Microsoft is trying to prevent users from enabling Bitlocker when not using Microsoft account.
However, there is a way to fix this issue with some console commands.
However, there is a way to fix this issue with some console commands.
While it's possible to enable the disk encryption in GUI, the encryption process will be stuck forever.
To check the encryption status, execute:
It will probably show that the progress is 99% and it won't go any further.
To finish the encryption progress, you have to pause it and then resume. Microsoft's Logic~!
Now the drive is encrypted. However, there's no decryption method set, yet. By default, there's an unsecured encryption key, which allow to decrypt the drive until proper keys will be added.
In Bitlocker, the way of unlocking the drive is called `protector`. It can be TPM, string key or universal numerical password (the one used when TPM fails to unlock your drive).
You can get the current protectors using command:
It will show you your numerical password, so you can backup it. Shouldn't it be unable to receive this key? I thought so, too.
Available protectors can be checked using:
To add the default, numerical password (recovery password), we can use:
To remove the unsecured encryption key and force decryption by secure protectors (TPM, recovery password), we use command:
If you forgot to save the numerical/recovery password, you won't be able to decrypt the drive after rebooting.
To let the computer decrypt the drive at the boot time, without the need to provide numerical password, we can add TPM decryption key:
If we execute the same command on another drive, for example D:, we can enable auto unlocking the drive:
This will create decryption key and save it on the system drive, so it will be safe as long as your system drive is encrypted.
For drives different than system one, you don't need TPM keys.
References:
* https://www.reddit.com/r/Intune/comments/11vnp0u/bitlocker_stuck_encrypting/
* https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/manage-bde-protectors
All commands have to be executed from admin terminal
To check the encryption status, execute:
manage-bde -status
It will probably show that the progress is 99% and it won't go any further.
To finish the encryption progress, you have to pause it and then resume. Microsoft's Logic~!
manage-bde -pause C:
manage-bde -resume C:
Now the drive is encrypted. However, there's no decryption method set, yet. By default, there's an unsecured encryption key, which allow to decrypt the drive until proper keys will be added.
In Bitlocker, the way of unlocking the drive is called `protector`. It can be TPM, string key or universal numerical password (the one used when TPM fails to unlock your drive).
You can get the current protectors using command:
manage-bde -protectors -get C:
It will show you your numerical password, so you can backup it. Shouldn't it be unable to receive this key? I thought so, too.
Available protectors can be checked using:
manage-bde -protectors -add -?
To add the default, numerical password (recovery password), we can use:
manage-bde -protectors -add -rp C:
To remove the unsecured encryption key and force decryption by secure protectors (TPM, recovery password), we use command:
manage-bde -protectors -enable C:
If you forgot to save the numerical/recovery password, you won't be able to decrypt the drive after rebooting.
To let the computer decrypt the drive at the boot time, without the need to provide numerical password, we can add TPM decryption key:
manage-bde -protectors -add -tpm C:
If we execute the same command on another drive, for example D:, we can enable auto unlocking the drive:
manage-bde -autounlock -enable D:
This will create decryption key and save it on the system drive, so it will be safe as long as your system drive is encrypted.
For drives different than system one, you don't need TPM keys.
References:
* https://www.reddit.com/r/Intune/comments/11vnp0u/bitlocker_stuck_encrypting/
* https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/manage-bde-protectors