Windows 10: Windows 11 Device encryption with local account

My questions revolves around what happens with Device Encryption on a Windows 11 Home PC with a local user account no Microsoft account. This article https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/ states that "If a device uses only local accounts, then it remains unprotected even though the data is encrypted." So,What do they mean by it remains unprotected? That statement is very nebulous.I have personally worked on PCs with a local user account and Windows 11 does indeed encrypt the drive. What is the best way to turn off this D

:)

 

Local and MS Account users with Device Encryption in Windows Home 11

I'm setting up a new laptop and am looking for some advice on configuration.



Specifics

Windows 11 Home

I have a M365 Subscription which is linked to a Microsoft Account for normal use

I would also like to setup a separate admin account for the device



Objective

I'd prefer to setup a local account for the administrator user rather than set up another Microsoft Account.



Approach

The approach I've taken is to setup the device with the Microsoft Account first. I've then added another user as a local account with administrator permissions and have changed the original (Microsoft Account) to standard (non-administrator) user.



Question

This all seems to work but I've seen comment that in order to have device encryption in Windows 11 Home you must have a Microsoft Account as administrator. When I set the machine up the administrator account was a Microsoft Account, device encryption was enabled, and I can see the recovery key associated with this account. What I wanted to check was:

1. Would removing administrator rights for the Microsoft Account and assigning to the new local user have any impact in the device encryption - immediate or longer term?
   
2. Any other observations of this setup. There is a lot of contradictory information about the use of administrator vs standard user accounts, and local vs Microsoft Accounts but (assuming the device encryption will continue to work ok) this approach seemed like a solid compromise...?
   

thanks

 

Windows 10 Device Encryption - You need a Microsoft Account to finish encrypting this device

'You need a Microsoft Account to finish encrypting this device'

If you never finish off setting a Microsoft Account, the drive is still encrypted without the user knowing. How does one access the encrypted drive then? Or is this data lost forever if the laptop dies if you don't setup a Microsoft Account to finish encrypting the device?

Is the clear key encrypted even when the laptop is in this state ''You need a Microsoft Account to finish encrypting this device'? If not encrypted, how can you see what the recovery key is?

If you don't finish setting up a Microsoft Account, the drive is still partially encrypted without the user knowing. This is very alarming as Windows doesn't provide any alerts that C: drive is encrypted.

 

Local account installation question

I'm fairly certain that Skip this step was available in 10.0.130 - the workaround in Step 20 (back button) is no longer required.

The currently known, as of 10.0.130, ways to create a Local account sign-in are

• Skip this step at the MS account creation phase
• No Internet connection during the install
• static IP (post# 2 by Fragment) - New (to me anyway)