Windows 10: What happens when BitLocker encryption is turned on without adding/enabling protectors tpm,...

danhar555 · Mar 15, 2021

[COLOR=rgba34, 34, 34, 1]Running the following commands on C: volume which is an internal eMMC drive not HD/SSD if it matters in a laptop running Windows 10 Home:[/COLOR]

[COLOR=rgba34, 34, 34, 1] manage-bde -on c: # encrypt data[/COLOR]
[COLOR=rgba34, 34, 34, 1] manage-bde -status c: # show status after waiting a while for encryption to finish[/COLOR]

[COLOR=rgba34, 34, 34, 1]Output:[/COLOR]

[COLOR=rgba34, 34, 34, 1] Volume C: [BOOTCAMP]
[OS Volume]
Size: 57.71 GB
BitLocker Version: 2.0[/COLOR]
[COLOR=rgba34, 34, 34, 1] [/COLOR][COLOR=rgba34, 34, 34, 1]Conversion Status: Fully Encrypted[/COLOR]
[COLOR=rgba34, 34, 34, 1] [/COLOR][COLOR=rgba34, 34, 34, 1]Percentage Encrypted: 100.0%[/COLOR]
[COLOR=rgba34, 34, 34, 1] [/COLOR][COLOR=rgba34, 34, 34, 1]Encryption Method: XTS-AES 128[/COLOR]
[COLOR=rgba34, 34, 34, 1] [/COLOR][COLOR=rgba34, 34, 34, 1]Protection Status: Protection Off[/COLOR]
[COLOR=rgba34, 34, 34, 1] [/COLOR][COLOR=rgba34, 34, 34, 1]Lock Status: Unlocked[/COLOR]
[COLOR=rgba34, 34, 34, 1] [/COLOR][COLOR=rgba34, 34, 34, 1]Identification Field: Unknown[/COLOR]
[COLOR=rgba34, 34, 34, 1] [/COLOR][COLOR=rgba34, 34, 34, 1]Key Protectors: None Found[/COLOR]

[COLOR=rgba34, 34, 34, 1]It says that the volume is encrypted with no protectors since I haven't added them yet so the question is what's used to derive the encryption keys if no TPM, password etc are added and why is it allowed does it have any specific usage?[/COLOR]

:)

Naveen Murugan · Mar 15, 2021

Bitlocker TPM enabled(Not enabling PIN as a protector) prompts for recovery key during the restart

Starting a Windows 10 with bitlocker TPM enabled(Not enabling PIN as a protector), PC asks for a recovery key during the restart.

Behavior is random, it is not happening in all the restarts, but can say it occurs 1 of 3 restarts.

Models: Lenovo and HP

Is there any logs that can be checked to identify the problem?

Is there any suggetions ?

StephenMc_964 · Mar 15, 2021

Unable to turn bitlocker on - TPM 2.0 is enabled but is not being recognised

Hi,

My Surface Pro 3 recently started asking me to enter BitLocker recovery keys on every start-up (I believe this was because on one occasion I accidentally tried booting the machine with a USB stick connected). To avoid having to enter BitLocker recovery keys
on every startup I turned off encryption.

I would now like to turn the encryption back on, but when I attempt to turn BitLocker back on (via Control Panel -> System and Security -> Bitlocker Drive Encryption) I get an error message that the device cannot use a Trusted Platform Module.

Within Trusted Platform Module (TMP) on Local Computer I get a message saying that Compatible TPM cannot be found.

I have followed various threads in this and other forums in an error to resolve this issue. I have confirmed that Trusted Platform Module 2.0 is enabled (via Device Manager and in BIOS settings). I have tried to initialise the TPM, but there is no initialization
option showing in the 'Trusted Platform Module (TMP) on Local Computer' tool.

Presumably since encryption was previously enabled on this machine the TPM 2.0 must have been recognisable and I have confirmed that there have been no firmware or other updates applied since the encryption was working - so I am now stumped by the fact
that turning encryption off seems to now be preventing me from turning it back on.

Any suggestions would be much appreciated. Thanks.

DavidY · Mar 15, 2021

Bitlocker forced to auto-encrypt on Creators Update?

It's a feature since Windows 8.1. All computers which meet certain hardware specifications (called 'InstantGo' for Windows 8.1, although I think it's less stringent for Windows 10, but it does require non-rotational/ solid state drive for the system drive) will have Device Encryption turned on on the system drive. This is all versions of Windows, even Windows 10 Home which don't have full Bitlocker.

I believe you can turn it off in Settings - on my tablet it's in Settings under System, then About, and Device Encryption is at the bottom. (Although I'm still running an older version of Windows 10 on it - need to free up some disk space before it will upgrade - so the option may have moved.)

Edit: or you could open Settings and type Encryption into the search box, which may find it.

Edit2: from https://docs.microsoft.com/en-us/win...iew-windows-10

Device encryption

Beginning in Windows 8.1, Windows automatically enables BitLocker device encryption on devices that support InstantGo. With Windows 10, Microsoft offers device encryption support on a much broader range of devices, including those that are InstantGo. Microsoft expects that most devices in the future will pass the testing requirements, which makes device encryption pervasive across modern Windows devices. Device encryption further protects the system by transparently implementing device-wide data encryption.

Unlike a standard BitLocker implementation, device encryption is enabled automatically so that the device is always protected. The following list outlines how this happens:

When a clean installation of Windows 10 is completed and the out-of-box experience is finished, the computer is prepared for first use. As part of this preparation, device encryption is initialized on the operating system drive and fixed data drives on the computer with a clear key (this is the equivalent of standard BitLocker suspended state).

If the device is not domain joined, a Microsoft account that has been granted administrative privileges on the device is required. When the administrator uses a Microsoft account to sign in, the clear key is removed, a recovery key is uploaded to the online Microsoft account, and a TPM protector is created. Should a device require the recovery key, the user will be guided to use an alternate device and navigate to a recovery key access URL to retrieve the recovery key by using his or her Microsoft account credentials.

If the user uses a domain account to sign in, the clear key is not removed until the user joins the device to a domain and the recovery key is successfully backed up to Active Directory Domain Services (AD DS). You must enable the Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives Group Policy setting, and select the Do not enable BitLocker until recovery information is stored in AD DS for operating system drives option. With this configuration, the recovery password is created automatically when the computer joins the domain, and then the recovery key is backed up to AD DS, the TPM protector is created, and the clear key is removed.

Similar to signing in with a domain account, the clear key is removed when the user logs on to an Azure AD account on the device. As described in the bullet point above, the recovery password is created automatically when the user authenticates to Azure AD. Then, the recovery key is backed up to Azure AD, the TPM protector is created, and the clear key is removed.

Click to expand...

Windows 10: What happens when BitLocker encryption is turned on without adding/enabling protectors tpm,...

What happens when BitLocker encryption is turned on without adding/enabling protectors tpm,...

What happens when BitLocker encryption is turned on without adding/enabling protectors tpm,...

What happens when BitLocker encryption is turned on without adding/enabling protectors tpm,...

What happens when BitLocker encryption is turned on without adding/enabling protectors tpm,... - Similar Threads - happens BitLocker encryption

Can not enable the Bitlocker Encryption

Can't enable bitlocker encryption.

Using BitLocker without a TPM

Using BitLocker without a TPM

Enable Bitlocker Without TPM

Facing issue when enable bitlocker encryption

Enabling factory-encrypted TPM protector using manage-bde breaks boot until secure boot is...

Bitlocker TPM enabled(Not enabling PIN as a protector) prompts for recovery key during the...

Bitlocker without TPM help