), and the default name ends up being encryption-key.pfx

Bitlocker keys are .bek files afaik. The .pfx I've never seen but Google says it's a certificate for unlocking network volumes. For example they're discussed here : BitLocker - How to enable Network Unlock (Windows 10) - Microsoft 365 Security

Does that apply to you by any chance?

johnlgalt · Sep 13, 2021

Dru2 said:
Well that's weird as I've never seen that before. And I know I'm not the only one otherwise we'd of seen all sorts of threads on that. That said, I did see a post where someone thought the same but it turned out to be Device Encryption - Bitlocker turned itself on??? Never seen this b4 - Windows 10 Help Forums

Yeah, that's what is odd about it, couldn't really find any sort of information on it - I'm definitely in the minority on this one.

lx07 said:
Bitlocker keys are .bek files afaik. The .pfx I've never seen but Google says it's a certificate for unlocking network volumes. For example they're discussed here : BitLocker - How to enable Network Unlock (Windows 10) - Microsoft 365 Security

Does that apply to you by any chance?

Exactly, which is why I know it was not BitLocker. My machines have never been connected to a domain, and I don't have extended network connections either, other than OneDrive and Google Drive, the latter which is using hte FileSteam app and assigned a drive letter, but that is only a recent change for Google Drive.

dbartenstein · Sep 13, 2021

I just checked and Bitlocker is not turned on for my Win 11 Home installation. I don't even see any settings for it.

johnlgalt · Sep 13, 2021

BitLocker is not available on Home.

dbartenstein · Sep 13, 2021

johnlgalt said:
BitLocker is not available on Home.

Well that was easy! :)

ThrashZone · Sep 17, 2021

TairikuOkami said:
I have learnt my lesson about MS, as soon as I install Windows, disabling this junk is part of my routine:

Code:

fsutil behavior set disableencryption 1 cipher /d /s:C:\ reg add "HKLM\Software\Policies\Microsoft\Windows\EnhancedStorageDevices" /v "TCGSecurityActivationDisabled" /t REG_DWORD /d "1" /f sc config BDESVC start= disabled sc config "EFS" start= disabled

What is the point of the whole disk encryption? I encrypt important files, more than once actually.

LoL, that is like jumping out of a plane and then finding out, that they forgot to give you a parachute.
Encryption is a double edge sword, just like 2FA, once you are locked out, your life can be ruined, literally.
I have seen people loosing jobs, diploma, even family photos, because of those. And there are worse cases.

Hi,
Thank you saved

Pretty much why I've always installed I legacy mode make sure that crapware doesn't work.

ThrashZone · Oct 8, 2021

TairikuOkami said:
I have learnt my lesson about MS, as soon as I install Windows, disabling this junk is part of my routine:

Code:

fsutil behavior set disableencryption 1 cipher /d /s:C:\ reg add "HKLM\Software\Policies\Microsoft\Windows\EnhancedStorageDevices" /v "TCGSecurityActivationDisabled" /t REG_DWORD /d "1" /f sc config BDESVC start= disabled sc config "EFS" start= disabled

What is the point of the whole disk encryption? I encrypt important files, more than once actually.

LoL, that is like jumping out of a plane and then finding out, that they forgot to give you a parachute.
Encryption is a double edge sword, just like 2FA, once you are locked out, your life can be ruined, literally.
I have seen people loosing jobs, diploma, even family photos, because of those. And there are worse cases.

Hi,
That script you posted holy crap cmd showed it was decrypting a bunch of stuff :eek:

Try3 · Oct 9, 2021

Ghot said:
Might want to read this...

Mandatory Microsoft accounts for Windows 11 Home might be a good thing

Ghot said:
But from that article, I wonder IF being tied to a Microsoft account, is what's turning on BitLocker?

Treat anything in that article with suspicion. Its author has been known to publish deliberately-fabricated information.

Best of luck,
Denis

Ghot · Oct 9, 2021

Try3 said:
Treat anything in that article with suspicion. Its author has been known to publish deliberately-fabricated information.

Best of luck,
Denis

I treat everything that's said on the internet... with suspicion.
Just thought it might help with the issue.
That there might be "something" in there, that might put the OP on the right track.

H*ll, I don't even trust Microsoft. :)

Windows 11 encrypted my drive automatically

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Microsoft 365 Basic

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Antidisestablishmentarianist

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Antidisestablishmentarianist

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Antidisestablishmentarianist

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Antidisestablishmentarianist

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Minor Threat

My Computer My Computer

At a glance

Minor Threat

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computers

My Computers

My Computers

My Computers

My Computers

My Computer

My Computers

My Computers

My Computers

My Computers

My Computer

My Computer

My Computer

My Computers