Windows 10: Windows RE cannot be enabled on a volume with BitLocker Drive Encryption Enabled

​

Windows Recovery Environment allows users to repair their computers when they cannot boot into Windows. It is stored on a separate partition hidden by default and has no drive letter. You can enable or disable it as per your requirements. However, enabling the Windows Recovery Environment on a BitLocker-encrypted drive shows the “Windows RE cannot […]

This article Windows RE cannot be enabled on a volume with BitLocker Drive Encryption Enabled first appeared on TheWindowsClub.com.

read more...

 

Windows 10 BitLocker Drive Encryption AND Device Encryption enabled?

Recently I looked into enabling "BitLocker Drive Encryption" on Windows 10 Pro. After enabling it, I discovered that "Device Encryption" under Settings -> Update and Security -> Device Encryption was already enabled. This is a new Lenovo laptop from 12/2020,
bought from Lenovo with Windows 10 installed. I never enabled Device Encryption, so I'm guessing it was enabled by default. Does it matter if both "Device Encryption" AND "BitLocker Drive Protection" are BOTH enabled? Should I disable one of them?

 

Not Able to Enable Hardware Based Bitlocker Encryption On Surface Pro 4 (Windows 10 Pro)

Ok, I have a feeling that this is a larger Windows 10 issue, but I am experiencing this with the Surface Pro 4, the ideal test hardware for anything Microsoft, right?

Here is what we are trying to accomplish:

Encrypt our Surface Pro 4's (win 10 Pro) using Hardware-Based Encryption

Why?

A) Because it is faster for the SSD to perform the encryption rather than the process, since the SSD is already encrypted

B) Better battery life (because the processor is not encrypting the volume)

C) Performing software encryption on an already encrypted volume defeats many of the internal optimizations that SSDs have built in (leading to slower performance)

How?

We have taken stock Surface Pro 4s, straight from the box. No applications or updates have been installed, we have not added to a domain. The only modification we have made is to the Local Group Policy:

Computer Configuration/Administrative Templates/Windows Components/Bitlocker Drive Encryption/Operating System Drives

*Require additional authentication at startup (Enabled, default options)

*Enable use of BitLocker Aauthentication requireing preboot keyboard input on slates (Enabled, default options)

*Configure use of hardware-based encryption for operating system drives (Enabled, default options)

What's Wrong:

When I go to enable Bitlocker, I am being provided the prompt to encrypt Used Only, or Whole Drive. From all of the literature I have read, this prompt indicates Software Encryption. When I select Full Drive, it takes a while (over 10 minutes) to encrypt.
Again, from my reading, Hardware

Encryption should be immediate (as everything is already encrypted).

Question:

What am I missing? Is there an issue with Hardware Encryption that I have not been able to identify on the Surface Pro 4? Is this an OS issue? Are there any other troubleshooting steps that I can take a look at? Again, these are stock units, fresh out of
the box from Microsoft.

Sources (these are just some, all have been verified using additional sources that repeat the information):

Slower Performance- Hardware Accelerated BitLocker Encryption: Microsoft Windows 8 eDrive Investigated with Crucial M500

AnandTech Forums: Technology, Hardware, Software, and Deals

Steps to enable encryption- How to Enable BitLocker Hardware Encryption with SSDs

How to Enable BitLocker Hardware Encryption with SSDs

Technet on Why to Hardware Encrypt - Encrypted Hard Drive

Encrypted Hard Drive

GP Settings to Enable Hardware Encryption - Enabling Hardware Acceleration of BitLocker

http://blog.jflamb.com/enabling-hardware-acceleration-of-bitlocker/

Tags Bitlocker, Encryption, Windows 10 Pro, Hardware Encryption, 1511

 

What is the proper "Microsoft Procedure" to enable hardware encrypted Bitlocker?

Hello jshoemaker21，



Thank you for posting in Microsoft Community forum.



To enable hardware-encrypted BitLocker in Windows, you'll need to ensure your system meets certain requirements and follow the correct steps. Here is a general guide:



Requirements:

1. TPM (Trusted Platform Module): Your device must have a TPM version 1.2 or higher.

2. BIOS/UEFI Settings: TPM must be enabled in the BIOS/UEFI settings.

3. Drive Support: The drive must support hardware encryption (SED - Self-Encrypting Drive).

4. Windows Edition: You need Windows Pro, Enterprise, or Education editions.



Procedure:



1. Check TPM and Drive Compatibility:

- Open Device Manager and check the status of your TPM under "Security devices."

- Verify your drive supports hardware encryption (either check the manufacturer's documentation or use utilities like `manage-bde -status`).



2. Configure Group Policy:

- Press `Windows + R`, type `gpedit.msc`, and press Enter to open the Group Policy Editor.

- Navigate to `Computer Configuration` > `Administrative Templates` > `Windows Components` > `BitLocker Drive Encryption`.

- Under "Operating System Drives" or "Fixed Data Drives":

- Locate and enable the policy: `Configure use of hardware-based encryption for operating system drives` (or "fixed data drives" as applicable).

- Set it to "Enabled."



3. Enable BitLocker:

- Open the Control Panel and go to `System and Security > BitLocker Drive Encryption`.

- Select the drive you want to encrypt and turn on BitLocker.

- Follow the wizard, selecting the desired encryption options and saving your recovery key.



4. Verify Encryption Type:

- Once BitLocker is enabled, you can verify it is using hardware encryption:

- Open Command Prompt as an administrator.

- Type `manage-bde -status` and press Enter.

- Check the "Encryption Method" field to ensure it says "Hardware Encryption" for your drive.



Important Notes:

- If your drive or system does not support hardware encryption, BitLocker will fall back to software encryption.

- Keep your recovery key in a safe place; losing it means you won't be able to access your data if you encounter issues.



By following these steps, you should be able to enable hardware-based BitLocker encryption on your machine.



I hope the information above is helpful.



If you have any question or concern, please feel free to let us know.



Best Regards,