2

I have a Windows 10 Pro machine; the administrator (and only) account is a Microsoft account. I am trying to set up BitLocker to ensure maximum security and safety, even from Microsoft.

I understand that I can choose to disallow BitLocker from saving the recovery key to my Microsoft account.

However, does this option matter at all if my user account is a connected Microsoft account anyway? Microsoft already has my user account password. Couldn't Microsoft just use the actual password (which it has) to decrypt the data (given access to the physical drive) instead of the recovery key?

2

BitLocker is technology to encrypt the disk drive pror ANY software, including OS, try to access it. Your Microsoft account acts on OS level as user credentials and in practice there could be more than one registered user account on one PC. Which automatically make nonsense to mix the encryption key with the user accout. Moreover, normal account password length is between 8 and 12 characters, when BitLocker key is much longer and complex. Finally, but not last, Microsoft provide additional methods of managing BitLocker key in corporate environment through ActiveDirectory, which is a level above your private home usage.

| improve this answer | |
0

Yes that option matters. It allows you to save your key locally. Which I recommend doing rather than putting it in the cloud.

| improve this answer | |
  • Thank you for your reply. Unfortunately, this does not answer my question completely. I see the value in the option apart from a connected Microsoft user account. – Daniel Jan 31 '19 at 6:16
  • I'm confused... let's step back for a second. When one configures bitlocker, they have the option to (more or less, without being pedantic) store the key remotely or locally. If you select the Microsoft Account option, it's going to put it in your OneDrive account. The bitlocker key and the password to OneDrive are not the same (re: "Couldn't Microsoft just use the actual password"). If you select the save to file option, you can put the key on a USB drive and then protect that drive accordingly. – MGoBlue93 Jan 31 '19 at 16:30
  • I understand the rationale for storing the key locally. However, my assumption is that the BitLocker encryption key and the user-account password are related to each other. So, if Microsoft has my user-account password (because it’s a connected Microsoft account), I’m imagining that they could use this information to somehow unlock the BitLocker encryption key and decrypt my files, given access to the physical drive. Obviously, this wouldn’t be a concern with a local non-Microsoft-connected user account. – Daniel Jan 31 '19 at 20:39
  • 1
    @MGoBlue93 I think OP's confusion is around the fact that logging-in to their PC's account (which is linked to a Microsoft account) will give the OP access to the hard-drive. The OP's fear / assumption seems to be that because of that link, Microsoft – if in possession of the hard-drive – would be able to login using the Microsoft account and also gain access (irrespective of where the recovery key was stored). [cont] – TripeHound Oct 28 '19 at 9:40
  • 1
    [cont] My assumption / guess / hope is that would only be possible if you knew the appropriate password (to the PC-account and/or the Microsoft account), and that Microsoft do not know the password. Therefore, they wouldn't be able to access the hard-drive, and that @Daniel's fears are unwarranted (but I don't know enough about Microsoft accounts to be certain...) – TripeHound Oct 28 '19 at 9:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.