Encryption, or getting locked out of your own house without the key

I won’t address my opinion of how Microsoft so poorly implemented device encryption on Windows 11 Home here. With that said, for anyone who uses Windows 11 Home, the encryption recovery information is saved to the Microsoft account you signed in with during installation. If you enable encryption (BitLocker) on Windows 11 Pro, save the recovery information to your Microsoft account. In either case, immediately after installation (or enabling BitLocker), in settings access your Microsoft account. On the initial page, scroll down to the Devices section and select β€˜View Details > Manage recovery keys’ or β€˜Manage recovery keys’ (depending on whether you’re running the Home or Pro flavor) for your computer. Your recovery information will be displayed. At the least, copy the 'Key upload date, Key ID, and Recovery Key information to your clipboard, then save it to a secure location.

I use the BitWarden password manager here, and I have it installed on my Windows 11 Pro 25H2 and Garuda Linux installations (I dual-boot) as well as on my Android phone. Because I can access my password vault from my phone if I’m locked out of Windows for any reason, And I need my recovery key to regain access, I can still get to it, so I’ve decided it’s the safest place to keep my recovery information, and I edited the Note space on the Credentials card for the Microsoft email account I signed in with when I installed Windows, and stored my recovery information there.

As always, anticipation of, and preparation for catastrophe is the best way to convert such events to inconveniences, and if you have any questions, please reply.

I hope this helps others,

Ernie

4 Likes

Since you are dual booting I don’t know your reason for keeping Windows, but I realize that there are real reasons for doing so. My recommendation would be to setup a second account, make it an administrator account and delete the Microsoft account. I know that is easier said than done as entails a complete rebuild of the new account.

If you aren’t aware of the free app OOSU10 ( O&O ShutUp10 - O&O Software GmbH ) I would recommend that you install it and check out the amount of data is gong to Microsoft. It is an executable and you can just delete if you decide not to use it. If you decide to use it just select there recommended option and run it. I am a member of a computer club in Washington and we are a 501(c3) that was a Microsoft refurbisher. We would get donated computers check them out ad some software like LibreOffice and give them away to social services organizations in our area. We put that on each machine that we gave away and never had any issues with it. If you decide to use it you need to be sure you have the latest version and run it after every Microsoft update, as thing sometimes get turned off. OOSU10 will give you a list of changes and ask you if you want to put them back, it also creates a restore point before it makes changes if you OK it.

I agree with you an using Bit Warden, good app.

Having someone come in with a computer they just bought at Best Buy is a real problem. The ones we’ve seen here at out clinic have some software added that BB installed and included the price in the cost of the machine. On invoice I remember was for $34 and the invoice was so long that didn’t notice the charge.

3 Likes

Thank you for the link, I’ll check it out. I dual-boot because there are things I enjoy from using both OSes … as well as the satisfaction I get from thwarting many of Microsoft’s unnecessary … β€˜features’, for example, I’ve modified my Windows install drive using Rufus to create a local account as you suggest, but as one of my usual post-install procedures, I sign into my Microsoft account for the benefits it provides, including an easy location to find my encryption recovery info, if needed (such as for copying to the password manager) then immediately after first reboot, I sat One Drive to keep all files locally, and deleted the One Drive app so I’d not be plagued by all their nagging over their so-called One Drive β€˜backup’ ?feature?. I don’t need One Drive because I prefer mega.nz where I get 20GB storage with true zero-knowledge end-to-end encryption with my free account. As for dealing with the encryption recovery keys, my reply is intended to first: inform less technically inclined users who may see it that their computer may have been encrypted without prior notification, and second: To offer my best suggestion for securely storing their recovery information while retaining ready access to it when needed. In my opinion, on laptop computers, I’d recommend full drive encryption for any OS that supports it. That, and the LidLock app that can be downloaded free from C-net can secure your Windows computer’s data from intrusion, even if the device is stolen. As for, every GNU/Linux distribution I’ve used, other than configuring the DE to lock the screen when I close the lid, and choosing to encrypt the drive during system installation, no additional software is required.

2 Likes

You know what you are doing, without knowing anything about where you live and your free time I think you would be an ideal candidate to run a computer clinic. I live in Newcastle WY 70 miles from anywhere. Previously I lived on the North Olympic Peninsula in Washington. We did a similar clinic there and there were quite a few people using it. Same here. I have myself and two other people that work with me and we are at the center on Monday from 1 to 4. There is no computer support here so we deal with Windows, Linux, Android phones and can help a bit with Apple phones. We also do upgrades to peoples’ PC to replace an old mechanical drive with an SSD. We try to find a drive that will work and is reasonable priced and give them a link to where they can buy it and then install it. One of the guys I work with loves to open up laptops.

We will show them Linux Mint if they have a computer that can’t be upgraded to Win 11 and if they decide to try it we will save their data install mint reinstall their data and give them a lesson on how to use Linux. We’ve only had a couple of people come back for a second lesson.

The senior center here runs pretty much on grants, they provide meals and transportation for the members of the community and the clinic has brought in new people and that helps with the numbers that go into the grants. Thy also provide facilities for community functions.

2 Likes

BitLocker is a pain in the A** when dual booting. I brought a laptop off of e-Bay that had WIn 11 already installed and also had BitLocker enable. My daily driver is Linux, so of course I loaded Mint onto the laptop and dual booted.

Win 11 did not like Linux updating grub and would want the BitLocker key in order to boot Windows. After the 2nd time this happen, I turned BitLocker off. No Bitlocker, no further problem booting Windows.

2 Likes

This bitlocker discussion has convinced me that my next computer will be custom built and have no OS.
I want to have a say in anything that refers my computer to anyone on the internet.

1 Like

Don’t know about the e-Bay down under, but e-Bay here in the USA, has loads of PC’s offered with no HDD, no OS.

2 Likes

There are some . Mostly they remove the old HDD, put in a new SSD and install Win.
You can always erase Win.

2 Likes

Exactly how I ran my computer business

That’s what I did with my last two e-bay (au) computer purchases…

A ThinkPad in 2022 and a Dell Optiplex late last year…

Never even booted the installed O/S - just formatted and installed Linux… You can actually get your OEM Windows license from the firmware…

───────┬─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
       β”‚ File: get-win->SWEARING<-info.bash
───────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1   β”‚ #!/bin/bash
   2   β”‚ # query bios/uefi for MS Windows license info : 
   3   β”‚ sudo strings /sys/firmware/acpi/tables/MSDM
───────┴─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

That doesn’t do anything on my main desktop machine as it was put together with different brand new parts by myself and never had windows…

Works on my Dell Optiplex and my Lenovo Thinkpad E495..

I’ve no idea what Windows version I’m entitled to on either… Dunno if it has TPM2 or whatever - I think the Dell came with Win11 - but I never booted it…

3 Likes

Like many others, we put Mint (usually xfce) on recycled machines to be given away.

But, though I don’t like complaining, there are still some niggles. The latest and most trivial is having easy control of screen brightness (usually portables in our case); there is plenty of advice on the web but none of it seems suitable for someone who isn’t at ease with computers. I looked that up because I keep a machine too old and scruffy to be given away, for listening to the radio - and can’t be bothered to find how to make it work with the lid down.

More seriously, there were a couple of fatal bugs last years that caused unease regarding reliability. Mint is entirely FOSS, but it can be difficult for volunteers to organise rapid servicing when so many people now depend on it.

1 Like

The solution is user education. Not easy, but Linux is meant to be used by informed users. It works well in groups at work , but I dont know how you get the general public interested in learning.

1 Like

I was under the impression that Linux is the only OS being considered as a replacement for the ones that are presently causing so much concern, for well-known reasons: mainly Windows, Mac, and Google incluing Android.

Presently, there are too many things preventing one or two desktop Linux distributions becoming mainstream, and I wonder whether introducing a commercial element as in Zorin OS would help tighten things up. Ubuntu is commercially owned, but (as we read here) their free desktop doesn’t yet satisfy everyone - perhaps Canonical could try a more commercial tack for the general public.

As I’ve mentioned, paying fairly small amounts for licences or subscriptions isn’t always straightforward Worldwide.

Of course, we must preserve our strong community of informed users, whether or not they contribute to forums.

1 Like

Yes,but its design is a problem . It was put together for academics and people who like to fiddle. There has never been a lot of thought given to making it foolproof or even easy to learn.

Linux does not try, like Win does, to be everything to everyone , and it does not try to be a β€˜nanny OS’ that protects its user from every contingency. Linux expects the user to contribute something.

So , yes , Linux is an alternative, but it is not a clone.

2 Likes

I disagree with you @nevj . While it certainly was true in the past that Linux is an OS for those who know how to get stuff done, there are quite some distributions which bend over backwards to satisfy the β€œnormal” user. I’d say it’s ready for digital illiterates at this point – more so than Windows, in all actuality.

There are some minor things which need to be adressed, to prevent digital illiterates from panicking, but other than those, I think Linux is mainstream ready. Yesyes, of course only the distributions which actually address the beginner; I’m not talking about Void or Gentoo here.

2 Likes

We only mildly disagree. Yes some distros are trying.
I dont think any OS should be exposed to digital illiterates, I think some education is needed to use a computer.
An OS as sophisticated as Linux has an almost impossible job trying to please everyone… I think a cutdown subset like Android has a much better chance of general success.
Time will tell.

1 Like

But that was the idea of chromebooks

Yes . The best solution for people who do not want to learn is to provide something that requires zero learning. It has to do without the infinite configurability of Linux. It does not need multiuser. It needs automatic networking with no options. It has to be preinstalled.

1 Like

I’ve not run into any fatal bugs that weren’t of my making like installing kernel 7.1.5. If it’s new I’ve got to try it. I have the grub menu show up at startup so I can go back the last working version. I run Cinnamon.

Here is something that I found and it worked on my system for brightness control. It is a set a level and not a slider or key type approach.

  1. Run xrandr | grep " connected" to find your display’s name (e.g., HDMI-1 or eDP-1).

  2. Set your desired brightness level (values range from 0.1 to 1.0, where 1.0 is 100%):

    Bash

    xrandr --output HDMI-1 --brightness 0.8
    
    

(Replace HDMI-1 with your actual display name from step 2).

I’d be interested if you found it useful. I don’t have my laptop handy, I try it later and see if I have the issue.

3 Likes

I believe that is the biggest hurdle to getting people to try Linux. An average Window user has no idea about partitions, creating a bootable OS on a USB stick, or installing an OS.

2 Likes