Windows 10: Windows 11 After 22H2 Update Forcing BitLocker Encryption on USB Devices Domain-Joined PC

Syed Ashiq1 · May 21, 2025 at 4:32 AM

Hello,I’m encountering an issue on multiple PCs running Windows 11, after updating to version 22H2. Whenever a USB drive is plugged in, the system automatically prompts to enable BitLocker encryption on the drive. However, the USB drive itself does not use any encryption, and the prompt seems to be forced upon us without any clear reason.Windows Version: Windows 11 22H2Domain: The PC is domain-joined via Active Directory.Group Policies: No Group Policies GP have been applied that would mandate BitLocker encryption on removable drives.Encryption: The USB drive is not encrypted, but Window

:)

DavidY · May 21, 2025 at 4:34 AM

Bitlocker forced to auto-encrypt on Creators Update?

It's a feature since Windows 8.1. All computers which meet certain hardware specifications (called 'InstantGo' for Windows 8.1, although I think it's less stringent for Windows 10, but it does require non-rotational/ solid state drive for the system drive) will have Device Encryption turned on on the system drive. This is all versions of Windows, even Windows 10 Home which don't have full Bitlocker.

I believe you can turn it off in Settings - on my tablet it's in Settings under System, then About, and Device Encryption is at the bottom. (Although I'm still running an older version of Windows 10 on it - need to free up some disk space before it will upgrade - so the option may have moved.)

Edit: or you could open Settings and type Encryption into the search box, which may find it.

Edit2: from https://docs.microsoft.com/en-us/win...iew-windows-10

Device encryption

Beginning in Windows 8.1, Windows automatically enables BitLocker device encryption on devices that support InstantGo. With Windows 10, Microsoft offers device encryption support on a much broader range of devices, including those that are InstantGo. Microsoft expects that most devices in the future will pass the testing requirements, which makes device encryption pervasive across modern Windows devices. Device encryption further protects the system by transparently implementing device-wide data encryption.

Unlike a standard BitLocker implementation, device encryption is enabled automatically so that the device is always protected. The following list outlines how this happens:

When a clean installation of Windows 10 is completed and the out-of-box experience is finished, the computer is prepared for first use. As part of this preparation, device encryption is initialized on the operating system drive and fixed data drives on the computer with a clear key (this is the equivalent of standard BitLocker suspended state).

If the device is not domain joined, a Microsoft account that has been granted administrative privileges on the device is required. When the administrator uses a Microsoft account to sign in, the clear key is removed, a recovery key is uploaded to the online Microsoft account, and a TPM protector is created. Should a device require the recovery key, the user will be guided to use an alternate device and navigate to a recovery key access URL to retrieve the recovery key by using his or her Microsoft account credentials.

If the user uses a domain account to sign in, the clear key is not removed until the user joins the device to a domain and the recovery key is successfully backed up to Active Directory Domain Services (AD DS). You must enable the Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives Group Policy setting, and select the Do not enable BitLocker until recovery information is stored in AD DS for operating system drives option. With this configuration, the recovery password is created automatically when the computer joins the domain, and then the recovery key is backed up to AD DS, the TPM protector is created, and the clear key is removed.

Similar to signing in with a domain account, the clear key is removed when the user logs on to an Azure AD account on the device. As described in the bullet point above, the recovery password is created automatically when the user authenticates to Azure AD. Then, the recovery key is backed up to Azure AD, the TPM protector is created, and the clear key is removed.

Click to expand...

Frank Raúl Pérez Pérez · May 21, 2025 at 4:34 AM

Can't join domain after update to 22H2

I've updated to Windows 11 22H2 through clean installation and now I can't join the domain controller.

skok(1) · May 21, 2025 at 4:34 AM

Windows 11 22H2 Domain Joined and the minimum Domain Controllers domain and forest functional level supported by this operating system

Hello MS Community ,

I am writing to seek clarification and guidance regarding the domain joining requirements and the minimum domain controllers domain and forest functional level supported by Windows 11 22H2.
currently we planning an upgrade to Windows 11 22H2 for our client machines.
Windows Server Domain Controllers environment with a domain and forest functional level of Windows Server 2008 is supported for this scenario ? .

To facilitate a smooth transition and avoid any potential compatibility issues, we kindly request your assistance in addressing the following:

What is the minimum domain functional level required for Windows 11 22H2 domain joining?

What is the minimum forest functional level required for Windows 11 22H2 domain joining?

Are there any specific considerations or limitations regarding the forest & domain functional level ?

Windows 10: Windows 11 After 22H2 Update Forcing BitLocker Encryption on USB Devices Domain-Joined PC

Windows 11 After 22H2 Update Forcing BitLocker Encryption on USB Devices Domain-Joined PC

Windows 11 After 22H2 Update Forcing BitLocker Encryption on USB Devices Domain-Joined PC

Windows 11 After 22H2 Update Forcing BitLocker Encryption on USB Devices Domain-Joined PC

Windows 11 After 22H2 Update Forcing BitLocker Encryption on USB Devices Domain-Joined PC - Similar Threads - 22H2 Update Forcing

Windows 11 After 22H2 Update Forcing BitLocker Encryption on USB Devices Domain-Joined PC

How to Prevent Brute Force Attacks on Windows 11 Non-Domain Joined & Azure AD Joined Devices

How to Prevent Brute Force Attacks on Windows 11 Non-Domain Joined & Azure AD Joined Devices

Windows 11 22H2 Domain Joined and the minimum Domain Controllers domain and forest...

Windows 11 22H2 Domain Joined and the minimum Domain Controllers domain and forest...

Can't join domain after update to 22H2

Can't join domain after update to 22H2

Non Domain Joined PC Not Updating

Bitlocker forced to auto-encrypt on Creators Update?