2

I have a Windows 10 Pro machine; the administrator (and only) account is a Microsoft account. I am trying to set up BitLocker to ensure maximum security and safety, even from Microsoft.

I understand that I can choose to disallow BitLocker from saving the recovery key to my Microsoft account.

However, does this option matter at all if my user account is a connected Microsoft account anyway? Microsoft already has my user account password. Couldn't Microsoft just use the actual password (which it has) to decrypt the data (given access to the physical drive) instead of the recovery key?

Improve this question

2 Answers 2

Reset to default
2

BitLocker is technology to encrypt the disk drive pror ANY software, including OS, try to access it. Your Microsoft account acts on OS level as user credentials and in practice there could be more than one registered user account on one PC. Which automatically make nonsense to mix the encryption key with the user accout. Moreover, normal account password length is between 8 and 12 characters, when BitLocker key is much longer and complex. Finally, but not last, Microsoft provide additional methods of managing BitLocker key in corporate environment through ActiveDirectory, which is a level above your private home usage.

Improve this answer
0

Yes that option matters. It allows you to save your key locally. Which I recommend doing rather than putting it in the cloud.

Improve this answer
9
  • Thank you for your reply. Unfortunately, this does not answer my question completely. I see the value in the option apart from a connected Microsoft user account.
    – Daniel
    Commented Jan 31, 2019 at 6:16
  • I'm confused... let's step back for a second. When one configures bitlocker, they have the option to (more or less, without being pedantic) store the key remotely or locally. If you select the Microsoft Account option, it's going to put it in your OneDrive account. The bitlocker key and the password to OneDrive are not the same (re: "Couldn't Microsoft just use the actual password"). If you select the save to file option, you can put the key on a USB drive and then protect that drive accordingly.
    – MGoBlue93
    Commented Jan 31, 2019 at 16:30
  • I understand the rationale for storing the key locally. However, my assumption is that the BitLocker encryption key and the user-account password are related to each other. So, if Microsoft has my user-account password (because it’s a connected Microsoft account), I’m imagining that they could use this information to somehow unlock the BitLocker encryption key and decrypt my files, given access to the physical drive. Obviously, this wouldn’t be a concern with a local non-Microsoft-connected user account.
    – Daniel
    Commented Jan 31, 2019 at 20:39
  • 1
    @MGoBlue93 I think OP's confusion is around the fact that logging-in to their PC's account (which is linked to a Microsoft account) will give the OP access to the hard-drive. The OP's fear / assumption seems to be that because of that link, Microsoft – if in possession of the hard-drive – would be able to login using the Microsoft account and also gain access (irrespective of where the recovery key was stored). [cont]
    – TripeHound
    Commented Oct 28, 2019 at 9:40
  • 1
    [cont] My assumption / guess / hope is that would only be possible if you knew the appropriate password (to the PC-account and/or the Microsoft account), and that Microsoft do not know the password. Therefore, they wouldn't be able to access the hard-drive, and that @Daniel's fears are unwarranted (but I don't know enough about Microsoft accounts to be certain...)
    – TripeHound
    Commented Oct 28, 2019 at 9:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .