I have a Windows 10 Pro machine; the administrator (and only) account is a Microsoft account. I am trying to set up BitLocker to ensure maximum security and safety, even from Microsoft.

I understand that I can chose to disallow BitLocker from saving the recovery key to my Microsoft account.

However, does this option matter at all if my user account is a connected Microsoft account anyway? Microsoft already has my user-account password. Couldn't Microsoft just use the actual password (which it has) to decrypt the data (given access to the physical drive) instead of the recovery key?

Forgive me if this question grossly misrepresents the cryptographic process.



Yes that option matters. It allows you to save your key locally. Which I recommend doing rather than putting it in the cloud.

  • Thank you for your reply. Unfortunately, this does not answer my question completely. I see the value in the option apart from a connected Microsoft user account. – Daniel Jan 31 '19 at 6:16
  • I'm confused... let's step back for a second. When one configures bitlocker, they have the option to (more or less, without being pedantic) store the key remotely or locally. If you select the Microsoft Account option, it's going to put it in your OneDrive account. The bitlocker key and the password to OneDrive are not the same (re: "Couldn't Microsoft just use the actual password"). If you select the save to file option, you can put the key on a USB drive and then protect that drive accordingly. – MGoBlue93 Jan 31 '19 at 16:30
  • I understand the rationale for storing the key locally. However, my assumption is that the BitLocker encryption key and the user-account password are related to each other. So, if Microsoft has my user-account password (because it’s a connected Microsoft account), I’m imagining that they could use this information to somehow unlock the BitLocker encryption key and decrypt my files, given access to the physical drive. Obviously, this wouldn’t be a concern with a local non-Microsoft-connected user account. – Daniel Jan 31 '19 at 20:39
  • I'm confused. Is your OneDrive password related to your BitLocker key? They are not. – MGoBlue93 Feb 1 '19 at 22:47
  • Ok, thank you for this clarification. I am surprised, but perhaps I shouldn’t be. I understand you to mean that if party x possessed a drive with encrypted data on it and party x also possessed the user account password used by a Windows 10 account on that drive to encrypt the data on the drive, party x could not somehow use the user account password to derive the encryption key and decrypt the data on the drive. Is this correct? – Daniel Feb 3 '19 at 4:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.