[Tip] Windows 11 Home Edition may also adopt BitLocker full disk encryption with disabling method by default

Since Windows 10, based on security considerations, some device manufacturers have enabled BitLocker full disk encryption on the motherboard by default. Normally, if you log in to the Microsoft account and use BitLocker encryption, the recovery key will be saved in the Microsoft account center, and users can unlock the device through the recovery key when necessary.

The problem is that the reliability of this function is not very high. At least in the past few years, Blue Dot has met many netizens who had to completely reinstall the system because of full encryption, because there is no recovery key in the Microsoft account center.

However, Windows 10/11 installed by users will not use full disk encryption by default, but this situation will change in Windows 11 24H2. It is expected that Windows 11 24H2 Home Edition will also use full disk encryption by default.

Changes from Build 25905:

In July 2023, Microsoft will release Windows 11 Build 25905. In this version, Microsoft has adjusted the prerequisites for enabling device encryption, so that device encryption can be automatically enabled when Windows 11 is newly installed.

Initially, this function was only enabled in Windows 11 Professional Edition. When the official version of Windows 11 24H2 was released in October this year, it is expected that the home version system will also use the device encryption function by default.

Enabling encryption costs performance:

From a security perspective, it is certainly a good practice to enable full disk encryption. However, it is unnecessary for most users to enable full disk encryption, and disk performance will be lost if encryption is enabled.

The default encryption method adopted by Microsoft is BitLocker, which is combined with XTS-AES 128 algorithm, After encryption, even SSDs will suffer obvious performance loss (Because encryption and decryption require a series of calculations).

How to disable the default encryption device when installing Windows 11:

Method 1: On the OOBE interface, press Shift+F10 to open the command prompt, enter regedit to open the registry, and then go to the following path:

 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\BitLocker

Create a new DWORD 32-bit value here and rename it as PreventDeviceEncryption, and then modify the new registry key value from 0 to 1.

Method 2: If you use Rufus to burn USB flash drive When burning, Rufus has an option to disable BitLocker. Just check this option and continue burning. BitLocker will be disabled automatically when the device is installed.

Method 3: For supported devices, if BitLocker encryption has been completed in the installation phase, go to Settings, Security, and Privacy after installation. Here is an option to manage device encryption.