How to Enforce BitLocker Encryption on Removable Drives
BitLocker encryption for removable drives is a security feature built into Windows 11 Pro, Enterprise, and Education that scrambles the data on USB sticks and external hard drives so nobody can read it without a password. Enforcing this policy means every external drive plugged into your computer automatically gets locked down, which stops people from stealing sensitive files if you lose a drive.
You can set up this mandatory protection using the built-in Local Group Policy Editor or by running quick commands in PowerShell. Windows 11 Home does not support this specific group policy tool, so you need Pro or Enterprise edition to make it work.
Enforce BitLocker encryption for removable drives by opening Group Policy Editor and navigating to Computer Configuration Windows Components BitLocker Drive Encryption Removable Data Drives. Double-click “Enforce drive encryption type on removable data drives” and select your desired encryption method. Save the changes and restart your computer.
What Is BitLocker and Why Use It?
BitLocker is a built-in Windows tool that scrambles (encrypts) files so only authorized users with the correct password or recovery key can read them. Securing removable drives prevents private information from leaking when external hardware gets lost or stolen.
BitLocker protects external, fixed drives, and operating system drives. Main Windows drives running BitLocker can unlock automatically at startup using a TPM (Trusted Module, a dedicated security chip that aids encryption).
Understanding Encryption Types
Enabling BitLocker for removable data drives prompts Windows to request a specific encryption type selection.
Full encryption locks down the entire drive.
Used space only encryption protects solely the sectors holding active data.
Why Enforce an Encryption Type?
The 'Enforce drive encryption type on removable data drives' policy setting governs how BitLocker behaves on external storage. Administrators use this control to enforce a standardized encryption method across an entire organization or workstation.
Method 1Using Group Policy Editor
The Group Policy Editor handles enforcing BitLocker across all removable drives. This built-in configuration tool establishes rules that automate security protocols for USB hardware.
Search for "Edit group policy" in the Start menu. Click on 'Local Group Policy Editor' to open the utility.
Step 2: Navigate to BitLocker Settings
Follow this path in the left panel:
- Computer Configuration
- Administrative Templates
- Windows Components
- BitLocker Drive Encryption
- Removable Data Drives
Step 3: Find the Encryption Policy
Locate the setting "Enforce drive encryption type on removable data drives" in the right panel of the Group Policy Editor. Double-click this setting to open its configuration window.
Step 4: Choose Your Encryption Type
A configuration window presents three choices:
- Not Configured (default) – Works like Disabled. BitLocker will ask users which encryption type to use.
- Enabled – BitLocker uses the type you choose below. Users won't see the option to pick a type in the wizard. Choose either "Full encryption" or "Use Space Only encryption."
- Disabled – BitLocker setup will keep asking users to pick the encryption type.
Step 5: Save and Restart
Click OK to save changes. A system reboot applies the new policy settings.
Method 2Using Registry Editor %%FLAG_ADMIN%%
The Registry Editor provides an alternative method for enforcing BitLocker policies on removable drives. This approach writes direct requirements into the system database for connected USB storage.
Right-click the Windows Registry editor and select "Run as administrator."
Step 2: Navigate to the BitLocker Key
The Windows Registry, a central database for computer settings, resides at HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\System. Accessing this location allows management of BitLocker encryption policies for removable drives, ensuring external storage meets organizational security standards.
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVEStep 3: Find or Create the Encryption Type Setting
The 'RDVEncryptionType' setting appears in the right-hand pane. Double-click 'RDVEncryptionType' to open its properties window and select the encryption method for removable drives.
If the entry is missing, right-click an empty space and select 'New' > 'DWORD (32-bit) Value.' Name this new value 'RDVEncryptionType.'
Step 4: Set the Encryption Value
Enter one of these numerical values:
- 1 – Enforces full encryption on removable drives
- 2 – Enforces used space only encryption on removable drives
Step 5: Save and Restart
Click OK to save modifications. Restart the machine to enforce the changes.
How to Undo These Changes
Restoring user choice involves deleting the RDVEncryptionType item and restarting the computer.
Summary
BitLocker encryption on removable drives protects data integrity. Administrators deploy this security feature for USB hardware through either the Group Policy Editor or the Registry Editor. Direct database modifications occur via the Registry Editor.
- Group Policy Editor – Best for everyday users who prefer a visual interface
- Registry Editor – A direct way to change settings in Windows' database
Both methods support choosing full encryption or used space only configuration. Once applied, BitLocker enforces the selected rule automatically. Rebooting the machine finalizes these adjustments.
Can you remove BitLocker encryption from a USB drive?
Yes, removing BitLocker encryption from a USB drive involves disabling the protection feature. Search for 'Manage BitLocker' in Windows, open the utility, and select 'Turn off BitLocker' for the target drive.
How to encrypt a removable drive?
Protecting specific items on a removable drive involves encrypting individual files or folders. Insert the USB drive, right-click the target file or folder, select 'Properties', click 'Advanced' on the 'General' tab, and check 'Encrypt contents to protect data'.
Was this guide helpful?
About the Author
Richard
Tech Writer, IT Professional
Richard, a writer for Geek Rewind, is a tech enthusiast who loves breaking down complex IT topics into simple, easy-to-understand ideas. With years of hands-on experience in system administration and enterprise IT operations, he’s developed a knack for offering practical tips and solutions. Richard aims to make technology more accessible and actionable. He's deeply committed to the Geek Rewind community, always ready to answer questions and engage in discussions.
No comments yet — be the first to share your thoughts!