Windows 10: Encrypted drive alterative to TPM.

Could I install Bitlocker to encrypt my drive to install windows 11 on a PC that is not fitted with a TPM?

:)

 

Need help on whether to clear TPM on not

Sounds like it was using the tpm to encrypt the main drive. Certainly not the norm. Also, the fact that you could not log in suggests the computer may be illegally repackaged or stolen.

Where did you buy this?

 

Secure Boot and TPM (what does it do to the system drive)

BitLocker encryption

Once the user enables BitLocker on a disk volume, Windows generates a random volume master key (VMK) as well as a recovery key. The master key is then stored in the TPM module; it is also encrypted with the recovery key. The encrypted VMK is then saved in the disk header. Once the computer is rebooted, the following happens:

1. All PCR registers are zeroed out.
2. The system follows steps 1 through 4 described earlier.
3. The OS kernel attempts unlocking the encrypted volume and requests the VMK from the TPM module. The TPM module in turn analyzes the chain of trust by checking PCR registers. If the chain of trust is corrupted, the VMK is not released; the OS kernel than displays a message requesting the user to unlock the volume with a Recovery Key.

As you can see, if the computer is powered off, the only way to obtain the VMK is by launching the original OS in its original configuration. Altering a single component will trigger the prompt for Recovery Key.

Understanding BitLocker TPM Protection | ElcomSoft blog

 

Windows 10: How to hardware encrypt using bit locker without TPM.

Unfortunately I did not set a restore point as my plan was to set a restore point and do a complete backup once I had installed all the drivers, and the basic programs.

I have now created a restore point.

In the GPedit.msc all setting are " not configured" EXCEPT:--

• Fixed data drives>configure use of hardware based encryption for fixed data drives. =enabled -- all check boxes cleared.
• Operating system drives>require additional authentication at startup = Enabled--
  
  • "Allow BitLocker without a compatible TPM..." checked.
  • Configure TPM startup= do not allow TPM (My system does not have a TPM)
• Operating system drives> configure use of hardware based encryption for operating system drives= enabled. All boxes cleared. this is probably the reason that bitlocker gives an error message instead of doing software encryption. But I DO
  NOT WANT software encryption.
• remaining entries are "not configured" as I mentioned earlier.

I am not comfortable with command line tools, though I can copy a given command.