How to Change BitLocker Encryption in Windows 11

What is BitLocker?

BitLocker is a built-in Windows security tool that scrambles the data on your hard drives so no one can read it without your password or recovery key. It protects your personal files from theft and keeps your system secure if your computer is lost or stolen, using the BitLocker encryption method to lock down both internal system drives and external USB sticks.

Enabling BitLocker on a primary drive often triggers automated unlocking via a Trusted Platform Module (a specialized security microchip installed on the motherboard). Bypassing manual passwords at every boot relies entirely on this hardware integration. Learn more about TPM here.

Why Change the Encryption Method?

Default configurations apply XTS-AES 128-bit encryption when initializing the tool. Upgrading to XTS-AES 256-bit encryption increases data protection levels substantially. Brute-force attacks face exponentially higher hurdles when processing this denser cryptographic standard.

How to Change BitLocker Encryption Using Group Policy

You can change the BitLocker encryption method using the Local Group Policy Editor in Windows 11 Pro, Enterprise, or Education editions. This built-in tool lets you switch the cipher strength and scrambling algorithm used to secure your drives before you turn on encryption, ensuring your files meet specific security standards.

1. Open the Group Policy Editor: Click the Start button, type Edit group policy, and press Enter. ⚠️ Admin privileges required
2. In the window that opens, follow this path: Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption
3. On the right side, find and double-click "Choose drive encryption method and cipher strength (Windows 10 Version 1511 and later)".
4. In the window that opens:

   • Select Enabled.
   • Now you can choose the encryption method and strength for:
     • Operating system drives
     • Fixed data drives
     • Removable data drives
   • Pick the desired encryption type from the drop-down menus (for stronger encryption, pick a 256-bit option).
5. Click OK to save.
6. Restart your computer to apply the changes.

How to Change BitLocker Encryption Using Registry Editor

You can change the BitLocker encryption method using the Registry Editor if you use Windows 11 Home and do not have access to the Group Policy Editor. This method involves creating specific registry keys to adjust your drive's cipher strength, though you need to follow the steps carefully to avoid system errors.

1. Open the Registry Editor: Click Start, type regedit, and press Enter. ⚠️ Admin privileges required
2. If prompted, click Yes to allow changes.
3. Go to this folder path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE
4. Look for these three entries on the right side:

   • EncryptionMethodWithXtsOs
   • EncryptionMethodWithXtsFdv
   • EncryptionMethodWithXtsRdv
5. If you don't see them, right-click on an empty space, choose New › DWORD (32-bit) Value, and create these three names exactly as above.
6. Double-click each entry and set its value to:

   • 4 for AES-CBC 256-bit encryption
   • 7 for XTS-AES 256-bit encryption
7. Click OK for each, then close the Registry Editor.
8. Restart your PC to apply changes.

Reset to Default Encryption

Reverting to the default XTS-AES 128-bit configuration requires deleting the custom database entries:

• EncryptionMethodWithXtsOs
• EncryptionMethodWithXtsFdv
• EncryptionMethodWithXtsRdv

Rebooting the computer applies the deletion.

Summary

Customizing disk encryption parameters through administrative tools hardens Windows 11 against potential data breaches.