How to Enforce BitLocker Encryption on Removable Drives

What is BitLocker Encryption on Removable Drives?

BitLocker encryption for removable drives scrambles your data on USB sticks and external hard drives, keeping your files safe and private.

• Full Encryption: Encrypts the entire drive, even the empty space. This takes longer but is very secure.
• Used Space Only Encryption: Encrypts only the parts of the drive where you have saved files. This is faster but encrypts less data.

By default, Windows will ask you which encryption type you want when you first set up BitLocker for a removable drive.

How to Enforce One Encryption Type Using Group Policy

You can make sure BitLocker always uses the same encryption type for removable drives by using the Group Policy Editor, which helps keep security settings consistent across computers.

1. Press the ⊞ Start button, type Edit group policy, and open the Local Group Policy Editor.
2. Go to this folder path: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Removable Data Drives
3. On the right side, double-click Enforce drive encryption type on removable data drives.
4. Choose one of these options:

   • Not Configured (or Disabled): Windows will ask you which encryption type to use every time.
   • Enabled: You pick one encryption type below, and Windows will not ask users anymore.
5. Select Full encryption to always encrypt the whole drive.
6. Select Used space only encryption to encrypt only the used space.
7. Disabled: Same as Not Configured; user chooses encryption type.
8. Click OK to save.
9. 🔄 Restart your PC to apply the change.

How to Enforce Encryption Type Using the Windows Registry

Forcing a specific BitLocker encryption type on removable drives can also be done using the Windows Registry Editor, offering an alternative way to set encryption standards directly in your system.

1. ⚠️ Admin privileges required: ⊞ Press Start, type regedit, and open the Registry Editor (run as administrator).
2. Navigate to this key: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE
3. Look for a value named RDVEncryptionType. If it doesn’t exist, create it:

   • Right-click in the right pane → New → DWORD (32-bit) Value
   • Name it RDVEncryptionType
4. Double-click RDVEncryptionType and set its value data to:

   • 1 to enforce Full encryption
   • 2 to enforce Used space only encryption
5. Click OK and close the Registry Editor.
6. 🔄 Restart your computer to apply the change.

Summary

• BitLocker protects your data on removable drives by encrypting it.
• You can choose between full encryption or encrypting only used space.
• You can force a specific encryption type so users won’t be asked every time by using Group Policy or the Registry Editor.
• These steps help keep your data safer with the encryption method you prefer.

BitLocker protects your data on removable drives by encrypting it, and you can choose between full encryption or encrypting only used space.