Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / How Windows 11 Is Forcing Enterprises to Rethink SSD Encryption
Transcript
- Lucas: So there's this change in Windows 11 24H2 that's been quietly causing headaches in enterprise IT departments, and it has to do with how the OS handles encryption on NVMe SSDs. Luna: I've seen some chatter about that — something about hardware encryption being mandatory now? Lucas: Exactly. Starting with 24H2, Windows 11 requires storage devices to support hardware-based encryption — specifically the IEEE 1667 standard — and if they don't, BitLocker falls back to software encryption, which can tank performance. But the bigger issue is that many enterprise NVMe drives that shipped in the last three or four years either don't support it properly or have buggy firmware implementations. Luna: And 'don't support it properly' means what, exactly? Drives that claim compliance but then cause problems? Lucas: Right. Microsoft's eDrive protocol, which is the BitLocker interface for hardware encryption, has been around since Windows 8. But adoption was spotty. A lot of OEMs and SSD vendors opted for software encryption to save on cost or complexity. Now Microsoft is forcing the issue. If your drive doesn't have a certified eDrive controller, Windows 11 will refuse to enable hardware encryption at all. Luna: So what happens to the IT department that has a fleet of, say, 2021-era Dell Latitudes with Samsung PM9A1 drives? Lucas: Those drives do support hardware encryption, but the firmware might not be updated to the latest IEEE 1667 spec. In practice, we're seeing three failure modes. First, BitLocker reverts to software encryption, which uses CPU cycles and can slow boot times by 20 to 30 percent. Second, some drives initialize with a blank password or an unexpected key, causing recovery key prompts — users get stuck at the BitLocker recovery screen. Third, and this is the scary one, some firmware implementations have bugs that corrupt the encrypted volume when the drive enters a low-power state. Luna: That last one sounds like a data loss scenario. Lucas: It absolutely is. There's a known issue with certain SK Hynix drives where if the device goes to sleep and wakes up, the encryption key gets scrambled. The system can't unlock the drive, and the only recovery is to reimage the machine. IT teams are starting to realize that their SSD inventory is effectively incompatible with Windows 11, at least in the configuration they're using. Luna: And Microsoft's stance is that this is a security improvement, not a bug. Lucas: Yes. The justification is that hardware encryption is faster and more secure because it isolates the encryption process from the host CPU. With software-based BitLocker, the encryption keys are stored in memory, which is vulnerable to cold boot attacks or dma based extraction. Hardware encryption keeps the keys inside the SSD controller, which is a separate chip. So from a security architecture standpoint, Microsoft is right. Luna: But the deployment reality doesn't match the ideal. Lucas: Right. Enterprises that standardized on a particular SSD vendor three years ago are now finding out that those drives aren't compatible. And it's not just about upgrading firmware — in some cases, the controller silicon itself is too old. The IEEE 1667 standard requires specific NVMe command sets that older controllers don't implement. So the only fix is to replace the drive. Luna: Which is a big cost, especially if you have thousands of machines. Lucas: Huge. We're talking maybe fifty to a hundred dollars per drive, plus the labor to swap them. And if the devices are still under warranty, the OEM might cover it, but many organizations are seeing this as an unplanned expense in their 2026 budget. I've heard from one IT manager at a mid-sized financial firm — they have about 4,000 laptops, and about 1,200 of them have drives that fail the eDrive check. That's potentially 60 grand in drive replacements alone. Luna: And the alternative — keeping those machines on Windows 10 — is also closing, since Windows 10 reaches end of life in October 2025. Lucas: Which is exactly the bind Microsoft wants. They're using the hardware encryption requirement as another lever to force hardware refresh. It's the same playbook as the TPM 2.0 requirement for Windows 11. Each new feature update ratchets up the hardware baseline. Luna: So what should IT departments be doing right now to assess this? Lucas: First, run the 'manage-bde -status' command on a sample of machines to see what encryption method BitLocker is using. If it says 'xts aes' with a number, that's software encryption. If it says 'Hardware Encryption' and lists the drive model, you're good. Second, check the SSD vendor's compatibility list for eDrive. Samsung, Western Digital, and Micron all have published lists. Third, test a pilot group with the 24H2 update before rolling out broadly — the failure modes I mentioned show up quickly. Luna: And what about the Pluton security chip that Microsoft is pushing? Does that tie into this? Lucas: It does. Pluton is Microsoft's own security processor, built into the CPU, that handles encryption keys and credential storage. Some of the newer AMD and Intel chips with Pluton can act as a bridge for drives that don't have full eDrive support. But that's a workaround, not a solution. And it only works with drives that implement the NVMe TCG Opal standard. So it's another layer of compatibility to check. Luna: It feels like every Windows 11 update adds another thing IT has to test before deploying. Lucas: Absolutely. And this one is particularly tricky because it's invisible — the user might not notice until they hit a recovery key prompt at 8 AM on a Monday. Then it becomes a fire drill. Luna: Speaking of which, I want to circle back to something you said earlier about boot times. Is there any data on how much slower software encryption is? Lucas: There is. Microsoft's own documentation says hardware encryption can achieve up to 5,000 megabytes per second throughput, while software encryption tops out at around 3,000 on modern CPUs. But the real impact is on small random reads — which is what happens during boot. We've seen tests where software encryption adds 8 to 12 seconds to the boot sequence. On a fleet of thousands of machines, that adds up to a lot of wasted time. Luna: And for power users or developers who run virtual machines, the performance hit is even bigger. Lucas: Exactly. If you're running multiple VMs on a single SSD, software encryption means the CPU is doing double duty — encrypting and decrypting every I/O operation. That can lead to stuttering and longer compile times. In a development environment, that's a productivity loss. Luna: So what's the takeaway for someone listening who's in IT and hasn't dealt with this yet? Lucas: Don't wait until the 24H2 update hits your pilot group. Start auditing your drive inventory now. Identify which models are certified for eDrive. For drives that aren't, plan for replacement or at least have a firmware update strategy. And if you're buying new PCs, specify in your procurement that the SSDs must be Windows 11 eDrive certified. That way you're not caught off guard two years from now. Luna: That's a concrete action item. I think a lot of IT teams are still focused on app compatibility and printer issues — they might not be looking at the storage layer. Lucas: Right. And the storage layer is where the data lives. If you can't reliably encrypt it, you have a compliance problem. This is one of those changes that seems small but has huge downstream effects. Luna: If today's conversation gave you something useful — a command to run, a checklist item, or just a heads-up — that's the kind of deep dive we try to bring every week. And if you find value in that, listener support is what keeps these episodes ad-free and independent. You can help out at buy me a coffee dot com slash fexingo. It's a small gesture that goes a long way. Lucas: Yeah, and we really appreciate it. It's what lets us spend the time chasing down these specific, nitty-gritty details that matter to people actually managing Windows environments. Luna: Exactly. Now back to the encryption story — one more thing I'm curious about: are there any third-party tools that can help IT manage this transition? Lucas: There are. Dell and Lenovo both have firmware update utilities that can check and update eDrive compatibility. For broad inventory management, tools like ManageEngine Endpoint Central or Microsoft Intune can report on the encryption method used by each device. You can set up a compliance policy in Intune that flags any machine using software encryption, then remediate with a firmware update or a drive replacement. But the key is knowing what you have. Luna: And for smaller IT shops without a big management stack? Lucas: PowerShell. You can write a simple script that runs 'Get-BitLockerVolume' on each machine and logs the EncryptionMethod. Then export that to a CSV. It's not fancy, but it works. Luna: Good. So there's a path forward, even if it requires some legwork. Lucas: Absolutely. The bottom line is: know your storage hardware, test before you deploy, and budget for the possibility that some of your drives are going to need swapping. Microsoft isn't backing down on this one.