Windows 10: Microsoft Accounts and Device Encryption

I recently started setting up a new laptop. Because if you connect a Microsoft account during setup the username defaults to the first 5 letters of the account name in my case `smang` I created a local account, then linked it to my Microsoft account afterwards, so I got the username I wanted. Sorted.However, it turns out that Device Encryption will not finish - when going to the Privacy & Security > Device Encryption menu, there is a yellow banner saying "Sign in with your Microsoft account to finish encrypting this device" with a "Sign in" button. When I click on it, it takes me t

:)

 

Windows 10 Device Encryption - You need a Microsoft Account to finish encrypting this device

'You need a Microsoft Account to finish encrypting this device'

If you never finish off setting a Microsoft Account, the drive is still encrypted without the user knowing. How does one access the encrypted drive then? Or is this data lost forever if the laptop dies if you don't setup a Microsoft Account to finish encrypting the device?

Is the clear key encrypted even when the laptop is in this state ''You need a Microsoft Account to finish encrypting this device'? If not encrypted, how can you see what the recovery key is?

If you don't finish setting up a Microsoft Account, the drive is still partially encrypted without the user knowing. This is very alarming as Windows doesn't provide any alerts that C: drive is encrypted.

 

Device Encryption not avaiable

Hello Fraczek,

Thank you for contacting Microsoft Community.

We understand your concern in this regard.

• Are you referring to BitLocker Drive Encryption?
• What preventing you from doing this?
• Did you get any error message or code while doing this?

Before you come up with the above information, suggest you to refer the article

Help protect your files using BitLocker Drive Encryption and see if it help you.

Do refer the article
Windows BitLocker Drive Encryption Step-by-Step Guide and check if it help you with the required information.

Keep us posted if you require further assistance.

 

Windows 10 Device Encryption - You need a Microsoft Account to finish encrypting this device

Hi Portofino9,

Thank you for reaching Microsoft Community.

I hope you are doing well.

We really appreciate your time in bringing this concern about BitLocker to our attention.

Here are the answers to your questions:

-Why doesn't Windows provide any serious warnings about the drive being encrypted whether you are using a local account or a Microsoft account?

• Your device is a modern device that meets certain requirements to automatically enable device encryption: In this case your BitLocker recovery key is automatically saved to your Microsoft account before protection is activated.
  
• An owner or administrator of your device activated BitLocker protection (also called device encryption on some devices) through the Settings app or Control Panel: In this case the user activating BitLocker either selected where to save the key or (in the case of device encryption) it was automatically saved to their Microsoft account.
  
• A work or school organization that is managing your device (currently or in the past) activated BitLocker protection on your device: In this case the organization may have your BitLocker recovery key.
  

BitLocker is always activated by or on behalf of a user with full administrative access to your device, whether this is you, another user, or an organization managing your device. The BitLocker setup process requires the creation of a recovery key at the time of activation.

-With Device Encryption in this state 'You need a Microsoft Account to finish encrypting this device', the encryption key is available in the clear, where is the key located on the drive and how can you see it?

• The clear key is stored as raw data on the disk together with the Volume Master Key. Raw data is encrypted with the full volume encryption key, which is then encrypted with the volume master key. The volume master key is in turn encrypted by one of several possible methods depending on your authentication (that is, key protectors or TPM) and recovery scenarios.
  

For an references and overview of BitLocker, see links below:

Finding your BitLocker recovery key in Windows

Clear-BitLockerAutoUnlock

Device encryption in Windows

BitLocker Drive Encryption Overview

BitLocker Key Management FAQ (Windows 10) - Windows security

I hope I was able to help you today.

Thank you for choosing Microsoft. Have a great day and stay safe!

Best regards,



Microsoft Community Advocate