BitLocker hardware encryption fallback via GPO

Question

BitLocker falls back to software encryption instead of hardware-based SED encryption, how do we enforce hardware encryption via GPO?

Answer 1

Hello Lewis Hilton,

BitLocker uses software encryption when it doesn't correctly detect the disk's SED capabilities. To force the use of hardware encryption, you need to configure the Group Policy under Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption → Operating System Drives. The option to enable is Configure use of hardware-based encryption for operating system drives, and it must be set to Enabled. You can also apply the same policy to both fixed and removable drives to standardize the behavior.

After modifying the GPO, you need to remove any existing BitLocker protection, run manage-bde -off C: to decrypt, and then re-enable BitLocker so that it applies hardware encryption. Then, verify with manage-bde -status that the Encryption Method field correctly displays Hardware Encryption. If the drive doesn't support eDrive/SED standards, BitLocker will always fall back to software, so make sure the drive's firmware and BIOS/UEFI are up to date and that the feature is enabled.

If my answer is helpful, please click "Accept the answer" to support me.

Thank you,

HL.