Windows 10: Turned off Device Encryption but bitlocker recovery key still present in the microsoft account

So I turned off the Device encryption Windows 11 home version not pro but bitlocker recovery keys still present in my microsoft account under device section. The account is the one which I have been using as administrator. Three 48 digit keys are there. And each has the option to delete beside it. So can I delete all three of them?And if I plan to again encrypt my device can I again find them on my microsoft account under device section as bitlocker recovery keys?

:)

 

Windows 10 Device Encryption - You need a Microsoft Account to finish encrypting this device

Hi Portofino9,

Thank you for reaching Microsoft Community.

I hope you are doing well.

We really appreciate your time in bringing this concern about BitLocker to our attention.

Here are the answers to your questions:

-Why doesn't Windows provide any serious warnings about the drive being encrypted whether you are using a local account or a Microsoft account?

• Your device is a modern device that meets certain requirements to automatically enable device encryption: In this case your BitLocker recovery key is automatically saved to your Microsoft account before protection is activated.
  
• An owner or administrator of your device activated BitLocker protection (also called device encryption on some devices) through the Settings app or Control Panel: In this case the user activating BitLocker either selected where to save the key or (in the case of device encryption) it was automatically saved to their Microsoft account.
  
• A work or school organization that is managing your device (currently or in the past) activated BitLocker protection on your device: In this case the organization may have your BitLocker recovery key.
  

BitLocker is always activated by or on behalf of a user with full administrative access to your device, whether this is you, another user, or an organization managing your device. The BitLocker setup process requires the creation of a recovery key at the time of activation.

-With Device Encryption in this state 'You need a Microsoft Account to finish encrypting this device', the encryption key is available in the clear, where is the key located on the drive and how can you see it?

• The clear key is stored as raw data on the disk together with the Volume Master Key. Raw data is encrypted with the full volume encryption key, which is then encrypted with the volume master key. The volume master key is in turn encrypted by one of several possible methods depending on your authentication (that is, key protectors or TPM) and recovery scenarios.
  

For an references and overview of BitLocker, see links below:

Finding your BitLocker recovery key in Windows

Clear-BitLockerAutoUnlock

Device encryption in Windows

BitLocker Drive Encryption Overview

BitLocker Key Management FAQ (Windows 10) - Windows security

I hope I was able to help you today.

Thank you for choosing Microsoft. Have a great day and stay safe!

Best regards,



Microsoft Community Advocate

 

Windows 10 Device Encryption - You need a Microsoft Account to finish encrypting this device

'You need a Microsoft Account to finish encrypting this device'

If you never finish off setting a Microsoft Account, the drive is still encrypted without the user knowing. How does one access the encrypted drive then? Or is this data lost forever if the laptop dies if you don't setup a Microsoft Account to finish encrypting the device?

Is the clear key encrypted even when the laptop is in this state ''You need a Microsoft Account to finish encrypting this device'? If not encrypted, how can you see what the recovery key is?

If you don't finish setting up a Microsoft Account, the drive is still partially encrypted without the user knowing. This is very alarming as Windows doesn't provide any alerts that C: drive is encrypted.

 

Bitlocker forced to auto-encrypt on Creators Update?

It's a feature since Windows 8.1. All computers which meet certain hardware specifications (called 'InstantGo' for Windows 8.1, although I think it's less stringent for Windows 10, but it does require non-rotational/ solid state drive for the system drive) will have Device Encryption turned on on the system drive. This is all versions of Windows, even Windows 10 Home which don't have full Bitlocker.

I believe you can turn it off in Settings - on my tablet it's in Settings under System, then About, and Device Encryption is at the bottom. (Although I'm still running an older version of Windows 10 on it - need to free up some disk space before it will upgrade - so the option may have moved.)

Edit: or you could open Settings and type Encryption into the search box, which may find it.

Edit2: from https://docs.microsoft.com/en-us/win...iew-windows-10