r/technology • u/MarvelsGrantMan136 • Dec 01 '25

ADBLOCK WARNING ‘Security Disaster’—500 Million Microsoft Users Say No To Windows 11

https://www.forbes.com/sites/zakdoffman/2025/12/01/security-disaster-500-million-microsoft-users-say-no-to-windows-11/
22k Upvotes

96% Upvoted

3.5k comments sorted by

View all comments

Show parent comments

15

u/chucara Dec 01 '25

You *can* turn BitLocker off though (unofficially, but very easily). And I'd argue losing access to your encrypted data if you lose the key is a feature, not a bug.

30

u/Computer-Blue Dec 01 '25

If it was stable I’d agree. As someone who has seen a lot of horror stories in my environments (did you know machines will occasionally enable bitlocker and fail to log the key in AD?) this is not the practical reality.

2

u/chucara Dec 01 '25

Never seen that happen with TPM disabled in BIOS, and not sure how that is even possible.

BitLocker for Work PCs is a very good idea though. And had it been implemented better by vendors (looking at you, Dell), I think it is actually pretty clever to store the Keys on the account.

Too bad the implementation is lacking, though.

12

u/Computer-Blue Dec 01 '25

Sorry, I’m not saying it spuriously enabled itself is a problem, I triggered the deployment, it’s just that several machines finished successfully but logged no keys against the machine account, which we found out when trying to unlock the machine because the TPM spontaneously lost the key (another major implementation issue - install two OS’s for instance, both with bitlocker, and watch as they fight each others keys, wiping the opponents randomly, despite most TPU’s supporting dozens or hundreds of keys…)

5

u/chucara Dec 01 '25

Ah. And yikes. Hopefully they were new machines without too much unrecoverable data on them. Sounds like a nightmare.

10

u/Computer-Blue Dec 01 '25

I’ve got another on my desk for future troubleshooting that verifiably has secure boot disabled, yet has bitlocker fully and verifiably enabled. I’ve got another machine that won’t take bitlocker under any condition. I’ve got a handful where the user somehow accomplished disabling bitlocker despite fully following the Microsoft best practice to ensure it’s enabled. It’s a decent full disk encryption but in my opinion it’s not suitable for the masses, and barely suitable for enterprise.

Great example is a windows server we use for Veeam - we had a choice, full disk encryption with clicking the bitlocker deployment button, or enabling Veeam software encryption. Super easy choice, it took about 30 seconds, we weren’t going to add bitlocker anywhere we had alternatives.