How to Choose BitLocker Encryption Type on Windows 11 Drives

What is BitLocker?

BitLocker is a built-in Windows tool that protects your files by scrambling them, making them unreadable to anyone without the correct password or key. You can use BitLocker on your main Windows drive, other internal drives, or external drives like USB sticks to keep your information secure.

• External drives like USB sticks
• Fixed drives inside your computer
• Your main Windows system drive

When you use BitLocker on your main Windows drive, it can unlock automatically when your computer starts. This is made possible by a specialized security chip called the Trusted Platform Module (TPM).

Encryption Types for Fixed Drives

For fixed drives inside your computer, BitLocker offers two main encryption types to protect your data. You can choose full encryption, which scrambles everything on the drive and is the most secure option but takes longer, or you can choose to encrypt only the space on the drive that is currently being used by your files.

• Full Encryption: Encrypts the entire drive — even empty space. This takes longer but is the safest choice.
• Used Space Only Encryption: Encrypts only the space where your files are stored. This is faster but less complete.

How to Make Windows Always Use One Encryption Type

You can set Windows 11 to automatically use your preferred BitLocker encryption type for any new drives you add, so you don’t have to choose it every time. This setting ensures Windows consistently applies full disk encryption from the start, giving you reliable data protection without extra steps.

When you set the BitLocker automatic encryption preference, Windows 11 automatically picks a full disk encryption type for your drive without prompting. This default choice ensures data protection from the start.

If you want Windows to always pick one encryption type, you can set a rule using Windows tools. Here are two ways to do it.

Method 1Using Local Group Policy Editor

1. Press the ⊞ Start button and type Edit group policy, then open the Local Group Policy Editor.
2. In the window that opens, go to this folder: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Fixed Data Drives
3. Find Enforce drive encryption type on fixed data drives on the right and double-click it.
4. Choose one of these options:

   • Not Configured (default): Windows will ask you every time which encryption type to use.
   • Enabled: You pick the encryption type below, and Windows will use it automatically without asking.
   • Disabled: Same as Not Configured — Windows asks you each time.
5. If you selected Enabled, choose either:

   • Full encryption
   • Used space only encryption
6. Click OK to save.
7. 🔄 Restart your computer to apply the changes.

To set your preferred BitLocker encryption type using the Local Group Policy Editor, first press the ⊞ Start button and type ‘Edit group policy,’ then open the tool. In the window that appears, navigate to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Fixed Data Drives.

And here are the options you can pick:

Method 2Using Windows Registry Editor

Setting a default BitLocker encryption type can be done by carefully editing the Windows Registry. Open the Registry Editor by searching for ‘regedit’ in the ⊞ Start menu and choosing ‘Run as administrator.’ Then, go to the 🗝️HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE folder. Be cautiouscopy, as incorrect changes can damage your system.

1. Open the Windows Registry Editor as administrator. Search for regedit in Start, then right-click and choose Run as administrator. ⚠️ Requires admin privileges
2. Go to this folder in the Registry Editor: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE
3. Look for a value named FDVEncryptionType in the right pane.
4. If it’s not there, 🖱️ right-click on the right side, pick New > DWORD (32-bit) Value, and name it FDVEncryptionType.
5. Double-click FDVEncryptionType and set its value to:

   • 1 for Full encryption
   • 2 for Used space only encryption
6. Click OK and close the Registry Editor.
7. 🔄 Restart your computer to apply changes.

If you want to go back to letting Windows ask which encryption type to use, delete the FDVEncryptionType value from the registry.

Summary

• BitLocker protects your drives by encrypting them so only authorized users can access your data.
• You can choose how BitLocker encrypts fixed drives: full drive or used space only.
• Using the Group Policy Editor or Registry Editor, you can force Windows to always use one encryption type without asking.
• Remember to 🔄 restart your computer after making these changes.

BitLocker is a Windows feature that secures your drives by encrypting them, ensuring only authorized people can access your data. You can choose between full drive encryption or encrypting only used space for fixed drives. Using the Group Policy or Registry Editor, you can set Windows to always use your preferred encryption type automatically.