How to Change BitLocker Encryption in Windows 11

What is BitLocker?

Disk encryption features inside Windows protect your files by locking them away from unauthorized eyes. Main system drives, USB sticks, and external storage all gain robust defense through this utility. Hardware chips built onto motherboards frequently unlock the primary drive automatically during boot.

Enabling BitLocker on a primary drive often triggers automated unlocking via a Trusted Platform Module (a specialized security microchip installed on the motherboard). Bypassing manual passwords at every boot relies entirely on this hardware integration. Learn more about TPM here.

Why Change the Encryption Method?

Default configurations apply XTS-AES 128-bit encryption when initializing the tool. Upgrading to XTS-AES 256-bit encryption increases data protection levels substantially. Brute-force attacks face exponentially higher hurdles when processing this denser cryptographic standard.

How to Change BitLocker Encryption Using Group Policy

The Local Group Policy Editor (a Microsoft Management Console snap-in for configuring system policies) provides an interface for altering cipher strength. Security parameters and scrambling algorithms change rapidly through this console. Clicking the Start button ⊞, typing ‘Edit group policy’, and pressing Enter launches the editor. Administrative privileges remain mandatory for altering these system rules.

1. Open the Group Policy Editor: Click the Start button, type Edit group policy, and press Enter. ⚠️ Admin privileges required
2. In the window that opens, follow this path: Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption
3. On the right side, find and double-click "Choose drive encryption method and cipher strength (Windows 10 Version 1511 and later)".
4. In the window that opens:

   • Select Enabled.
   • Now you can choose the encryption method and strength for:
     • Operating system drives
     • Fixed data drives
     • Removable data drives
   • Pick the desired encryption type from the drop-down menus (for stronger encryption, pick a 256-bit option).
5. Click OK to save.
6. Restart your computer to apply the changes.

How to Change BitLocker Encryption Using Registry Editor

Registry modifications offer an alternative route for adjusting encryption parameters, though caution remains paramount. System instability often follows mistaken entries inside this database. Launching the Windows Registry database requires clicking Start, typing 'regedit', and pressing Enter.

1. Open the Registry Editor: Click Start, type regedit, and press Enter. ⚠️ Admin privileges required
2. If prompted, click Yes to allow changes.
3. Go to this folder path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE
4. Look for these three entries on the right side:

   • EncryptionMethodWithXtsOs
   • EncryptionMethodWithXtsFdv
   • EncryptionMethodWithXtsRdv
5. If you don't see them, right-click on an empty space, choose New → DWORD (32-bit) Value, and create these three names exactly as above.
6. Double-click each entry and set its value to:

   • 4 for AES-CBC 256-bit encryption
   • 7 for XTS-AES 256-bit encryption
7. Click OK for each, then close the Registry Editor.
8. Restart your PC to apply changes.

Reset to Default Encryption

Reverting to the default XTS-AES 128-bit configuration requires deleting the custom database entries:

• EncryptionMethodWithXtsOs
• EncryptionMethodWithXtsFdv
• EncryptionMethodWithXtsRdv

Rebooting the computer applies the deletion.

Summary

Customizing disk encryption parameters through administrative tools hardens Windows 11 against potential data breaches.