How to Change BitLocker Encryption in Windows 11

What is BitLocker?

What is BitLocker? BitLocker is a built-in Windows security feature that scrambles your files, keeping private information safe. It protects your computer’s main drive, USB drives, and other storage devices from unauthorized access. BitLocker can often unlock your main drive automatically if your PC has a specific chip.

When you enable BitLocker for your main Windows drive, it might unlock automatically using a special chip known as the Trusted Platform Module (TPM). This means you won’t need to enter a password every time you start your computer. Learn more about TPM here.

Why Change the Encryption Method?

BitLocker, a drive encryption tool in Windows, uses XTS-AES 128-bit encryption by default. Users can change this setting to XTS-AES 256-bit encryption. This 256-bit encryption makes data access significantly more difficult for unauthorized individuals.

How to Change BitLocker Encryption Using Group Policy

You can change the BitLocker encryption method your drives use with the Local Group Policy Editor. The Local Group Policy Editor lets you choose how BitLocker scrambles your data and adjust other security settings. To open the Local Group Policy Editor, click the Start button, type ‘Edit group policy’, and press Enter. You’ll need administrator rights to make these changes.

1. Open the Group Policy Editor: Click the ⊞ Start button, type Edit group policy, and press Enter. ⚠️ Admin privileges required
2. In the window that opens, follow this path: Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption
3. On the right side, find and double-click “Choose drive encryption method and cipher strength (Windows 10 Version 1511 and later)”.
4. In the window that opens:

   • Select Enabled.
   • Now you can choose the encryption method and strength for:
     • Operating system drives
     • Fixed data drives
     • Removable data drives
   • Pick the desired encryption type from the drop-down menus (for stronger encryption, pick a 256-bit option).
5. Click OK to save.
6. 🔄 Restart your computer to apply the changes.

How to Change BitLocker Encryption Using Registry Editor

You can also change the BitLocker encryption method by editing the Windows Registry, but you must be extremely careful. Be careful, as mistakes made in the Registry can cause serious problems with your computer. To safely adjust how your drive’s data is scrambled, first click Start, type ‘regedit’, and press Enter to open the Registry Editor.

1. Open the Registry Editor: ⊞ Click Start, type regedit, and press Enter. ⚠️ Admin privileges required
2. If prompted, click Yes to allow changes.
3. Go to this folder path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE
4. Look for these three entries on the right side:

   • EncryptionMethodWithXtsOs
   • EncryptionMethodWithXtsFdv
   • EncryptionMethodWithXtsRdv
5. If you don’t see them, 🖱️ right-click on an empty space, choose New → DWORD (32-bit) Value, and create these three names exactly as above.
6. Double-click each entry and set its value to:

   • 4 for AES-CBC 256-bit encryption
   • 7 for XTS-AES 256-bit encryption
7. Click OK for each, then close the Registry Editor.
8. 🔄 Restart your PC to apply changes.

Reset to Default Encryption

If you want to go back to the original BitLocker encryption (XTS-AES 128-bit), delete the three registry entries you created:

• EncryptionMethodWithXtsOs
• EncryptionMethodWithXtsFdv
• EncryptionMethodWithXtsRdv

Then restart your PC.

Summary

You can customize BitLocker encryption in Windows 11 to make your files more secure by changing its settings through tools like the Group Policy Editor or Registry Editor.