How does Device Encryption work?

Question

I had installed a new BIOS update for my computer (my first time) and after i had finished it gave me two options, either I boost TPM with current data or I reset TPM. Resetting TPM means that I lose all the encrypted keys. I'm on Windows 11 Home Edition and found out that it doesn't use BitLocker. Also I don't remember getting any BitLocker keys nor getting one saved to my account. So what does it mean when it says that I lose my Encrypted keys? And do is my Microsoft account used as a key or what?

Answer 1

Hi, I'm Rodrigo and I will help you.
If your drive is not encrypted by BitLocker, you can reset your TPM, this was needed because of the BIOS update.

Resetting TPM will reset your encrypted keys, but since you don't have anything encrypted, it is not an issue.
If you had a BitLocker encrypted drive, your keys are usually stored in your Microsoft Account, so you can restore them easily if needed.

Answer 2

Device Encryption in Windows 11 works by automatically enabling BitLocker Drive Encryption on devices that meet specific hardware requirements, such as Modern Standby. When you log in with a Microsoft account, the system checks if the hardware is compatible and then activates Device Encryption. The recovery key for the encrypted data is backed up in the Microsoft cloud and can be accessed through your Microsoft account.

When you reset the TPM (Trusted Platform Module), it clears all keys associated with it. This means that any data that was encrypted using those keys will become inaccessible. Essentially, if you reset the TPM, you will lose access to any encrypted data, such as files protected by Device Encryption, as the keys that allow you to decrypt that data will be deleted. This is why it is crucial to ensure that you have backups of any important data before proceeding with a TPM reset.

Since you are on Windows 11 Home Edition and noted that it does not use BitLocker, it is important to understand that Device Encryption still provides a level of protection similar to BitLocker, but it is automatically managed by the operating system without user intervention. Therefore, losing the encrypted keys means losing access to the data protected by Device Encryption as well.