In a move that confirms privacy advocates’ long-held fears, Microsoft has reportedly handed over BitLocker encryption keys to the FBI, allowing federal agents to unlock the laptops of suspects in a fraud investigation without their consent.
The disclosure reveals a critical issue in how modern Windows devices handle security: convenience often comes at the cost of privacy. While BitLocker is designed to make your data unreadable to third-parties, the default settings on millions of Windows 11 PCs automatically upload the recovery key to Microsoft’s servers—creating a lawful “loophole” when served with a valid warrant.
For the suspects, this meant their encrypted hard drives were an open book. But for the average user, it serves as a grim reminder: if your recovery key lives in the cloud, Microsoft holds the master key to your digital life. Anyone else who may gain access, think malicious hackers, may also.
The good news? You can revoke their access today—if you know where to look.
Checking the status

If you do use computers with Windows 11 and a Microsoft account, chance is that BitLocker is used on the device and that the encryption keys are synced to the connected cloud storage.
The best way to find out if that is the case already is the following:
- Open a web browser on your computer.
- Navigate to https://account.microsoft.com/devices/recoverykey.
- Sign-in to your Microsoft account (the same that you use to sign-in to Windows)
The page that opens displays all connected devices, dates, and the Bitlocker recovery key. These keys can be used to decrypt hard drives encrypted by BitLocker.
Tip: You can delete any instance here with a click on the menu icon next to an item and the selection of delete.
You can also check the status of the active computer in the following way:
- Open Start.
- Type CMD.
- Select “run as administrator” while Command Prompt is selected.
- Paste or write manage-bde -status and press the Enter-key.
Check the conversion status to find out if a drive of the computer is encrypted.
Prevent the upload of recovery keys

The easiest option, by far, is to rely solely on local accounts on Windows 11. Since local accounts are not linked to a Microsoft account, they do not sync data to the cloud. However, it is necessary to make sure that the local account is created during the initial setup.
Another option is to avoid BitLocker altogether and use a third-party — trusted — encryption software, such as VeraCrypt instead.
For that, you have to disable BitLocker on each Windows machine. Here is how you disable it on the active machine.
Notes:
- Turning off will take some time. Windows begins decrypting the selected hard drive. It can take minutes to hours, depending on the size of the drive / partition and the speed of the PC.
- You can keep using the computer. While Windows decrypts the drive in the background, you can keep on using it. It may be a bit slower than usual though.
- Keep the PC turned on during the entire process. Ideally, you keep the PC on until the decryption of the drive completes. Keep the Control Panel open or check the notification area for status updates.
- If “turn off” is not available, you are either not logged in as an administrator or there is a policy in place that prevents you from making changes.
Method 1:
- Open the Start menu and click on the Settings icon.
- Select Privacy & security in the Settings app.
- Look for Device encryption.
- If you do not see the option, skip the process and check method 2 below.
- Click on Device Encryption.
- Toggle the feature to Off.
- Confirm the choice by selecting turn off again.
Method 2:
- Press the Start button.
- Type Manage BitLocker and select the result.
- Check all drives listed on the Control Panel page that opens.
- If you see “BitLocker Off” next to a drive, the encryption is disabled.
- Select “Turn off BitLocker” for each drive with “BitLocker on”.
- Confirm your choice by selecting “Turn off BitLocker” again.
Method 3: The Pro-method
- Right-click on the Start menu, select Terminal (Admin).
- Type the command manage-bde -off C: and press the Enter-key.
- Note: replace C: with the drive letter that you want to disable BitLocker for









