Microsoft secured my files!

They also do spyware. They just renamed it "AI."
- and also Recall
  
  Rectal is what it's called I believe?
  Microsoft Rectal
  
  Can you remind me what that "recall" is?
  
  Recall Rec all Record all, their not even being subtle about it anymore
- Did they change it from "telemetry" to AI now?
  
  https://en.wikipedia.org/wiki/Microsoft_Recall
- I think they renamed everything to copilot
  Office365 is now Copilot 365

Holy shit, they automatically activate it on computers without an account to back the key up to?
That's just malicious
- IIRC, they only do this if you're logged in with a Microsoft account.
  Bitlocker is disabled by default if you only use local accounts
  
  I've occasionally seen it activate itself on computers with only a local account, though I've so far only seen it when upgrading in place to 11 with secure boot enabled in the BIOS, and not every time. Fortunately the one time it locked me out was on a freshly cloned drive, so it only cost me redoing the work.
  Also, the number of people who I've seen lose all their data because they don't even know they created an MS account during OOBE, and later had a boot or BIOS hiccup, is too damn high!
  
  I have (had ;'( ) a local account, and bitlocker was activated. I only found out when my motherboard bit the dust, and that triggered the no-TPM bitlocker thingamajig. Goodbye data.
  Of course it hits right as I needed the data on that laptop. Fucking murphy and his fancy legal words.
  If anyone is in a situation like mine, you might find luck with a little DIY hacking: https://www.techspot.com/news/106166-old-bitlocker-vulnerability-exploited-bypass-encryption-updated-windows.html

- 🤔 shit... you right
- Could you elaborate?
  
  luks-cryptsetup-backup
  If you encrypted your disk/partition, the lock is stored in the luks header. But if that one is broken, you cant decrypt anything even if you remember your key and all data is lost.

They desperately wanted to eliminate personal computers and replace them with dumb terminals running over the net.
When the public rejected this idea
THIS is their response. They are still insisting on total control of our computers.
- They desperately wanted to eliminate personal computers and replace them with dumb terminals running over the net.
  I don't know about that.
  Dumb terminal concept was more what Chromebook was doing.
  Microsoft is doing something even stupider.
  
  Dumb terminal concept was more what Chromebook was doing.
  I mean, for a lot of people they're fine especially if they're priced appropriately. Especially with a lot more software as a service out there. My problem is that all of them have a built in drop dead date on when they're going to stop getting updates and there's not really a great option for the devices post ChromeOS.
  ChromeOS certainly can be a good system. I still have my old CR-48 from when I got selected to test the OS and even when it was in its infancy, it was solid. I used it for a lot of my college career because it was better than my Asus eeePC which had Ubuntu on it.
  
  I think they want you to only use Windows and pay for cloud storage.
  By enforcing BitLocker and Secure Boot, they are trying to eliminate dual-booting (you don't need to dual-boot Windows/Linux anyway, as you can just use WSL2 /s).
  By enforcing disk encryption, in general, they try to force the use of cloud storage, by making data recovery nearly impossible. Most people are probably too lazy to buy external storage, and manually copy their files over.
  This guarantees 2 money streams. One from Windows's tracking/advertising and the other from OneDrive subscriptions.
  
  MS execs blathered about "the age of software running locally being over" long before Chromebooks.
- Not to mention DRM. They want to own your computer and prevent any kind of modification so that movie producers give them money.
  
  Movie producers?
- Good thing PCs aren't locked into Windows.
  
  yet
- Just wait until you learn about Intel's Management Engine...

Just checked my wife's laptop. Local account, secure boot off, windows 10. It had a message telling me to setup a microsoft account to 'finish encrypting the device'. I clicked turn off, and it's currently decrypting the hard drive. Blech.
- I need to check my girl's laptop.
  
  Good now we know that
- Which version of Win 10 are you using? My girl's Win 10 Pro laptop is still unencrypted.
  
  Windows 10 Home
  
  It's not which version, it's where you are. They follow some laws here some there and now that the US is fascist they roll out features like this on these easy targets first
- Shit they do this on windows 10 too? I should check my girl laptop too.

Meanwhile in Linux with luls, which I've had since a pre-pre-pre version somewhere back in the early 2000's, I can have multiple keys, all works like sunshine, never had problems.
On windows... So we work with highly sensitive data, and ever since I came in I thought it insane that people working remote don't have that highly sensitive data encrypted. We can't switch Linux yet, so okay, we go for BitLocker.
Boy oh boy oh boy was that a mistake.
50 remote users, 5 get encrypted devices with BitLocker as a trial and within a month, 3 of them already got locked up permanently because apparently it'll pwrma lock itself after x amounts of invalid passwords which is just incredibly stupid. But don't worry, there is a backup key! Yeah, that is lie 48 characters that we'd had to pass by phone and they have to type it flawlessly.
Suffice to say, the remote users will be running Linux soon, like it or not.
- Yeah, that is lie 48 characters that we'd had to pass by phone and they have to type it flawlessly.
  Wouldn't be so bad if everyone knew their Alpha Bravo Charlies
  My one talent: alpha bravo charlie delta echo foxtrot golf hotel India Juliet kilo Lima mike November Oscar papa Quebec Romeo Sierra tango uniform Victor whiskey x-ray Yankee Zulu, typed using voice to text
  
  You have a point. But Bitlocker recovery keys are all numeric. Really not all that hard to translate over the phone. Typically a secure email is what we use to deliver since 99% of employees also have email on their mobile devices.
  
  Alpha bravo charlie Delta echo foxtrot golf hotel Juliet Lima kilo Manhattan November Ovaltine Papa Quebec Romeo Sierra Tatooine uniform Victor wet ass pussy x-ray yokai Zelda
  I'm a little fuzzy on some of them...
- pass by phone
  That's a ticket I would go and overnight mail a pre configured IP KVM
- apparently it'll pwrma lock itself after x amounts of invalid passwords which is just incredibly stupid. But don't worry, there is a backup key! Yeah, that is lie
  If you only used TPM for bitlocker with no pre-boot authentication or something similar, it's possible that you had the "MaxDevicePasswordFailedAttempts" policy configured. Apparently that is configured by default if you use the security baseline.
  IMO it makes a lot of sense to lockdown and require bitlocker recovery if there has been a few failed attempts.
  We use bitlocker on probably over 1000 devices I don't believe we had any substantial issues with it. Of course users occasionally get locked out, but that should be planned for and a process should be in place to help them.
  I suggest deploying windows hello or smart cards to reduce the dependency on passwords. Window hello for business is especially great since it's free, secure and way easier and faster for users to use, especially if your devices have fingerprint readers or face recognition. I wish Linux and MacOS had anything as useful as Windows Hello.
  
  Yeah I'm with you. I also manage about 800 devices at my current role and I've never had any major issues with BitLocker.
  I'm tempted to think they're just lying but that's a little mean. Maybe they just didn't know? I don't know but BitLocker is not the problem here.
- hey, at least it tells you if you put in a typo every few chars.

Not that it helps now, but you can also dump your bitlocker recovery key through powershell and save it independently.
(Get-BitLockerVolume -MountPoint "C").KeyProtector
- The control panel dialogue allows you to do this as well. Control Panel > system security > Bitlocker encryption. But it also has the superior option which is to turn it off.
  I didn't loose any data BTW. I had my M$ account info, and a backup besides.
  
  But it also has the superior option which is to turn it off.
  Why would you not want to encrypt your files? My Linux systems are encrypted too.
  
  Disk encryption should absolutely be used, especially on laptops/portable systems.
  Otherwise someone steals your laptop and swaps the disk into another system and they've got all your stuff. Including that folder that nobody knows about.

I've actually had this occur before to a machine I specifically disabled the tpm on so that it wouldn't happen (it was an account less frozen kiosk). I was fuming the entire time I spent rebuilding it.

I just installed Manjaro on my daily driver over the weekend. My entire steam library just works. My dev tools all work(better) on Linux, and free office is nice and familiar. Fuck widows.
- Give them time to mourn first, but then fuck widows :D
- Bazitte ! Try Bazitte.

Windows is the virus.

This happened to me once and I had to redo my coursework over the weekend...now I use Fedora :D

Thank you for the word of warning. Does this affect Windows 10 as well?
- Does this affect Windows 10 as well
  IDK. 10 has bitlocker, so I'd check.
  
  I just checked and it is not on by default.
- Might be, so better check like this user did:
  Just checked my wife's laptop. Local account, secure boot off, windows 10. It had a message telling me to setup a microsoft account to 'finish encrypting the device'. I clicked turn off, and it's currently decrypting the hard drive. Blech.

Why cant windows copy luks and let you choose your own password
- because people will set hunter2 and be done with it.
  
  How did you get my password?
  
  So?
- You can use pins, passwords, TPM, a usb key, or multiple in combination. But generally TPM is the best option for most users
  
  Oh I thought you can only pick tpm
- I'm pretty sure you can get your recovery key and write that down elsewhere.
  
  Ik that

Fuck Microsoft.
I remember back in highschool a buddy encrypted his harddrive, didn't backup his key. He Lost ALOT when I upgraded his comp
- But how is that relevant to your 'Fuck Microsoft' if he knowingly encrypted his device, which is how you make it sound?
  I've enabled FDE on one of my Linux devices, I've already had to mount the filesystem in a rescue environment once because a failed update caused the system to be unable to boot. I would also have been hosed if I had lost the encryption key. Ok not really, because that's what backups are for, but you hopefully get the point.
  
  From what I gather though other memes, It looks like Windows 11 is enabling Bitlocker by default.
- That's not a Microsoft issue. Loose your key and the door will stay close whatever it is.

I can't even adjust bitlocker settings on my laptop's windows 11 home Installation...
- Yeah, you need Windows 11 Pro, Enterprise, or Education edition.
  
  Not anymore. Now home has it too
  
  Is this person lying/incorrect? https://lemmy.world/comment/16865866
- I had a windows home installation too, local rules may vary, but mine (India), I could turn it off from the command prompt.
  manage-bde -off C: (or any other drive) was what I used.
  Edit: nevermind, you meant that you wanted to change the key. That's not possible, unfortunately, you might have to use some other encryption software.
- The what? I think i disabled bitlocker fromsettings on my laptop which is probably home version
  
  Disabling it entirely is possible, but I want to keep the encryption and set a proper password for it instead of the stupidly long recovery key. That and similar features seem to be locked behind the pro version.
- Do home versions even come with bitlocker? There might be nothing to adjust
  
  They do and it auto activates when you add a Microsoft account. It cannot be turned off on the home edition as it doesn't have the full bitlocker settings. Came across this one on some machine i was working on a while ago and i ended up having to pull the SSD from the customers machine and plug it into something with pro to actually disable bitlocker.

I just leave secure boot/bitlocker off when it comes to my home system. It wasnt something I "needed" when I was dual booting windows 10 and it's not something I'm gonna enable now that I'm using 11.
- It’s not ”leaving bitlocker off”, though. It’s ”be aware about it and turn bitlocker off manually” since it’s enabled by default in the latest updates.
  
  They can't do that legally without notifying our asking in eu
  
  That's false. My Windows partition didn't magically enable bitlocker and I'm on 24h2. LTSC build and local account tho.
- I tried having it on my new laptop for a bit. It took like a week for Windows to kill the secure boot key for my Linux partition. Even after I disabled secure boot I couldn't get it to boot up so I had to reinstall. Just left it turned off afterwards.
  
  Its just not worth the trouble for a home pc imo

Always have backups! Doesnt matter what OS you use, stuff will break eventually.
I prefer bootable full system images to my NAS for easy restores, and online file backups, both running daily.
- 3-2-1 rule : 3 backups 2 different types of storage 1 copy off-site
  
  Yup, I treat the '3' as 3 copies of data, so the first copy is just my working system, and the other 2 are various backups.

Bit late to this thread but I know a few commands that might help if you're stuck:
manage-bde -off C: (or any other drive) This decrypts the volume and turns off bitlocker
manage-bde -lock/unlock
manage-bde -protectors -get C: (or any other drive) This displays your 48-digit key. I suggest you store it somewhere, just to be safe.
Get-BitlockerVolume reveals which of your partitions are encrypted with Bitlocker.
Disclaimer: I am not a terminal nerd, I just had similar problems years ago and went down the rabbit hole, used these commands and turned off bitlocker permanently. I don't use windows anymore, but when I did, it didn't cause any problems with bitlocker after this. If you're concerned about your un-encrypted hard drives, consider using Veracrypt (carefully!) or similar open source encryption software.

This has been happening to people randomly for years. Ysed to get calls about it all the time, and that was pre-covid

Regarding your last sentence, something similar happened to me with OneDrive. I mocked people thinking surely they enabled something by mistake. Nope. The defaults and general behavior are just that wacky. Glad I'm off Microsoft now.

Upvote for a acknowledging karma

I still don't understand why there is no other mainstream os in competition alongside MS except IOs, I wouldn't call Linux mainstream of course, don't you think that's a bit weird?!
- Microsoft is almost good as dead. These days, Linux takes just as much maintenance as XP used to. They've got maybe 5 years left until laptops start shipping with alternatives to Windows. My bet is it's going to be SteamOS.
  
  I have way less maintenance to do than on my old XP machine.
  And considering all the shenanigans Microsoft does starting with 10, I guess this still holds up.
  
  Microsoft is thriving and will continue to do so, just probably on machines running Linux.
  They get paid $$ per month per employee by most businesses in the developed world.
  There is a mature alternative to desktop Windows now. But there isn't for AD, Azure, Exchange, Kerberos and M365.
  
  Maybe SteamOS Lite if the device doesn't have a proper GPU.
  
  There are already big brands offering laptops with linux in lieu of windows.
- MS abused its monopoly in the 90s. The Clinton administration was too lenient, then the Bush admin kowtowed completely. Now, there's largely no chance for another operating system to compete.
  
  Why so! and what Clinton and Bush have to do with an operating system that is used globally!? I think you overestimate MS
- If you don't just look at desktop computers, GNU/Linux and Android/Linux are the most used operating systems in the world (not sure which is in the lead).
  If you look only at desktop computers, the most used OS is Minix, which is installed on most Intel CPUs and motherbords.
- no, most users just dont want to put in any work in learning something new

"do not redeem!" - microsoft, probably

Holy shit. This happened to me last week.
Turned off Safe Boot when going back over to Win on a dualboot after 6 months. Wanted to avoid updates nuking my dualboot option. (Edit: As was a Win issue 6 months ago)
...enter Bitlocker recovery for Every. Single. Logon.
Just need to do one thing that needs genuine Win11 fingerprint and then I'm doing a 22.1 fresh install.

I got into coding in the last few days. I have a project. Bumping into this while I'm trying to learn this shit? Fuck me. You know, we could just stop using money
- I can't connect what you are saying into a coherent thread
- No, we can't. Otherwise how would people like Elon and Bezos know that they're better than us?
  /s
  
  Their good looks, obviously
- Hahahha

Windows is still around?????
- yes, I have to use it at work - and it's awful.

I've been preaching about this for a while. Many modern systems are getting bitlocker turned on by default.
If your system gets messed up, or simply won't start because of some security vendors bad update, goodbye data. You need the recovery key, and if you don't have it, you'll never see your bits the the correct order again.

I mean you can write your Bitlocker key down and store it safely or put it somewhere else safe.. Lol
- The main problem here is Bitlocker is being turned on by default on fresh 24H2 installs, most people that don't know how to bypass the online account requirement are making burner Microsoft accounts (Boomers), therefore do not know the credentials in 3-4 years when their computer needs a repair.

When I switched to a new CPU I got a bit locker message and it was one of my biggest computer scares ever. I couldn't remember if the shop that assembled my pc would have enabled it or not. And wasn't available to contact.
I had to take a risk. If I continued there was a 50 50 chance my shit would have been bricked. Thankfully. That shop had the foresight to NOT randomly enable features the client didn't ask for
- I ran into a similar problem after a bios update.
  Turns out "this update may wipe out your bitlocker key" also means "if you don't have bitlocker turned on, it'll just wipe out your windows key."

*You’re
You’re boned
- MY boned?
  
  OUR boned

Alright, lol, I'll be the guy
Hey OP, ever heard of Linux?

Windows 10 or 11?

You know, this is actually one Windows decision I agree with. Encryption should be default, especially on portable devices like laptops. For an OS aimed at people who want to use their computers, rather than understand them, you have to choose an encryption that works by default for most of your non-tech-savvy users.
If they want their data truly in their own hands, or full control, use Linux.
If they want to use Windows, but not rely on a Microsoft account for recovery, get the bitlocker recovery key and write it down (which you can do).
But I think this looks like a sane default.
(Full disclosure, I don't use Windows for anything I care about!)
- Would be fine. The problem is, Microsoft is encrypting drives and not telling anybody about it. Average users have no clue what any of this is and are completely unaware they need to create a passphrase for safe keeping.
  
  Fair point.
- Respectfully, hard disagree and terrible take. I work in IT, and your stance only makes sense if people have some tech knowledge. Which is never going to happen for the average person.
  I can't tell you how many older people I've had to tell that I can't save their grandkids first pics because of bitlocker
  
  That still happens without bitlocker. Computers are dropped. Facebook passwords are forgotten.
  I acknowledge automatic encryption is going to make some more cases of lost data, but, with respect, I think the benefit of making fewer cases of stolen data is worth it. I agree with the other commenter that users should be made aware of it more clearly.
  Also, as much as I hate the push to Microsoft accounts, I have to admit it helps mitigate this problem: if all ordinary users have an account looking after their master keys, then they can turn to that when they forget their login password etc. but the opportunistic thief on the train can't (as easily). Not every grandma has a Millennial relative at hand to boot Linux to rescue files off her HDD. And for those who don't like to trust their master keys to Microsoft/Apple/Google? There's Linux. And external backups. And saving your password somewhere safe.

I thought bitlocker had a maximum of 20 digits for the pin and only numbers were allowed.
- Don't know the pin limit/requirements, but the recovery token is a 48 digit token

This was the exact same situation I experienced with my old Surface 6. Started to look into Linux firmware on Surface devices and deactivated secure boot because it wouldn't boot Ventoy at all and do nothing, so I figured to try again with no secure boot. It still didn't work so I turned it on again, but was then greeted with this Bitlocker screen which I didn't even know it had activated up until this point. I set up a local account so I had no key to reset or something and was literally not able to do anything besides reinstalling the entire system.
Luckily I had nothing important on it lol
Weirdly the activation was saved on the MS servers so I didn't need to do that again at least (was a preinstalled system so I wouldn't have known the activation key anyways, I thought "When it doesn't work I'll switch to Linux fully because I'm not paying for that garbage system").
After I updated Ventoy I was able to boot again even with secure boot on, there seems to have been an issue with that specific version.
I had Windows on my device since I bought it (around 2018) only upgraded to W11. It never mentioned anything about Bitlocker before this incident so if I had important stuff on it it would have been so over. Well, never save important files on Windows without backup is what I got out of it
This caused me literally bigger problems than my switch to Arch Linux after having only used Windows the entire time xD

All in the name of national security *wink

they've been doing this for a long time. the issue you are having is the reason I keep bitlocker disabled on my desktop. on devices that can be stolen I still use it.

This is gonna happen to a lot more people with their password change.
Why do you have to use there? Nothing a cater. You can't use Google or open source. I don't get it. They suck.
Like I need more spyware on my phone.
What about people with landlines? Older people.
So they're going to lose a huge market share when they force everybody to throw away their computer to run Windows 11.