4 ms·
You can turn it off without resorting to a local account, although it's non-obvious. GPEdit -> Computer Configuration → Administrative Templates → Windows Comp
by pnw 9mo ago
You can turn it off without resorting to a local account, although it's non-obvious.
GPEdit -> Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption → Operating System Drives → “Choose how BitLocker-protected operating system drives can be recovered”
Repeat for other drives.
- g-b-r 9mo agoI imagine you have to re-encrypt the drive after that, though, for it to have some real effect
- vel0city 9mo agoNo, the actual data encryption key doesn't need to change unless you're very paranoid. The backup key and your normal key is just to decrypt the data encryption key.
- smileybarry 9mo agoNo, you can just revoke and regenerate the recovery key with `manage-bde`.