Back in January Microsoft encrypted all my hard drives without saying anything. I was playing around with a dual boot yesterday and somehow aggravated Secureboot. So my C: panicked and required a 40 character key to unlock.
Your key is backed up to the Microsoft account associated with your install. Which is considerate to the hackers. (and saved me from a re-install) But if you've got an unactivated copy, local account, or don't know your M$ account credentials, your boned.
Control Panel > System Security > Bitlocker Encryption.
BTW, I was aware that M$ was doing this and even made fun of the effected users. Karma.
I mean, not Windows user lives in a nursing home. I wish! But some lose laptops on the train, and some even throw their computers away!
Sure, most of the risk is remote through emails etc. Maybe you're right. Maybe the balance is better the other way round: let all Windows Home users' computers stay unencryptedv at rest, and keep encryption for Pro users. I grew up with a high focus on security; maybe I'm paranoid.
But phones are all encrypted these days. Obviously they're more mobile and at more risk, but that suggests to me that laptops are subject to similar, if smaller, risks.
But wtf, all thiefs want is the device, why do they want photos of her grandson?
Is this serious? Grandsons' photographs are not the only thing non-tech-savvy people keep on their laptops. Microsoft's policies are not targeting this grandma specifically.
Ok then why are we discussing this scenario specifically?
Because you asked.
I get it, but as someone who has had to tell little old ladies their data is fucked, I am beyond pissed at Microsoft's implementation. They should not be encrypting data without forcing lay people to have backup codes printed or on a flash drive or something.
They're doing this because they want to force people to her Microsoft accounts, probably just to collect more data.
And for the record, I am very pro encryption The half assed way of encrypting even if there isn't a Microsoft account connected and therefore no way to save keys somewhere is completely unacceptable
That's fair.
(Though, small point, I think you can get the encryption keys to save even without a Microsoft account? Digging in regedit or something?)
So if the device is functional you can use the manage-bde command in command prompt to disable. But that's only if the original motherboard is functional, because the key is stored in the TPM chip on the board.
That's the problem I personally deal with, someone spills soda on their laptop or something, usually that sucks but I can get the data. With bitlocker and no account? Data is gone gone