Solved Device Encryption Windows 11 Home 24H2.

Mitch · May 18, 2024

Hello. Would be grateful if Insiders on 24H2 could clarify the position about Bitlocker/Encryption being auto enabled. We have 2 pc's running W11 Home 23h2. Both are setup with a MS Administrator account plus a Local Standard User account which we use. Device encryption is turned off in the MS Admin account and does not show in the Local account. After a clean install, encryption was turned on automatically but I turned it off and a Recovery Key was shown in MS Account. It's reported that in 24H2, Bitlocker (and I assume Device Encryption ) will be activated on a clean install or repair install? Will this apply to W11 Home and if so would it also apply to Local non MS Accounts and where would the Recovery Key be located? Thanks.

Brink · May 18, 2024

Hello Mitch,

Device encryption is available and automatically turned on by default on devices (ex: tablet or 2-in1) that support Modern Standby and running any Windows 11 edition.

If device encryption is turned off, it will no longer automatically enable itself in the future. You must enable it manually (if wanted) in Settings.

Turn On or Off Device Encryption in Windows 11 Tutorial

This tutorial will show you how to turn on or off device encryption on a Windows 11 PC. Device encryption (aka: BitLocker automatic device encryption) helps protect your data on the OS drive, and it's available on a wide range of Windows devices. If you turn on device encryption, the OS drive...

www.elevenforum.com

If Device Encryption is turned on with a local account, you would need to manually back up the BitLocker Recovery Key since it doesn't have a Microsoft account to auto backup to.

Mitch · May 18, 2024

Thanks Shawn. In the Local Accounts on our 2 pc's we are not signed on as Administrators, which is why I assume Device Encryption doesn't show. Device Encryption only shows on the MS Admin accounts and the Recovery Key is backed up to the account. Is it likely in 24H2 that the need to be signed in as administrator for device encryption (which we don't need or want) on Local Accounts would change? Our Local Accounts don't have Admin privileges and we wouldn't change that. If we did, for some reason, decide to turn on encryption for our Local Accounts, where would the key be located if it's not backed up to a MS account? Thanks a lot. Mitch.

Brink · May 18, 2024

Correct. You must be signed into an administrator account (local or Microsoft) to see the Device Encryption setting.

The BitLocker recovery key is not backed up for a local account unless you manually do so and select where.

Backup BitLocker Recovery Key in Windows 11 Tutorial

This tutorial will show you how to back up the BitLocker recovery key for a drive in Windows 10 and Windows 11. BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or...

www.elevenforum.com

Mitch · May 18, 2024

Thanks for clearing that up Shawn.
Mitch.

Brink · May 18, 2024

You're most welcome. :shawn:

garlin · May 18, 2024

Brink said:
If Device Encryption is turned on with a local account, you would need to manually back up the BitLocker Recovery Key since it doesn't have a Microsoft account to auto backup to.

I think this would be 24H2's most egregious flaw (if they don't change it before GA), is there isn't a post-install task prompting non-MSA users to backup the key offline. I get they're trying to market MSA's ability to silently backup recovery keys. but still...

cereberus · May 18, 2024

Brink said:
You're most welcome.

Actually things may be more complicated when 24H2 is released as MS are relaxing need for modern standby to enable device encryption.

I believe this has already rather quietly "slipped" in to Insider versions but I have yet to test it. I would have to disable modern standby on my laptop to test if I can enable device encryption without modern standby (or use another laptop).

Brink · May 18, 2024

cereberus said:
Actually things may be more complicated when 24H2 is released as MS are relaxing need for modern standby to enable device encryption.

I believe this has already rather quietly "slipped" in to Insider versions but I have yet to test it. I would have to disable modern standby on my laptop to test if I can enable device encryption without modern standby (or use another laptop).

Microsoft has indeed.

Starting with Windows 11 build 25905, Microsoft have adjusted the prerequisites (removal of Modern Standby/HSTI validation and untrusted DMA ports check) for enabling device encryption so that it is automatically enabled when doing clean installs of Windows 11.

Mitch · May 19, 2024

Morning. Sorry to raise this one again but just to clarify, does auto-enablement of Bitlocker/Device Encryption for W11 home in 24h2 apply to repair installs, either using MCT/ISO or the Windows Update recovery feature in Settings, as well as clean installs. The point of repair installs is that "your Settings will be preserved" but......This has the potential to cause real problems especially if using a Local Account and no prompt to back the key up. Mitch.

cereberus · May 19, 2024

Mitch said:
Morning. Sorry to raise this one again but just to clarify, does auto-enablement of Bitlocker/Device Encryption for W11 home in 24h2 apply to repair installs, either using MCT/ISO or the Windows Update recovery feature in Settings, as well as clean installs. The point of repair installs is that "your Settings will be preserved" but......This has the potential to cause real problems especially if using a Local Account and no prompt to back the key up. Mitch.

The key is automatically backed up to the TPM I understand.

BruceR · May 20, 2024

Mitch said:
This has the potential to cause real problems especially if using a Local Account and no prompt to back the key up. Mitch.

garlin said:
I think this would be 24H2's most egregious flaw (if they don't change it before GA), is there isn't a post-install task prompting non-MSA users to backup the key offline.

Automatic device encryption is not activated for a local account. The system disk may be encrypted but no key will be required as protection is suspended until an administrator signs in with a Microsoft Account, which then saves the recovery key automatically:

! Note

BitLocker automatic device encryption starts during Out-of-box (OOBE) experience. However, protection is enabled (armed) only after users sign in with a Microsoft Account or an Azure Active Directory account. Until that, protection is suspended and data is not protected. BitLocker automatic device encryption is not enabled with local accounts, in which case BitLocker can be manually enabled using the BitLocker Control Panel.

BitLocker automatic device encryption

If the device isn't Microsoft Entra joined or Active Directory domain joined, a Microsoft account with administrative privileges on the device is required. When the administrator uses a Microsoft account to sign in, the clear key is removed, a recovery key is uploaded to the online Microsoft account, and a TPM protector is created. Should a device require the recovery key, the user is guided to use an alternate device and navigate to a recovery key access URL to retrieve the recovery key by using their Microsoft account credentials

If a device uses only local accounts, then it remains unprotected even though the data is encrypted

Device encryption

Mitch · May 20, 2024

Thanks for the information. We have both an MS and a Local non admin account on our PC. We use the MS account for updates etc and the Local account for everything else. Device Encryption for our 2 W11 Home 23h2 is off in our MS Account and doesn't show in the Local account. The last Recovery Key showing in our MS account was when I did I clean install of W11 in December, Encryption was auto enabled and when installed I turned off Dev Encryption. We have no need to turn on Encryption ourselves and it would only happen in the event of a clean install or if forced on us in 24h2 - not sure if a repair install in 24h2 would turn Encryption on automatically? Hope not. Thanks again.