Hard Drive Encryption after BIOS update.

JamesSmith · Friday at 5:05 PM

I did a fresh install of Windows 11 Pro and did not setup bitlocker. So my drives had not been encrypted and had no pass key or pin or any of that stuff.
After successfully updating the BIOS on my motherboard both my hard drives were encrypted. I ran the command to decrypt my hard drives which took a really long time. (3 hours)

So now both my hard drives have bitlocker set to off. If i do another BIOS update will the same thing happen? Is there a way to stop Win 11 pro from encrypting my drives? I have read that some people turn on bitlocker and set it to suspended before a BIOS update. But i don't want bitlocker or the encryption.

I am scared to update my BIOS at any point in the future as I have seen people suffer with Bitlocker lock-outs as well as Windows login PIN changes

James.

Ghot · Friday at 5:40 PM

JamesSmith said:
I did a fresh install of Windows 11 Pro

I believe Win 11 Pro automatically enables Bitlocker, these days.
I doubt the BIOS update had anything to do with it. Just coincidence, probably.

Microsoft is enabling BitLocker device encryption by default on Windows 11

You can avoid device encryption by using a local account.

www.theverge.com

BitLocker overview

Learn about BitLocker practical applications and requirements.

learn.microsoft.com

From the Bitlocker Overview article...

Difference between BitLocker and device encryption

Device encryption turns on BitLocker automatically on device encryption-qualifying devices, with the recovery key automatically backed up to Microsoft Entra ID, AD DS, or the user's Microsoft account

Device encryption adds a device encryption setting in the Settings app, which can be used to turn device encryption on or off

The Settings UI doesn't show device encryption enabled until encryption is complete

There's probably an Eleven Forum topic about this, but I couldn't find it.

antspants · Friday at 6:31 PM

Next time you install Windows, use RUFUS to create the install media:

If you use RUFUS to create your install media, you can stipulate a username and local account, disable Bitlocker etc.

Create the install media with RUFUS.
When instigating the creation of the media and clicking “Start”,

The following options will show. Select your choices.

Click OK then the USB install media will be created on the USB

JamesSmith · Saturday at 8:09 PM

Prior to updating the BIOS I had not set up bitlocker and my hard drives weren't encrypted.

After I did that bitlocker was (on or off I don't remember) and my hard drives were encrypted but I did not need to use a key to decrypt them. A slight annoyance but did not lock me out. (just hours of decryption time)

I guess my question is can Windows enable bitlocker encrypt your drives and set a key by itself or does the user have to set that key?

I have a local account only. I find it difficult to believe it would set a key without windows telling me what it is.

Sorry if my questions are hard to answer I have not had to deal with bitlocker in the past.

antspants · Saturday at 8:14 PM

Where did you see that Bitlocker was enabled?
Screenshot please.

antspants · Saturday at 8:19 PM

Here is a list of possible helpful tutorials

JamesSmith · Saturday at 8:32 PM

antspants said:
Here is a list of possible helpful tutorials

Suspend or Resume BitLocker Protection for Drive in Windows 11

Turn On or Off Device Encryption in Windows 11

Turn On BitLocker for Operating System Drive in Windows 11

Turn On BitLocker for Fixed Data Drive in Windows 11

Turn On BitLocker for Removable Data Drive in Windows 11

Turn Off BitLocker for Drive in Windows 11

Check BitLocker Drive Encryption Status of Drive in Windows 11

Add Suspend BitLocker protection to Context Menu in Windows 11

Lock BitLocker Drive in Windows 11

Change BitLocker Password for Drive in Windows 11

I guess my question is hard to answer because I do not remember if bitlocker was on or off. All I remember is that both hard drives were encrypted after I made the BIOS change.

Thanks for the information.

James.

Scannerman · Saturday at 8:57 PM

Good ole Rufus is a friend of mine. Saves me from so much fuss and nonsense.

antspants · Saturday at 9:56 PM

JamesSmith said:
I guess my question is hard to answer because I do not remember if bitlocker was on or off. All I remember is that both hard drives were encrypted after I made the BIOS change.

Thanks for the information.

James.

I would just like to know how you found out encryption was activated and where you seen it?

Scannerman · Saturday at 10:12 PM

When in doubt blame the cat. Trust me when I say they know how to use keyboards.

Berton · Saturday at 10:17 PM

Checking in Disk Management will show if Bitlocker has been activated.

I've set up 3 new Win11 Notebooks this year, all with Win11 Home. They all required a Microsoft Account and accepted only a PIN, used 5 numbers. Bitlocker was automatically active and no key given nor asked for. I found it on the first machine as I tried to access the OS partition on the drive from a Linux Mint LiveUSB for testing.

JamesSmith · Saturday at 1:33 AM

antspants said:
I would just like to know how you found out encryption was activated and where you seen it?

From memory the hard drive had a padlock with a yellow icon

I went into diskmgmgent it said encrypted in there (I cant remember what it said when I went into bitlocker settings)

I ran manage-bde -off C: and then D:

C: was my SSD it took 15 minutes and D was my SATA HDD which took 2 hours.

The whole thing I find strange is there was no key or pin to do any of this and how it was triggered.

Sorry.

antspants · Saturday at 1:40 AM

Right. Really strange that this was triggered by the BIOS update. Unless you reinstalled after that, which could make sense.

There’s a possibility that using this tutorial could of helped so as you knew the key after changing it.

Change BitLocker Password for Drive in Windows 11

This tutorial will show you how to change the password for a fixed or removable data drive encrypted by BitLocker in Windows 10 and Windows 11. BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure...

www.elevenforum.com

It’s always been my understanding that encryption keys were kept on a Microsoft Account, not sure.

Is thereA setting in your BIOS by any chance about encryption?

I’m also surprised that you didn’t notice it being encrypted at the time (unless, again, it was during a reinstallation..

JamesSmith said:
Sorry.

You shouldn’t be, James. Dreadfully inconvenient for you though.

And remember… Rufus is your friend.

XxXxX · Saturday at 2:52 AM

if you open the services settings.
start > windows tools > services

you can stop and then disable the bitlocker service
this way if you wish to update your BIOS again bitlocker wont operate or get in the way.

best of luck, Steve ..

JamesSmith · Saturday at 2:56 AM

I will try to remember to my best ability.

I bought a new PC then did a fresh install of Windows 11 pro. I was running Windows 11 for a few days and because I always use file explorer I can see the hard drive icon and there was never a lock or a yellow icon.

In the few days I was using my computer. I had not set up bitlocker at this point. It wasn't on or off as I hadn't gotten around to looking into that feature. A few days later I updated the BIOS and when I booted into Windows there was a padlock with a yellow icon on my drives.

This is when I went into diskmgmgent and saw my drives were encrypted. I then went into bitlocker and it said waiting for activation BUT if I follow the bitlocker process, you need a password/key to encrypt it. Right?

So my question is still how did I get to that point? How did the drives get encrypted with no password/key or pin. I only have a local account. There was no MS account to upload the key to. Just seems odd. I was easily able to decrypt and turn the feature off without a key/pin. So yeah about 3 hours of inconvenience for me.

I am still perplexed how it was able to do that with no key and what happens next time if a key is generated and I am unaware of it .

I am scared to update my BIOS

I hope this kind of makes sense we are relying on my old brains memory which aint what it used to be.

antspants · Saturday at 3:04 AM

JamesSmith said:
I am still perplexed how it was able to do that with no key and what happens next time if a key is generated and I am unaware of it .

So am I

antspants · Saturday at 3:06 AM

JamesSmith said:
I am scared to update my BIOS

I don’t think you should be worried?

I’m going to make an uneducated guess and say it was a coincidence. I don’t see a correlation between updating a BIOS and drive encryption, unless it’s some new setting that the update added to the BIOS. I’ve certainly neer seen that in a BIOS before. However I’ve never looked for one.

antspants · Saturday at 3:11 AM

Compute Securely with GIGABYTE's TPM 2.0 Solution

Gigabyte B760M H DDR4
Trusted Platform Module (TPM) is a component that significantly increases security. One example is that it allows encryption keys to be created in a secure environment, minimizing the risk of a hacker gaining access.

The TPM securely stores your cryptographic key which can be created with encryption software such as Windows BitLocker. Without this key, the contents of the user's PC will remain encrypted and safe from unauthorized access.

But I still don’t see a correlation and how that would instigate drive encryption.

XxXxX · Saturday at 3:17 AM

if you have Microsoft logon instead of a local account Windows 11 24H2 auto bitlockers your drive.
its one of the new Windows security features.

as antspants has stated if installing Windows by USB use Rufus.
other wise you can decrypt the drives and disable bitlocker in the service menu.
this way bitlocker wont encrypt your drives again when you dont want it to.

best of luck, Steve ..

antspants · Saturday at 3:19 AM

I was doing a search or two. One of my searches produced this, it was a Google AI answer at the top.

A BIOS update for a Gigabyte B760M H DDR4 Micro ATX motherboard might have inadvertently enabled or modified Secure Boot settings, leading to drive encryption or a perceived encryption issue, though this is not a common outcome of BIOS updates.

Here's a breakdown of potential causes and troubleshooting steps:

Understanding Secure Boot and Encryption:

Secure Boot:
This is a security feature in UEFI that verifies the authenticity of the bootloader before the operating system loads, helping prevent malicious software from booting.
Encryption:
While Secure Boot itself doesn't directly encrypt drives, it can interact with encryption features like BitLocker on Windows, potentially making it appear as though the drive is encrypted when Secure Boot is enabled.

Possible Causes of the Issue:

Secure Boot Activation:
The BIOS update might have enabled Secure Boot or changed its settings, which then interacted with your operating system's encryption features.
Incorrect Secure Boot Settings:
If Secure Boot is enabled but not configured correctly (e.g., using the wrong keys), it can cause boot problems or make it appear as though the drive is encrypted.
Interactions with Encryption Software:
If you have encryption software installed, the BIOS update might have introduced a conflict or incompatibility that causes the drive to appear encrypted.

Troubleshooting Steps:

1. Check Secure Boot Settings:
- Boot into the BIOS/UEFI setup (usually by pressing DEL, F2, or F12 during startup).
- Navigate to the "Security" or "Boot" section.
- Verify the status of Secure Boot (enabled/disabled).
- If enabled, check the system mode (User/Deployed) and ensure it's set correctly.
- If you're unsure, temporarily disable Secure Boot and see if the drive access issue is resolved.
- In the BIOS/UEFI setup, look for an option to "Load Optimized Defaults" or "Restore Factory Settings".
- This will reset the BIOS settings to their original values, potentially resolving the issue.

Important Notes:

BIOS Flashing Risks: BIOS updates can be risky if not performed correctly, so proceed with caution.
Backup Data: Before making any changes to BIOS settings, back up your important data.
Consult Documentation: Refer to the Gigabyte B760M H DDR4 motherboard manual for detailed instructions on BIOS updates and Secure Boot settings.

Hard Drive Encryption after BIOS update.

Member

My Computer

Well-known member

Difference between BitLocker and device encryption​

My Computers

Like a rolling drone.

My Computers

Member

My Computer

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers

Member

My Computer

Well-known member

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computer

Ret. ATC

My Computers

Member

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computers

Member

My Computer

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers

Well-known member

My Computers

Like a rolling drone.

My Computers

Similar threads

Difference between BitLocker and device encryption