Enable 256-bit Bitlocker encryption on Windows 11 to boost security

Bitlocker is the default encryption know-how of the Home windows working system. It’s used extensively on Home windows, however some customers choose third-party options, equivalent to VeraCrypt.

What many customers of Bitlocker do not know is that it defaults to 128-bit encryption, regardless that 256-bit can also be obtainable. With out going into too many particulars in regards to the variations; the core distinction between AES 128-bit and 256-bit encryption is the size of the safety key. An extended key makes brute pressure assaults a lot more durable.

Whereas 128-bit is the default, even Microsoft recommends utilizing 256-bit to enhance safety. Drawback is, most customers could not know in regards to the weaker default or find out how to make the change.

First, it’s possible you’ll need to discover out which encryption technique is used on the Home windows machine. Right here is how that’s performed:

Open the Begin Menu.
Sort CMD and activate the “run as administrator” choice whereas the Command Immediate result’s highlighted.
Run the command manage-bde -status.
Home windows returns a bunch of details about every quantity. Test the Encryption Technique standing. If it reads XTS-AEs 256 you’re all set and need not do something. If you happen to get XTS-AES 128, encryption is utilizing the weaker 128-bit technique.

Drawback is, Home windows doesn’t embody an choice to migrate from 128-bit to 256-bit. Even worse, to even get the 256-bit choice, it’s essential to make a change within the Group Coverage Editor.

Here’s a step-by-step information on how to do this:

Open the Begin Menu.
Sort gpedit.msc and choose Edit Group Coverage.
Navigate to Laptop Configuration > Administrative Templates > Home windows Parts > BitLocker Drive Encryption.
Double-click on “Select drive encryption technique and cipher energy” to handle this coverage. Observe that there are three entries for various variations of Home windows. Choose Home windows 10 [Version 1511] and later.
Swap the standing of the coverage to Enabled.
Change the encryption technique for working system and stuck drives to XTS-AES 256-bit. You might also make the change for detachable knowledge drives. Some say that AES-CBS 256-bit affords higher compatibility, however that is solely necessary in the event you plug-in the detachable drive into different methods.
Choose OK to make the change.

Upon getting made the required adjustments, it’s worthwhile to decrypt the BitLocker encrypted drives after which re-encrypt them. BitLocker makes use of the brand new encryption technique mechanically when it encrypts volumes on the system.

The simplest solution to get began is to open the Begin Menu, sort BitLocker and choose the Handle BitLocker choice.

It opens the basic Management Panel of the Home windows working system. There you discover both “Flip BitLocker on”, if the drive is just not encrypted, or “Flip off BitLocker” whether it is encrypted.

Choose Flip off BitLocker first to decrypt your entire quantity that you’ve chosen. Then, as soon as performed, choose Flip BitLocker on to encrypt the quantity utilizing the stronger encryption technique. Repeat the method for all volumes that you simply need to defend with BitLocker.

You may take a look at my information on encryption Home windows 10 arduous drives with BitLocker. It’s from 2015, however the course of has not modified.

Now You: do you encrypt your drives and units?

Abstract