How to Change BitLocker Encryption in Windows 11

Why Change Your BitLocker Settings?

Enhanced cipher strength makes volume data significantly harder to compromise. Workloads handling sensitive information benefit immediately from implementing 256-bit protection.

What Happens When You Change These Settings?

Existing files re-encrypt automatically in the background while remaining fully accessible. Newly created data adopts the upgraded cipher right away. A system reboot may be necessary before changes take full effect.

Method 1Use Group Policy Editor

The Group Policy Editor (a built-in Windows tool for managing system configurations) offers a reliable interface for adjusting drive cipher strength. Most administrators prefer this method to configure volume security policies safely.

1. Open the Local Group Policy Editor. Search for “Edit group policy” on your Start menu ⊞.
2. Follow these folders in order:

   • Computer Configuration
   • Administrative Templates
   • Windows Components
   • BitLocker Drive Encryption
3. On the right side, find “Choose drive encryption method and cipher strength (Windows 10 (Version 1511) and later)”. Double-click it.

4. A window opens. You have three choices:
   • Not Configured (this is the default) – BitLocker uses its standard settings
   • Enabled – you pick the encryption type yourself
   • Disabled – BitLocker uses AES with 128-bit or 256-bit strength

5. If you pick Enabled, use the dropdown menu under Options. Choose your encryption method for:

   • Operating system drives (your main drive)
   • Fixed data drives (regular storage)
   • Removable data drives (USB sticks)
6. Click OK to save. You may need to restart your 🔄 computer.

Method 2Use Registry Editor

Advanced users can also modify BitLocker settings directly through the Windows Registry. Modifying this central database requires careful execution to prevent unexpected system behavior.

The Registry houses low-level operating system configurations. Precision matters when altering these keys.

1. Open the Windows Registry Editor. Search for "regedit" on your Start menu.
2. Find this path in the left panel:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE
3. Look at the right side. You should see three items with these names:

   • EncryptionMethodWithXtsOs
   • EncryptionMethodWithXtsFdv
   • EncryptionMethodWithXtsRdv
4. Double-click each one and change its value:

   • Enter 4 to use AES-CBC 256-bit encryption
   • Enter 7 to use XTS-AES 256-bit encryption

5. Don't see these items? Right-click a blank area on the right side. Pick "New" and then "DWORD (32-bit) Value". Create all three items if they're missing, then enter the values above.
6. To go back to the default XTS-AES 128-bit encryption, delete all three items you created or changed.
7. Save your changes and restart your computer.

Summary

Securing sensitive files starts with choosing the right configuration tool. The Group Policy Editor works best for most setups, while the Registry Editor suits advanced administrative tasks.

Two primary configuration paths exist:

• Group Policy Editor - easier and safer for most people
• Registry Editor - more advanced, requires admin access

Encryption upgrades apply universally across system volumes, internal disks, and removable media. Rebooting hardware after policy updates forces Windows to apply the new cipher settings.

Higher cipher complexity demands slightly more processor overhead in exchange for superior data defense.