Windows 11 Secure Boot and Bitlocker

ml8585 · Sep 15, 2021

After turning on Secure Boot to install Windows 11 preview I have to enter the Bitlocker key to use the recovery environment tools. I did not do anything to turn Bitlocker on. I can find information that says Bitlocker does NOT require Secure Boot but nothing that specifically answers the question of whether Secure Boot requires Bitlocker.

Where do I find information about the dependencies between Secure Boot, windows 11, and Bitlocker.

FreeBooter · Sep 15, 2021

The Secure Boot does not have any association with Bitlocker when you enable Secure Boot the Bitlocker does not enable you have to enable it yourself.

Winuser · Sep 15, 2021

FreeBooter said:
The Secure Boot does not have any association with Bitlocker when you enable Secure Boot the Bitlocker does not enable you have to enable it yourself.

There are post stating that Bitlocker was turned on automatically.

Windows 11 encrypted my drive automatically

I am troubleshooting a failure to upgrade to 22449.1000 and when I installed MiniTool Partition Wizard Free to adjust partition sizes I found that my C: drive and D: drive were both bitlocker encrypted! I never turned on bitlocker nor encrypted drives before. I know the drives were not...

www.elevenforum.com

FreeBooter · Sep 15, 2021

Enabling Secure Boot cannot enable Bitlocker automatically, they are two different security features.

BunnyJ · Sep 15, 2021

FreeBooter said:
Enabling Secure Boot cannot enable Bitlocker automatically, they are two different security features.

Even in the thread there's no proof of it happening. In fact it proves it doesn't.

johnlgalt · Sep 17, 2021

Speculation on my part:

It could very well be possible that some OEM machines are set to automatically enable BitLocker if Secure Boot is enabled (as the OEM has it disabled by default), though, right? Maybe via a latent PS script, or Group Policy, that waits for SB to be enabled.

This might particularly be true of OEM machines targeting business users / OEM business class machines....

Which the OPs listed machine, a Lenovo Yoga 260, actually is: ThinkPad Yoga 260 | 12.5" 2-in-1 Business Laptop | Lenovo US

I see there are a ton of BL-related GP Settings listed here: BitLocker Group Policy settings (Windows 10) - Microsoft 365 Security and if Lenovo has created one or more GPOs to be enabled if certain conditions are met, this could be the result.

ThrashZone · Sep 17, 2021

Hi,
Yeah this post is a jewel

Windows 11 encrypted my drive automatically

After upgrades no drives are BITlocked on my /SYS win pro - new system totaly, uprgrade then.

www.elevenforum.com

BunnyJ · Sep 17, 2021

ThrashZone said:
Hi,
Yeah this post is a jewel

Windows 11 encrypted my drive automatically

After upgrades no drives are BITlocked on my /SYS win pro - new system totaly, uprgrade then.

www.elevenforum.com

In what way? Most of it is filled with how people didn't get their drives encrypted.

Dru2 · Sep 17, 2021

BunnyJ said:
In what way? Most of it is filled with how people didn't get their drives encrypted.

I "think" you might be missing the sarcasm :)

Getting back to this thread, yes, enabling Secure Boot does NOT auto enable BitLocker. That said, it should be noted I only use Gigabyte boards so... but I am 99.9% sure the same applies to any Intel based board. Also, enabling fTPM does not auto enable BitLocker.

PerpetualCycle · Sep 17, 2021

johnlgalt said:
Speculation on my part:

It could very well be possible that some OEM machines are set to automatically enable BitLocker if Secure Boot is enabled (as the OEM has it disabled by default), though, right? Maybe via a latent PS script, or Group Policy, that waits for SB to be enabled.

This might particularly be true of OEM machines targeting business users / OEM business class machines....

Which the OPs listed machine, a Lenovo Yoga 260, actually is: ThinkPad Yoga 260 | 12.5" 2-in-1 Business Laptop | Lenovo US

I see there are a ton of BL-related GP Settings listed here: BitLocker Group Policy settings (Windows 10) - Microsoft 365 Security and if Lenovo has created one or more GPOs to be enabled if certain conditions are met, this could be the result.

None of which, as far as I can tell enable bitlocker encryption, just modify options if it is enabled.
It could be dome boot script that is configured by a policy.

PerpetualCycle · Sep 17, 2021

To the OP, enabling secure boot affects bitlocker. It performs an attestation to make sure your system has not been tampered with. If it detects that it may have (like a BIOS update), it can lock out (not decrypt) a drive that has been bitlocker encrypted. You need the recovery key to unlock it.

Are you sure your drive wasn't already encrypted when you enabled secure boot? It could have been from the get-go.

Secure Boot and BitLocker on Win10

social.technet.microsoft.com

When you change secure boot settings on an already encrypted system, you will see that bitlocker might switch to recovery mode, requiring you to enter the recovery key before you can continue booting. So as with all bios changes, it is recommended to suspend (not disable) bitlocker before you do it.
As for OS upgrades, BL is suspended automatically in all versions of win8 or win10.
By the way, that latter behavior has caused a major outcry in the security scene as you can see here: http://blog.win-fu.com/2016/11/every-windows-10-in-place-upgrade-is.html

ThrashZone · Sep 17, 2021

BunnyJ said:
In what way? Most of it is filled with how people didn't get their drives encrypted.

Hi,
The code part is the jewel since I didn't know that and now I do

BunnyJ · Sep 17, 2021

Dru2 said:
I "think" you might be missing the sarcasm :)

Getting back to this thread, yes, enabling Secure Boot does NOT auto enable BitLocker. That said, it should be noted I only use Gigabyte boards so... but I am 99.9% sure the same applies to any Intel based board. Also, enabling fTPM does not auto enable BitLocker.

Likely..

johnlgalt · Sep 18, 2021

Uh, no, NOT LIKELY, he's being serious.

ThrashZone did not link to the thread, but to Tairiku's post with code in it that he (Tairiku) employs to disable disk-level encryption immediately after install.

BunnyJ · Sep 18, 2021

johnlgalt said:
Uh, no, NOT LIKELY, he's being serious.

ThrashZone did not link to the thread, but to Tairiku's post with code in it that he (Tairiku) employs to disable disk-level encryption immediately after install.

I was referring to the sarcasm bit.