Encryption Enabled By Default or Not?

Hello, all!

I installed Windows 10 on Wednesday. I remember one of the notifications that came up was asking me if I wanted to back up my encryption key.

I'd like to know, is Windows 10 encrypted by default? I read around, and it sounds like Windows 8.1 is, and would like to know for Windows 10. If so, how would one go about disabling this encryption? The only thing I've been able to find about it in the control panels (damn you, Micrsoft... Should've gone back to just one) is BitLocker, which is disabled.

Thanks!
ElectroPulse

P.S. Running Windows 10 Pro 64-bit.

There's no encryption unless you explicitly enable it via BitLocker. Cheers.

There is also file based encryption, where you encrypt files individually. If you have used this feature at some point, Windows have created an encryption certificate for you. It is wise to have a backup of it.

Alright, thank you for the replies!

pal said:

There is also file based encryption, where you encrypt files individually. If you have used this feature at some point, Windows have created an encryption certificate for you. It is wise to have a backup of it.

I've never used encryption before on this computer, and it is a clean install on top of that. Does it just automatically generate one for in case you do?

NoDeX said:

There's no encryption unless you explicitly enable it via BitLocker. Cheers.

Sorry but that isn't correct.

Windows 8.1 introduced Device Encryption which is included in all versions of Windows 8.1 (even the non-Pro version which doesn't have Bitlocker).
http://windows.microsoft.com/en-gb/w...ice-encryption

The catch is that it only works on certain hardware - it has to support something called InstantGo. You won't find this on any old PC, for one thing it needs the operating system to be on a solid state drive. You also need Secure Boot to be there and enabled, and a Microsoft Account with Admin rights, so that it can backup the encryption keys.

But for a tablet or similar, it's quite likely this would be supported. I have a tablet which has Windows 8.1 with Bing, and that is encrypted using this (well I'm temporarily unencrypting it to upgrade to 10 but until yesterday it was encrypted.) It started encrypting itself when I switched on Secure Boot.

I'm assuming Windows 10 is very similar, and therefore if the computer supports InstantGo specification, has Secure Boot and you login with an MSA with admin rights, I'd expect it to start encrypting.

ElectroPulse said:

I've never used encryption before on this computer, and it is a clean install on top of that. Does it just automatically generate one for in case you do?

An EFS certificate is usually created when you encrypt your first file. If you have never done it, it might be a certificate for something else.

Thank you again for the replies!

DavidY said:

Sorry but that isn't correct.

Windows 8.1 introduced Device Encryption which is included in all versions of Windows 8.1 (even the non-Pro version which doesn't have Bitlocker).
http://windows.microsoft.com/en-gb/w...ice-encryption

The catch is that it only works on certain hardware - it has to support something called InstantGo. You won't find this on any old PC, for one thing it needs the operating system to be on a solid state drive. You also need Secure Boot to be there and enabled, and a Microsoft Account with Admin rights, so that it can backup the encryption keys.

But for a tablet or similar, it's quite likely this would be supported. I have a tablet which has Windows 8.1 with Bing, and that is encrypted using this (well I'm temporarily unencrypting it to upgrade to 10 but until yesterday it was encrypted.) It started encrypting itself when I switched on Secure Boot.

I'm assuming Windows 10 is very similar, and therefore if the computer supports InstantGo specification, has Secure Boot and you login with an MSA with admin rights, I'd expect it to start encrypting.

I believe my BIOS has a TPM feature (getting ready to reboot to check), but not secure boot (also will be checking for this), as it was pre-8.

I am indeed logging in with a MS account with admin privileges. Is there any way to visually confirm or deny in settings that there is encryption going on?

pal said:

An EFS certificate is usually created when you encrypt your first file. If you have never done it, it might be a certificate for something else.

I remember it specifically mentioned encryption.

ElectroPulse said:

I believe my BIOS has a TPM feature (getting ready to reboot to check), but not secure boot (also will be checking for this), as it was pre-8.

I am indeed logging in with a MS account with admin privileges. Is there any way to visually confirm or deny in settings that there is encryption going on?

You could look in Disk Management. In the lower panel (where it says Disk 0, etc.) it should tell you if drives are encrypted.

If you don't have Secure Boot, and especially if your hardware is pre-Windows 8, I think it's unlikely that the default encryption is active.

However you would have been able to run Bitlocker as you have the Pro version, but you or someone using the PC would have needed to switch it on.