Why Microsoft Stores Your Windows 10 Device Encryption Key To OneDrive

0 views

Skip to first unread message

Message has been deleted

Bubba Lual

unread,

Jul 9, 2024, 7:42:24 AM7/9/24

to tabtikartu

Encryption helps protect the data on your device so it can only be accessed by people who have authorization. If device encryption isn't available on your device, you might be able to turn on standard BitLocker encryption instead.

Why Microsoft stores your Windows 10 Device Encryption Key to OneDrive

DOWNLOAD https://miimms.com/2yW2tF

In the search box on the taskbar, type Manage BitLocker and then select it from the list of results. Or, select Start > Settings > Privacy & security > Device encryption > BitLocker drive encryption.

Note: You'll only see this option if BitLocker is available for your device. It isn't available on Windows 11 Home edition.

Device encryption. Device encryption helps protect the data stored on your device by encrypting it using BitLocker Drive Encryption technology. When device encryption is on, Windows automatically encrypts the drive Windows is installed on and generates a recovery key. The BitLocker recovery key for your personal device is automatically backed up online in your personal Microsoft OneDrive account. Microsoft doesn't use your individual recovery keys for any purpose.

OU policy requires device encryption on laptop computers that may store sensitive or confidential information (e.g., SSN and financial information, patient information). For laptops used by OU Health Sciences Center Students, the presumption is that the device may be used for this purpose; therefore, OU policy requires all student devices have the built-in encryption always turned on while you are a Health Sciences Center Student. Students must enable encryption by January 16, 2024. The instructions below outline how to encrypt your device and set it up for encryption management.

Encryption is a technology that protects the contents of your device from unauthorized access by converting it into unreadable code. It is a stronger level of protection than other security features, such as user logins. Device encryption encrypts all existing data and any new data once encryption is enabled; therefore it does not require users to encrypt certain folders or files.

The Intercept has written that if you have bought a Windows PC recently then Microsoft probably has your encryption key. This is a reference to Windows' device encryption feature. We wrote about this feature when it was new, back when Microsoft introduced it in Windows 8.1 in 2013 (and before that, in Windows RT).

The final constraint for Device encryption is that you must sign in to Windows with a Microsoft account or a Windows domain account to turn it on. This is because full disk encryption opens the door to all kinds of new data loss opportunities. If, for example, you have your system's motherboard replaced due to a hardware problem, then you will lose access to the disk, because the decryption keys needed to read the disk are stored in the motherboard-mounted TPM. Some disk encryption users may feel that this is a price worth paying for security, but for an automatic feature such as device encryption, it's an undesirable risk.

To combat that, device encryption stores a recovery key. For domain accounts, the recovery key is stored in Active Directory, but in the common consumer case, using a Microsoft account, it is instead stored in OneDrive. This recovery key can be used after, say, a motherboard replacement or when trying to recover data from a different Windows installation.

It may be true that Microsoft has the decryption keys to your encrypted hard disk if you bought a PC with Windows 10 or Windows 8.1 preinstalled, if it supports device encryption (we still come across machines that for one reason or another don't support it or need reconfiguration to support it), and if you use a Microsoft account to log into Windows. But it isn't a security disaster that they do, and if you aren't happy that they do, it takes no more than a couple of minutes to delete the copy of the key they hold and then update your system to render their key useless. This can be done on any Windows version, even Home.

BitLocker encryption is often intentionally activated by or on behalf of a user with full administrative access to your device. This user could be you, another user, or an organization managing your device. Dell does not enable BitLocker on any device, BitLocker is enabled by the user during setup or domain configuration by an administrator.

A Credentials profile pushes certificates to devices for use in authentication. With Workspace ONE UEM, you can configure credentials for personal, intermediate, trusted root, trusted publisher, and trusted people certificate stores. Learn how to configure a credentials profile to enable authentication for your Windows devices.

With the Encryption profile, you can require the encryption of removable drives for your Windows devices using BitLocker To Go. Select the Enable BitLocker To Go Support check box to enable this feature. Removable drives are read-only until encrypted. By selecting an option in the Encryption Method drop down, you may choose which method to use to encrypt the device.

With Boxcryptor, data is automatically encrypted directly on your device before it is synchronized to the cloud. Microsoft has no access, so they cannot share your data. If your cloud or vault is hacked, attackers will only find encrypted data. At Boxcryptor, our Zero-Knowledge implementation means we cannot access your data either. And best of all, the encryption takes place in the background. Our users can save, edit, share, and move files as usual. Security can be that simple.

Note: If your computer has device encryption or BitLocker encryption enabled, you may need the BitLocker key to reset your computer. If you're unsure about your BitLocker key, please refer to this article: Find my BitLocker recovery key.

BitLocker is a Windows encryption function that helps protect your devices. If you are using Windows 10 or 11 Pro or Education on your personal computer, the installer may automatically enable BitLocker when downloading the Office 365 suite. If you disregard or improperly store the BitLocker data recovery key provided after installation, you could be locked out of your device. The only resolution would be to reformat or replace the hard drive and install a new operating system. This issue does not affect Windows 10 and 11 Home users.

I tried 2 procedures and both of them worked. First, I sysprep the device without installing or run windows updates and it worked. Secondly, I installed all the required microsoft windows updates until there are no more update to be installed and it worked too.