Windows 11 silently encrypted my data drives, never uploaded the keys, and now the data is gone for good
TL;DR: Windows auto-enabled Device Encryption (BitLocker) on two internal drives without asking, labeled the recovery keys “backed up to Microsoft account”, and never actually uploaded them. Both drives are now permanently locked. Check your drives.
I run a home server on Windows 11 (build 26200). I’d moved it to a local account to keep it isolated from Microsoft services, since it hosts a web UI for friends. I never turned on BitLocker or Device Encryption.
After a hardware rebuild, two of my data drives (a 4TB NVMe and a 500GB SSD) showed as BitLocker-locked. Here’s what I found:
- April 2026: the BitLocker event log shows Windows auto-encrypted both drives, run as SYSTEM (“Device Encryption initialized automatically”). No prompt, no notification.
- Both drives have a recovery key marked “Microsoft account backup.”
- None of my Microsoft accounts have any recovery keys. The event log has no backup event, going back to the day Windows was installed.
- Because the machine was isolated from Microsoft account services, the keys never got uploaded. But Windows labeled them backed up and locked the drives anyway.
- The auto-unlock keys that used to open the drives silently are gone, so the drives are bricked.
Microsoft’s own support pages say they can’t recover or recreate lost BitLocker keys. The data is gone.
The kicker: while I was investigating, re-enabling Secure Boot after a BIOS reset made Windows start silently encrypting two more of my hard drives. I caught it at 12% and reversed it.
Check yours right now. Open an admin command prompt and run:
manage-bde -status
- If any drive shows “Encryption in Progress”, or “Protection Off” with “Key Protectors: None Found”, Windows is quietly encrypting it. Run
manage-bde -off X:to decrypt it. - If any drive shows Protection On, get its recovery key now with
manage-bde -protectors -get X:and save the 48-digit number somewhere off the PC. - Turn off Settings → Privacy & security → Device encryption.
Don’t assume your keys are in your Microsoft account. Mine weren’t.
