|
There are isolated problems with current patches, but they are well-known and documented on this site. |
Bit-locker isn’t activated on my Win 11 machine, but after an update this week it is asking for the key and wont let me past it. Then today I get a call from someone else who had the same issue. One is a Dell desktop and one a Lenovo laptop. Something isn’t right here. I have never seen this and to have it twice in one week? I called Dell and they said just to wipe clean and start over. This needs to be investigated.
Brad
BL is active, just not yet secure.
If you boot from a USB recovery you should be able to see the partition (C drive) is not formatted / unknown format, which indicates it is encrypted.
If you can see the partition and files then you can backup prior to reinstalling.
cheers, Paul
New machines that meet the Bitlocker requirements automatically have BL turned on and the disk encrypted, but the key is stored locally until you log into an MS account. It is then transferred to the account – from where it can be recovered.
If something triggers a change to BL (Windows patches can do this) the machine will prompt for the BL recovery key.
If the machine been used with an MS account you should be able to login to the account via a browser and retrieve the key.
cheers, Paul
It is not with a MS Account. I never do that. And my 3 Dell’s I just purchased have BL but it is not activated. 2 different machines in just a few days. Microsoft updates are broken.
Brad
If you have a Local ID (have not logged in with a MS ID so that the key is stored on MS Servers), the key is stored in plain text on the computer. If you boot the computer from a rescue disk you can access it.
Hi BradH:
According to the process.st article How To Get BitLocker Recovery Key Without Microsoft Account you can run a manage-bde command in an elevated command prompt with Administrator rights to view your BitLocker recovery key. The MS Learn article manage-bde protectors confirms the correct syntax is manage-bde -protectors -get <drivelettter> (where <driveletter> is normally C: if that is your encrypted drive). Unfortunately, I don’t think you will be able start your computer in Safe Mode with Command Prompt (according to the MS support article Start Your PC in Safe Mode in Windows “If you’ve encrypted your device, you’ll need your BitLocker key to start in safe mode“) but if you can manage boot your computer from a rescue disk as PKCano suggested in post # 2607398 you might be able to open an elevated command prompt and run this manage-bde command.
You might also find some helpful information in my 13-Sep-2023 post # 2587029 in Wheeler’s BitLocker Recovery Key which includes a links to the Microsoft support article Finding Your BitLocker Recovery Key in Windows (which Susan mentioned in post # 2587060) and Dell support article Automatic Windows Device Encryption or BitLocker on Dell Computers. In that particular case Wheeler’s daughter had a new Dell computer that began prompting them to enter their BitLocker recovery key at boot-up, and they eventually found the recovery key after she logged in to the Azure AD (active directory) account at https://aka.ms/aadrecoverykey that she created when she first signed in to her school email account.
I know of several users who purchased a new Dell computer who had no idea that BitLocker drive encryption was automatically enabled on their machine at Control Panel | System and Security | BitLocker Drive Encryption and had never printed out their BitLocker recovery key or backed it up to a safe location like a removable USB stick. For example, see K_User’s thread BitLocker: Need a Key But I Never Installed It in the Dell forum about a problem many users encountered back in August 2022 when installation of KB5012170 (Security Update for Secure Boot DBX) triggered a prompt asking users to enter their 48-digit BitLocker recovery key at boot-up. Users who could not retrieve their BitLocker recovery key from a Microsoft Account eventually discovered that re-starting their system 3 or 4 times in succession cleared this prompt.
————
Dell Inspiron 5584 * 64-bit Win 10 Pro v22H2 build 19045.3693 * Firefox v120.0.1 * Microsoft Defender v4.18.23100.2009-1.1.23100.2009 * Malwarebytes Premium v4.6.6.294-1.0.2201 * Macrium Reflect Free v8.0.7690
This works for me, in Admin PowerShell, with a correct “Fully Encrypted” result.
But I think, for the purposes of detecting initialized but suspended automatic device encryption, it needs to be combined with ProtectionStatus:
Get BitLocker Status using PowerShell
Agreed. It’s quite obvious at This PC in File Explorer:
FIX: Yellow Triangle Warning on Drive C: in Windows
(But I’d say turn it on, not off! 
)
Have you had an instance where a machine that you know never had bitlocker enabled, yet you were faced with entering a recovery key where you had no such thing?
I’ve had several Surface devices where the key WAS backed up that has popped a recovery key after various updates.
I’ve had my Dad’s computer where bitlocker is enabled pop a request for the recovery key (I know where it is).
I’ve had (several years back) a Server where the data drives had a bitlocker key enabled but I never enabled bitlocker on the C drive itself. Couldn’t log in one weekend and found that the server had rebooted after patches and was asking for a recovery key. I tried the ones for the data drives and that did nothing. I ended up having to reinstall the C drive on that server, which fortunately did not touch the data drive, reenabling HyperV, getting the server back functional again. I didn’t find guidance at the time to see if I could find a ‘suspended’ backup key somewhere, I had to reinstall.
I can personally attest that someone can get into a situation where they know for a fact that bitlocker was not enabled, yet a recovery key is being asked for.
Susan Bradley Patch Lady/Prudent patcher
Hey Y’all,
Here’s a second iteration of the program obtaining data by a different method.
Clear-Host
# Initialize an empty array to hold the table
$DrvEncInfo = New-Object System.Collections.ArrayList
$Encrypt = manage-bde.exe -status
$LineCnt = 0
Do {
$LNParts = $Encrypt[$($LineCnt)].Split(" ")
If ($LNParts[0] -eq "Volume") {
[Void]$DrvEncInfo.Add([PSCustomObject]@{
DriveLtr = $LNParts[1]
VolumeName = $Encrypt[$(($LineCnt+=1))]
Size = (($Encrypt[$(($LineCnt+=2))].Split(":")
)[1].Trim()).Split(" ")[0]
ConvStatus =
($Encrypt[$(($LineCnt+=2))].Split(":"))[1].Trim()
Percent =
($Encrypt[$(($LineCnt+=1))].Split(":"))[1].Trim()
ProtStatus =
($Encrypt[$(($LineCnt+=2))].Split(":"))[1].Trim()
})
$LineCnt += 4
} #End If
Else { $LineCnt += 1 }
} While ($LineCnt -lt ($Encrypt.Count))
$fmtEncrypt =
@{Expression={$_.DriveLtr};
Label="Drv`nLtr"; Width=3; Align="Center"},
@{Expression={$_.VolumeName};
Label="Volume`nName";Width=13; ALign="Left"},
@{Expression={$_.Size};
Label="Sizen\GB"; Width=10; Align="Right"},
@{Expression={$_.ConvStatus};
Label="`nConversion Status"; Width=20; Align='Left'},
@{Expression={$_.Percent};
Label="PercentnEncrypted"; Width=9; Align="Right"},
@{Expression={$_.ProtStatus};
Label="`nProtection Status"; Width=20; Align='Left'}
$DrvEncInfo | ft $fmtEncrypt
Results:
This seems like it provides a more detailed look at the status.
“Get-BitLockerVolume” seems to get similar results, but with additional info.
And get the key: (Get-BitLockerVolume -MountPoint C).KeyProtector
cheers, Paul
Paul,
Same Information…much simpler code!
Clear-Host
$DrvEncInfo = Get-BitLockerVolume
$fmtEncrypt =
@{Expression={$_.MountPoint};
Label="Drv`nLtr"; Width=3;
Align="Center"},
@{Expression={$_.VolumeType};
Label="Volume`nName";Width=18;
ALign="Left"},
@{Expression={
([Math]::Round(($_.CapacityGB),2))};
Label="Size`n\GB"; Width=10;
Align="Right"},
@{Expression={$_.VolumeStatus};
Label="`nConversion Status";
Width=20; Align='Left'},
@{Expression={$_.EncryptionPercentage};
Label="Percent`nEncrypted"; Width=9;
Align="Right"},
@{Expression={$_.ProtectionStatus};
Label="Protection`nStatus"; Width=20;
Align='Center'}
$DrvEncInfo | ft $fmtEncrypt
So Microsoft has now provided us with three different ways to get at this information!
Just had someone call me with another Windows 11 computer asking for BitLocker key. Something is really wrong with Windows 11. Seen this 4 times in a week.
Brad
Please don’t throw out multiple people’s experience by asking for “one more proof.”
I have a new windows 11 we got for the office, local account. One that has no data on it, we just use it for meetings, etc. Let me grab it this week (but not tonight) and see if it has the staged bitlocker. It is one of the newish ARM based machines so in case that adds a wrinkle. Let me get the patching analysis behind me and I can look at it.
Susan Bradley Patch Lady/Prudent patcher
I have pro not home (rats) bit it CLEARLY has DEVICE ENCRYPTION pending but not Bitlocker.
Susan Bradley Patch Lady/Prudent patcher
Very interesting thread on the drive encryption and a Macrium image (without enabling bitlocker support when created). Worth the read.
https://www.elevenforum.com/t/all-partitions-are-bitlocker-on-win-11-home-sl.20324/
Hoping someone can help me here.
I recently set up a Windows 11 Home laptop for my mother. (Lenovo, if it matters). I set it up with a local account, as in, I connected to the internet, input a bogus Microsoft Account address, “flubbed” the password, and got redirected to local account creation. So no microsoft account ever touched this laptop. There is a local account with administrator privileges.
I checked Disk Management, and it says her C: drive is Bitlocker encrypted. The control panel has no dedicated bitlocker or disk encryption tools anymore as those have been redirected to Settings. I checked Settings > Privacy and Security > Device Encryption. Encryption is ON, but choosing to “Bitlocker Drive Encryption” redirects to the Microsoft Store, and “Find Your Bitlocker Recovery Key” redirects to a web page where the advice hinges on the key being in your Microsoft Account.
I tried the prompt mentioned earlier
(Command Prompt, manage-bde -protectors C: -get and PowerShell, Get-BitLockerVolume)
(How To Get Bitlocker Recovery Key Without Microsoft Account (process.st))
But it said access was denied and to make sure I have administrator privileges, even though I was using Command Prompt and Powershell from a Local Administrator account.
Is there any other way to find the Bitlocker key without resorting to a Microsoft account? And if the key cannot be elucidated without involving a Microsoft Account, is it advisable to turn off Device Encryption in Settings?
I tried the prompt mentioned earlier
(Command Prompt, manage-bde -protectors C: -get and PowerShell, Get-BitLockerVolume)(How To Get Bitlocker Recovery Key Without Microsoft Account (process.st))
But it said access was denied and to make sure I have administrator privileges, even though I was using Command Prompt and Powershell from a Local Administrator account.
Did you;
“Open Command Prompt: Press the Windows key + X and select “Command Prompt (Admin)”?
If you open This PC in File Explorer, does the C: drive icon have a yellow triangle with exclamation mark like this?
That means the disk has been encrypted BUT protection is suspended and no key required until an administrator signs in with a Microsoft Account (when the key would be stored to that account).
How does your C: drive appear under This PC in File Explorer? (icons or warnings)
If you’re determined not to use a Microsoft Account you should turn off device encryption, as it will never be fully activated otherwise.
The C: drive does not have any lock icons or warning flags.
Thank you for the advice, b!
Regardless of the reason BitLocker is activated or where the recovery key has been stored, the issue is that users are not informed and have no recovery option when things go pear shaped.
The least we can do is attempt to inform users via some simple commands as part of their initial setup / backup strategy.
cheers, Paul
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Notifications
