Question How is BitLocker enabled by default after clean Win10 install? Broken again.

Ichinisan

Lifer
Oct 9, 2002
28,298
1,234
136
A clean Win10 install broke itself within 2 days, apparently due to BitLocker. How is this on by default if we weren't prompted during a clean Win10 install?

My sister is in California and I am in Georgia, so it's difficult to help her remotely. Her Dell Inspiron 15 3567 laptop spontaneously stopped working and would only boot to a blank screen with a mouse pointer. We tried to use startup repair tools and it was asking for a BitLocker recovery key, which nobody had. There was basically no way to save the install or recover files.

[edit]
Yes, we followed a suggestion and tried logging-in to her Microsoft account from an iPhone to see if the recovery key was there. It wasn't there. I think her computer had originally been used without a Microsoft account (local account), but I am not sure.
[/edit]

I created a Windows 10 install DVD on 4/27 and mailed it to her. A couple days ago, I helped her install Windows clean. We deleted all partitions on the 1TB Seagate HDD until there was only a single contiguous block of "unpartitioned" space. We selected that and installed Windows.

During setup, it NEVER asked about enabling BitLocker or backing-up a recovery key.

After setup, she installed Google Chrome and her HP printer/scanner software. A day and a half later, she found that the computer would beep or something when she tried to turn it on. Then, after a few attempts, a Dell "SupportAssist" screen appears with her model, BIOS version, service tag number, etc.

This is very strange because we NEVER installed a Dell "SupportAssist" utility. This must be something in the EFI BIOS, and it persists after a clean Windows install.

xVGFc7P.jpg


She entered BIOS Setup, corrected the date + time, and selected "Exit"

Now the computer is prompting for a BitLocker recovery key again!

She's in a panic. I'll need to help her reinstall Windows again, but we need to do that in a way that permanently disables this broken BitLocker garbage.
 
Last edited:

VirtualLarry

No Lifer
Aug 25, 2001
56,339
10,044
126
Well, my understanding was, with recent Win10 versions, BitLocker is enabled AUTOMATICALLY, if the hardware (SED, TPM, etc.,) is capable of it. There is no choice, no opt-out.

As far as that Dell utility, well, with modern versions of Windows, the Windows Setup procedure actually has a defined way to allow the PC's UEFI BIOS to "inject" programs and download programs during Windows Setup phase. That's right, un-removable BIOS "malware" (in the case of Lenovo), that re-installs itself into the PC, when Windows is re-installed "fresh" or "clean" (but not really, because of these BIOS injects).
 
  • Like
Reactions: mxnerd

Shmee

Memory & Storage, Graphics Cards Mod Elite Member
Super Moderator
Sep 13, 2008
7,403
2,439
146
Can you disable it in UEFI? Disable secure boot if possible, disable TPM functions, and if need be you could always try changing to a legacy install if possible. Would require wiping the drive and reinitializing it MBR.
 

mxnerd

Diamond Member
Jul 6, 2007
6,799
1,101
126
Well, my understanding was, with recent Win10 versions, BitLocker is enabled AUTOMATICALLY, if the hardware (SED, TPM, etc.,) is capable of it. There is no choice, no opt-out.

As far as that Dell utility, well, with modern versions of Windows, the Windows Setup procedure actually has a defined way to allow the PC's UEFI BIOS to "inject" programs and download programs during Windows Setup phase. That's right, un-removable BIOS "malware" (in the case of Lenovo), that re-installs itself into the PC, when Windows is re-installed "fresh" or "clean" (but not really, because of these BIOS injects).
Wow, didn't know that.
 

mxnerd

Diamond Member
Jul 6, 2007
6,799
1,101
126
OP's sister's laptop does have TPM module.

See if the following tips help.



or

 
Last edited:

pcgeek11

Lifer
Jun 12, 2005
21,318
4,432
136
Yes, it is a WIndow's Setting and as I understand it it requires that you log into a Windows Account before it actually encrypts the drive.

 

Chiefcrowe

Diamond Member
Sep 15, 2008
5,046
177
116
Hold on, I have not heard of this before. The last few dell computers we bought have not had this enabled by default.

Does this happen when logging in with a MS account? Is this documented anywhere??!
I would recommend contacting Dell support to see if they know anything about this... and I'd love to hear back what they say...
 

Ichinisan

Lifer
Oct 9, 2002
28,298
1,234
136
Can you disable it in UEFI? Disable secure boot if possible, disable TPM functions, and if need be you could always try changing to a legacy install if possible. Would require wiping the drive and reinitializing it MBR.
How do we choose to do MBR during setup? After deleting all partitions and selecting the remaining "unpartitioned space," it never prompts for what type of partition or boot loader to use.
 

Shmee

Memory & Storage, Graphics Cards Mod Elite Member
Super Moderator
Sep 13, 2008
7,403
2,439
146
Windows will install MBR if you are installing in legacy mode.
 

pcgeek11

Lifer
Jun 12, 2005
21,318
4,432
136
Hold on, I have not heard of this before. The last few dell computers we bought have not had this enabled by default.

Does this happen when logging in with a MS account? Is this documented anywhere??!
I would recommend contacting Dell support to see if they know anything about this... and I'd love to hear back what they say...



Dell and Lenovo systems that ship with the Windows 10 operating system and are equipped with Trusted Platform Module (TPM) capability will have Microsoft BitLocker encryption enabled from the factory.


It has been found that once the device is registered to a Active Directory domain - Office 365 Azure AD, Windows 10 automatically encrypts the system drive. You find this once you reboot your computer and are then prompted for the BitLocker key.
 
  • Like
Reactions: FaaR

UsandThem

Elite Member
May 4, 2000
16,068
7,380
146
Dell and Lenovo systems that ship with the Windows 10 operating system and are equipped with Trusted Platform Module (TPM) capability will have Microsoft BitLocker encryption enabled from the factory.
Yup.

I've bought quite a few Dell laptops over the years, and the Inspiron I bought in November 2019 had BitLocker enabled directly from Dell.
 

pcgeek11

Lifer
Jun 12, 2005
21,318
4,432
136
Yup.

I've bought quite a few Dell laptops over the years, and the Inspiron I bought in November 2019 had BitLocker enabled directly from Dell.


My Lenovo T480 came with it also enabled but I did not use a Microsoft Account only a local accound. The first thing I did was disable it in Windows Settings.