Enforce drive encryption type on removable data drives

Purpose

Show registry keys (1)

• HKLM\SOFTWARE\Policies\Microsoft\FVE\RDVEncryptionType

This registry value belongs to the BitLocker Group Policy setting for removable data drives. It determines the encryption type BitLocker uses when a removable drive is encrypted for the first time:

• 0: Allow the user to choose the encryption type.
• 1: Full encryption. BitLocker encrypts the entire volume, including space that is currently unused.
• 2: Used Space Only encryption. BitLocker initially encrypts only occupied portions of the volume. Data written later is encrypted automatically.

If the associated policy is disabled or not configured, the BitLocker setup wizard offers the user a choice of encryption type.

The value does not turn on BitLocker by itself. It also does not select the encryption algorithm, cipher strength, or permitted unlock methods.

Notes

Security

Used Space Only encryption initially leaves free space unencrypted. On a previously used drive, that space can contain recoverable remnants of data that was stored before BitLocker protection was enabled. Full encryption covers those areas as well and therefore provides stronger protection for repurposed drives.

This particular risk does not apply to a new or reliably sanitized drive: data written after BitLocker is enabled is encrypted even when Used Space Only encryption was selected.

This setting does not independently require removable drives to be BitLocker-protected. It therefore does not prevent an unencrypted drive from being used unless another policy imposes that restriction.

Possible side effects

Full encryption generally takes longer to complete on large or partially occupied drives than Used Space Only encryption. Used Space Only encryption can substantially reduce initial encryption time, particularly for new or mostly empty drives.

Notes

The selection takes effect when BitLocker is enabled for the removable drive. Changing the value does not convert an already encrypted drive to the other encryption type and has no effect while encryption is already in progress.

The policy is not reapplied when a volume is expanded or shrunk. If a volume using Used Space Only encryption is expanded, the newly added free space is not proactively overwritten as it would be with Full encryption.

Microsoft documentation

Microsoft Learn: Configure BitLocker

Microsoft Learn: BitLocker CSP

Microsoft Learn: BitLocker planning guide

See also

• Entry in the reference