How to stop automatic BitLocker Device Encryption during install on Windows 11

Windows 11 now enables Device Encryption automatically during installation.
You can prevent the setup from enabling encryption by creating a custom USB bootable media with Rufus or by modifying the Registry during installation.
Alternatively, you can disable the Device Encryption feature on the Pro and Home editions in the Settings app after installation.

On Windows 11, Microsoft automatically enables encryption during operating system installation for both Pro and Home editions using the “Device Encryption” feature. However, if you prefer not to use this security feature, you have a few workarounds to install the operating system without encryption or to turn it off after setup.

What is Device Encryption?

Device Encryption is a security feature designed to protect your files by encrypting the entire system drive. This ensures your data remains secure and inaccessible to unauthorized users, even if the device is lost or stolen.

On Windows 11, the feature uses the Advanced Encryption Standard (AES) to encrypt documents, photos, and any data on the computer. It converts data into a format that cannot be read without the correct decryption key, helping protect data from unauthorized access.

In the past, computers were required to meet either the Modern Standby or the Hardware Security Test Interface (HSTI) security requirements, but starting with version 24H2 and later, the company is relaxing the requirements to enable encryption on more devices. Also, the latest version of the operating system doesn’t check untrusted Direct Memory Access (DMA) interfaces.

BitLocker vs. Device Encryption

BitLocker and Device Encryption are both security features that provide drive encryption. The difference is that BitLocker is a full-featured encryption tool available only on Windows 11 Pro, Enterprise, and Education.

On the other hand, Device Encryption is a simplified version of BitLocker available on Windows 11 Home and on devices running Windows 11 Pro or higher editions. It provides basic encryption features aimed at consumer devices. Also, this feature only encrypts the installation and secondary drives. It does not encrypt external storage connected to the device.

Why turn off Device Encryption?

Although encryption is always a good idea, there are still valid reasons to disable this feature. Sure, with modern hardware, encryption no longer has the same performance impact, but it can still be a concern for devices with older hardware and on gaming computers.

Another reason I can point out is compatibility, since some applications or peripherals may not work as expected with an encrypted drive. Also, if you have a dual-boot system, you may encounter issues when running Windows alongside Linux on the same computer.

If you frequently move drives between systems or need to use data recovery tools that do not support encrypted drives, having encryption disabled can simplify these processes. Also, while encryption keys are designed to secure data, losing access to these keys can result in permanent data loss.

When BitLocker encryption is enabled automatically during setup, the recovery key is typically backed up to your Microsoft account in the cloud. That means a copy of the key required to unlock your drive is stored on Microsoft’s servers.

Although this design helps prevent permanent data loss if you forget your password, some users may feel uncomfortable knowing an external entity holds a recovery copy. If that raises privacy concerns, you may want to take steps to stop the installation process from turning on encryption by default.

In this guide, I will explain several ways to prevent the Windows 11 setup from encrypting your device and the steps to turn off encryption after installation.

Disable Device Encryption using Rufus
Disable Device Encryption during setup
Disable Device Encryption after installation
FAQs stop Device Encryption on Windows 11

Disable Device Encryption using Rufus

To use Rufus to create a bootable media of Windows 11 that disables encryption, connect a USB flash drive with 8GB of space, and then use these steps:

Open the Rufus page.
Click the link to download the latest version under the “Download” section.
Double-click the executable to launch the tool.
Click the Settings button (third button from the left) at the bottom of the page.
Use the “Check for updates” drop-down menu and select the Daily option under the “Settings” section.
Click the Close button.
Click the Close button again.
Open Rufus again.
(Optional) Under the “Device” section, use the drop-down menu and select the USB flash drive to create the installation media.
Click the down-arrow button (on the right side) and select the Download option.
Click the Download button.
Select the Windows 11 option.
Click the Continue button.
Select the release of Windows 11 to download.
Click the Continue button.
Select the Windows 11 Home/Pro/Edu option.
Click the Continue button.
Select the language of Windows 11.
Click the Continue button.
Select the x64 architecture option.
Click the Download button.
Select the location to save the ISO file automatically.
Choose the “Standard Windows 11 Installation” option under the “Image option” setting.
(Optional) Continue with the default settings after the download.
(Optional) Specify a name for the drive under the “Volume label” setting.
Click the Start button.
Clear all the options (as necessary).
Check the “Disable BitLocker automatic drive encryption” option.
Click the OK button.

Once you complete the steps, you can use the bootable media to perform a clean install of Windows 11 without automatic device encryption.

Disable Device Encryption during setup

To disable encryption during the Windows 11 24H2 installation, use these steps:

Start the PC with the Windows 11 24H2 USB flash drive.
Press any key to continue.
Choose the installation language and format.
Click the Next button.
Choose the keyboard and input method.
Click the Next button.
Select the “Install Windows 11” option.
Check the “I agree everything” option to confirm that this process will delete everything on the computer.
Click the “I don’t have a product key” option.

Quick note: The device will activate automatically if this is a reinstallation. If this is a new computer, you must provide a product key.
Select the edition of “Windows 11” your license key activates (if applicable).
Click the Next button.
Click the Accept button
Select each partition on the hard drive where you want to install the operating system and click the Delete button. (Usually, “Drive 0” is the drive that contains all the installation files.)
Select the hard drive (Drive 0 Unallocated Space) to install Windows 11.
Click the Next button.
Click the Install button.
After the installation, use the “Shift + F10” keyboard shortcut to access the first page of the out-of-the-box experience (OOBE).
Type the regedit command and press Enter to open the Registry.

Browse to the following path in the Registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BitLocker

Right-click the BitLocker key, choose New, and click the “DWORD (32-bit) Value” option.
Confirm the PreventDeviceEncryption name for the DWORD value and press Enter.
Right-click the newly created key and choose the Modify option.
Change the value from 0 to 1.
Click the OK button.
Click the Close (X) button in the Registry app.
Click the Close (X) button in the Command Prompt app.
Continue with the on-screen directions to finish the setup.

After you complete the steps, the installation of Windows 11 will not be encrypted with BitLocker.

Disable Device Encryption after installation

To disable Device Encryption after the Windows 11 installation, use these steps:

Open Settings.
Click on Privacy & security.
Click the Device Encryption page.
Turn off the “Device Encryption” toggle switch.
Click the Turn off button.

Once you complete the steps, Windows 11 will disable encryption on your computer.

If you want to use your computer with BitLocker enabled, it’s recommended to find and back up your recovery key, in case the unexpected happens, you will have a way to recover. If you’re using the full version of BitLocker on Windows 11 Pro, you can back up the BitLocker recovery key from Control Panel.

It’s important to note that many computer manufacturers have been encrypting devices by default for a long time, and the ability to use encryption during installation isn’t new to Windows 11. However, starting with version 24H2, Microsoft will try to enforce the feature more rigorously, even after you reset your computer. However, the security feature won’t turn on automatically when upgrading from an older version to 24H2.

Are you turning off encryption on your computer? Or do you have any questions? Let me know in the comments below.

FAQs stop Device Encryption on Windows 11

Here’s a list of frequently asked questions (FAQs) and answers about preventing the installation setup from turning on encryption on Windows 11.

What is Device Encryption on Windows 11?

Device Encryption is a built-in security feature that automatically encrypts your system drive to protect files from unauthorized access. It uses AES encryption to secure data and, starting with Windows 11 version 24H2, turns on by default during installation on both Home and Pro editions.

Does Windows 11 enable encryption automatically?

Yes, Windows 11 automatically enables Device Encryption during a clean installation on supported hardware. The feature is activated by default on both Home and Pro editions, even if previous hardware requirements such as Modern Standby were not strictly met.

What is the difference between BitLocker and Device Encryption?

BitLocker is the full-featured drive encryption tool available on Pro, Enterprise, and Education editions, while Device Encryption is a simplified version designed for Home and consumer devices. BitLocker offers advanced management options, whereas Device Encryption focuses on automatic protection with minimal configuration.

How do I stop Windows 11 from enabling Device Encryption during installation?

You can prevent automatic encryption by creating a custom Windows 11 USB installer using Rufus and selecting the option to disable BitLocker automatic drive encryption. Alternatively, during setup, you can modify the Registry and set the PreventDeviceEncryption value to block activation before completing OOBE.

How do I turn off Device Encryption after installing Windows 11?

You can disable Device Encryption from Settings by going to Privacy & Security, opening Device Encryption, and turning off the toggle switch. Windows will decrypt the drive in the background, and the process may take time depending on storage size and hardware speed.

Why would someone disable Device Encryption on Windows 11?

Users may disable encryption due to compatibility issues, dual-boot setups with Linux, concerns about recovery key storage in a Microsoft account, or when frequently moving drives between systems. While encryption improves security, certain workflows and older hardware may benefit from it being turned off.

How can I check if Device Encryption is enabled on my Windows 11 PC?

You can verify encryption status by opening Settings and navigating to Privacy & Security > Device Encryption. If the toggle is on, the system drive is encrypted. On Pro editions, you can also check BitLocker through Control Panel or by running the manage-bde -status command in Command Prompt.

What happens if I lose my BitLocker or Device Encryption recovery key?

If you lose the recovery key and your system requires it to unlock the drive, you may permanently lose access to your data. On most consumer devices, Windows 11 automatically backs up the key to your Microsoft account during setup, which allows recovery if you can sign in to that account.

Update February 27, 2027: This guide has been updated to ensure accuracy and reflect changes to the process.