Will disable bitlocker in 23H2 be carried over to 24H2?

neemobeer · Jan 20, 2025

Device encryption is basically Bitlocker but gives you less options. It's only available on Windows 11 home and only if you are using a MS account to sign into your device. This is Microsoft trying to push on using a MS account. You should be able to disable it from an elevated Powershell prompt with

Powershell:

Get-BitlockerVolume | Disable-BitlockerVolume

That will turn it off, decrypt the volume and remove all the protectors

antspants · Jan 20, 2025

Create you install Media using RUFUS. It will allow you turn OFF Bitlocker during install and allow you to create a LOCAL ACCOUNT simply by clicking two checkboxes before the install starts/

I wish you luck.

mck · Jan 20, 2025

neemobeer said:
Device encryption is basically Bitlocker but gives you less options. It's only available on Windows 11 home and only if you are using a MS account to sign into your device. This is Microsoft trying to push on using a MS account. You should be able to disable it from an elevated Powershell prompt with

Powershell:

Get-BitlockerVolume | Disable-BitlockerVolume

That will turn it off, decrypt the volume and remove all the protectors

Thank you

.

mck · Jan 20, 2025

antspants said:
Create you install Media using RUFUS. It will allow you turn OFF Bitlocker during install and allow you to create a LOCAL ACCOUNT simply by clicking two checkboxes before the install starts/

I wish you luck.

Thanks. I have the instructions on how to disable Bitlocker during the Win11 fresh install. I'll use that when I install Win11 Home, when I build my DIY Win11 PC.

My question for this thread was for my existing HP i3 Win11 23H2 PC. Whether disabling Bitlocker via the registry on that PC while 23H2 is active, would carry over when MS updates my copy of Win11 to 24H2. No firm answer on that yet, (except that TairikuOkami had Bitlocker enabled on a subsequent random update), so I'll just go ahead and do the registry disable in 23H2 and hope that it carries over when it's updated to 24H2.

EDIT: I just created the "PreventDeviceEncryption" DWORD in the registry for my HP i3 Win11 Home, 23H2 PC, and set it to "1". I also disabled Bitlocker in "services.msc". Will see if the auto update to 24H2 over rides those changes and forces Bitlocker to enable.

TairikuOkami · Jan 21, 2025

mck said:
How had you disabled Bitlocker?

Code:

reg add "HKLM\System\CurrentControlSet\Control\BitLocker" /v "PreventDeviceEncryption" /t REG_DWORD /d "1" /f
fsutil behavior set disableencryption 1
manage-bde -off C:
manage-bde -off D:
manage-bde -off E:
cipher /d /s:C:\
sc config BDESVC start= disabled
sc config EFS start= disabled

But I have learnt my lesson and every 2 weeks I perform a manual cleanup and I check whether drivers are encrypted.
Last time I did a clean install, I could not understand, why my backups were corrupted, well they were encrypted.

mck · Jan 21, 2025

TairikuOkami said:
Code:

reg add "HKLM\System\CurrentControlSet\Control\BitLocker" /v "PreventDeviceEncryption" /t REG_DWORD /d "1" /f fsutil behavior set disableencryption 1 manage-bde -off C: manage-bde -off D: manage-bde -off E: cipher /d /s:C:\ sc config BDESVC start= disabled sc config EFS start= disabled

But I have learnt my lesson and every 2 weeks I perform a manual cleanup and I check whether drivers are encrypted.
Last time I did a clean install, I could not understand, why my backups were corrupted, well they were encrypted.

Wow, even with all of that, Win11 enabled Bitlocker on your PC via a random update. That is so discouraging! Microsoft needs to stop changing stuff on people's PCs (stuff that the user setup) without the user's permission!!!

OH, BTW, are your running Win11 Home or Pro?

hsehestedt · Jan 21, 2025

TairikuOkami said:
Code:

reg add "HKLM\System\CurrentControlSet\Control\BitLocker" /v "PreventDeviceEncryption" /t REG_DWORD /d "1" /f fsutil behavior set disableencryption 1 manage-bde -off C: manage-bde -off D: manage-bde -off E: cipher /d /s:C:\ sc config BDESVC start= disabled sc config EFS start= disabled

But I have learnt my lesson and every 2 weeks I perform a manual cleanup and I check whether drivers are encrypted.
Last time I did a clean install, I could not understand, why my backups were corrupted, well they were encrypted.

What kind of low grade backup software are you using that it does not decrypt the data before backing it up?

I have only encountered one backup program ever that behaved this way but they remedied that issue about a year ago.

hsehestedt · Jan 21, 2025

A theory here: Since automatic drive encryption requires secure boot to be enabled, why not simply disable secure boot during installation of Windows and then enable it after installation? Or will Windows turn on auto encryption even after Windows is already installed?

cereberus · Jan 21, 2025

mck said:
I don't want Bitlocker encryption to even start, which is the reason I started this thread.

Encryption does not actually start. PC id just put in bitlocker ready status but you still need to activate it.

As I said, run app to turn it of, then move on.

You are overthinking things.

antspants · Jan 21, 2025

Also, I am still not at all convinced your version of Windows (Home) will have to worry about it. If it was a laptop, I’d say maybe if the manufacturer set it up. I agree with Cereberus though, just overthinking it.
You possibly have nothing to worry about. back up your PC and find out.

Please fill out your Specs properly so people can see your version of Windows and your hardware. You’re a VIP, surly you know that this is helpful.

mck · Jan 23, 2025

mck said:
EDIT: I just created the "PreventDeviceEncryption" DWORD in the registry for my HP i3 Win11 Home, 23H2 PC, and set it to "1". I also disabled Bitlocker in "services.msc". Will see if the auto update to 24H2 over rides those changes and forces Bitlocker to enable.

My HP i3, Win11 Home, 23H2 PC was just updated to 24H2 via auto update.
It left the "PreventDeviceEncryption" DWORD in the registry set to "1".
But it changed Bitlocker in services.msc back to "Manual". So I had to change it back to "Disable".
All drives are still decrypted, so that's good so far.

Ghot · Jan 24, 2025

mck said:
My HP i3, Win11 Home, 23H2 PC was just updated to 24H2 via auto update.
It left the "PreventDeviceEncryption" DWORD in the registry set to "1".
But it changed Bitlocker in services.msc back to "Manual". So I had to change it back to "Disable".
All drives are still decrypted, so that's good so far.

Good that you noticed that.
When set to Manual, Windows can turn it on when it deems it's necessary. ^^

hsehestedt · Jan 24, 2025

Ghot said:
When set to Manual, Windows can turn it on when it deems it's necessary.

I'm glad you mentioned that. That was something that I was unaware of, probably because I've never had a machine auto encrypt a drive

Ghot · Jan 24, 2025

hsehestedt said:
I'm glad you mentioned that. That was something that I was unaware of, probably because I've never had a machine auto encrypt a drive

Same.
When he posted about it, I checked.
Registry value was set to "1", but Service was set to manual.

MS trying to sneak in another one. :/

cereberus · Jan 24, 2025

Ghot said:
MS trying to sneak in another one. :/

I rather doubt it. I just think MS are just consistently inconsistent. No surprises there.

aubergine · Jan 24, 2025

XxXxX said:
also i have read that it is only enabled if a MS account is used so bypassing that and using a local account could be a solution.

Clean install: Does not work if Secure Boot is enabled. However, read the quote below.

cereberus said:
Encryption does not actually start. PC id just put in bitlocker ready status but you still need to activate it.

"BitLocker waiting for activation."
"Sign in with your Microsoft account to finish encrypting this device."

Screenshots below: Windows 11 Pro 24H2 - clean install, Secure Boot enabled, local account

Sign in with your Microsoft account to finish encrypting this device.webp

XxXxX · Jan 24, 2025

i use NTLite to admin the ISO that way i can remove BL and disable its service, along with a few other things, before i use Rufus to burn the ISO.
for myself i use VeraCrypt for my encryption.
best of luck, Steve ..

Marie SWE · Jan 24, 2025

XxXxX said:
i use NTLite to admin the ISO that way i can remove BL and disable its service, along with a few other things, before i use Rufus to burn the ISO.
for myself i use VeraCrypt for my encryption.
best of luck, Steve ..

NTlite is a nice tool

just a tip.. have a look at Ventoy and you never have to burn an USB stick again

Ventoy

Ventoy is an open source tool to create bootable USB drive for ISO files. With ventoy, you don't need to format the disk again and again, you just need to copy the iso file to the USB drive and boot it.

www.ventoy.net

I run Ventoy on an external 256GB SSD that became to small for a system drive.... it works with USB sticks too, but they go bad sooner or later.. an SSD can handle more writes then a stick, so i have a truckload of installs and recovery ISO's i can boot from one boot menu.. you just copy paste the new ISO to the drive and you can boot it.. and when you have a newer install ISO you can have them both.
as for Veracrypt..

hsehestedt · Jan 25, 2025

Love BitLocker - I use it on EVERY single machine I own.

I guess that the one thing that I do differently is that I manually specify the 48 digit BitLocker key to a number that I have memorized (a trick I learned recently) so that I can always recover should the need arise without having to go searching anywhere for it.

For me at least, that is a far better solution than allowing Windows to randomly generate a key.

TraderGary · Jan 25, 2025

hsehestedt said:
Love BitLocker - I use it on EVERY single machine I own.

As do I. I'm very mobile and travel with two 4TB Samsung T9 Portable SSD drives that have 7 rotating Macrium Reflect images on each. Each SSD is protected with BitLocker To Go. That combined with 1TB OneDrive is my backup strategy and my data security.

Will disable bitlocker in 23H2 be carried over to 24H2?

Well-known member

My Computer

Like a rolling drone.

My Computers

Member

My Computer

Member

My Computer

Microsoft 365 Basic

My Computer

Member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Like a rolling drone.

My Computers

Member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

I almost never bite.......

My Computers

Well-known member

My Computers

Stock Market Wizard

My Computer

Similar threads