Hi All,

W10-21H2

This one was a new one on me!

I had a customer yesterday with an EXCRUCIATING
slow computer. Okay I was psyched. These
ar fun to fix and the customers shower you
with praise.

I started by disable Fast Boot (fast startup). Didn't
help.

Check Windows logs -- nothings showed.

Check hard drive health -- working perfectly for a
7200 rpm

Prune stale Autoruns - no change.

Remove a bit of junkware - no change

Check running process against Virus Total -- nothing.

Okay since it was boot slow too, I booted into
Fedora Linux to see if it was his hardware or
his OS. Ran like a champ from the Fedora
flash drive.

Whilst in Fedora, I decided to prune his tmp files.
Fedora is a lot fasted at that and no locked files.
What a minute, I can't open his main C: drive. Fedora
says it is encrypted. So into gparted and damned if
that partition is not listed as "bitlocker".

So back into Windows, whilst resisting falling asleep
waiting for it to boot, asked everyone, including
the owner why the drive was encrypted. No one knew and stated that if
someone stole the computer, they would
not care about what was on the hard drive.

Into settings and off with the bitlocker. Waited about
a half hour for the drive to decrypt whilst working
on their other computers.

Problem solved. The dead came back to life. The
customer was very, very pleased.

Just when you think you've seen everything!

:-)

-T

My office computer has full end to end encryption
and it makes zero performance difference. Then
again, it is Fedora Linux and the technology
difference between Windows and Linux is YUGE.

T wrote:

> W10-21H2
>
> I had a customer yesterday with an EXCRUCIATING
> slow computer. Okay I was psyched. These
> ar fun to fix and the customers shower you
> with praise.
> ...
> Okay since it was boot slow too, I booted into
> Fedora Linux to see if it was his hardware or
> his OS. Ran like a champ from the Fedora
> flash drive.
> ...
> Into settings and off with the bitlocker. Waited about
> a half hour for the drive to decrypt whilst working
> on their other computers.
>
> Problem solved. The dead came back to life. The
> customer was very, very pleased.

There is no point in encrypting the software unless you're into
development of software, and store highly sensitive code on your
computer (but, in that case, the company should provide a secure laptop
for you to work on their code when away from work). None of the
software, the OS or any apps you installed, need to be secured as anyone
can get that stuff. It's only the data that needs to be protected, and
only some of it. Instead of using Bitlocker, or another whole-disk
encryption scheme, just use Veracrypt to contain encrypted containers
that you load on-demand when you need to access the sensitive data, and
configure Veracrypt to unload a container when idle for too long, or on
logoff/shutdown. Bitlocker is overkill in most scenarios where *some*
encryption is desired for protection.

https://silicophilic.com/does-bitlocker-slow-down-windows-10/

There are a lot of reasons why Bitlocker will make a computer slow
(search online on "bitlocker slow"), the first of which is that
encryption ALWAYS slows access.

On 2/11/22 17:00, VanguardLH wrote:
> T wrote:
>
>> W10-21H2
>>
>> I had a customer yesterday with an EXCRUCIATING
>> slow computer. Okay I was psyched. These
>> ar fun to fix and the customers shower you
>> with praise.
>> ...
>> Okay since it was boot slow too, I booted into
>> Fedora Linux to see if it was his hardware or
>> his OS. Ran like a champ from the Fedora
>> flash drive.
>> ...
>> Into settings and off with the bitlocker. Waited about
>> a half hour for the drive to decrypt whilst working
>> on their other computers.
>>
>> Problem solved. The dead came back to life. The
>> customer was very, very pleased.
>
> There is no point in encrypting the software unless you're into
> development of software, and store highly sensitive code on your
> computer (but, in that case, the company should provide a secure laptop
> for you to work on their code when away from work). None of the
> software, the OS or any apps you installed, need to be secured as anyone
> can get that stuff. It's only the data that needs to be protected, and
> only some of it. Instead of using Bitlocker, or another whole-disk
> encryption scheme, just use Veracrypt to contain encrypted containers
> that you load on-demand when you need to access the sensitive data, and
> configure Veracrypt to unload a container when idle for too long, or on
> logoff/shutdown. Bitlocker is overkill in most scenarios where *some*
> encryption is desired for protection.
>
> https://silicophilic.com/does-bitlocker-slow-down-windows-10/
>
> There are a lot of reasons why Bitlocker will make a computer slow
> (search online on "bitlocker slow"), the first of which is that
> encryption ALWAYS slows access.

Very good advice.

When I have to take something private to a customer
site, I encrypt with gpg (Linux)

gpg -c foobar.txt

Enter passphrase:
Repeat passphrase:

This will create the file:

foobar.txt.gpg

When I get to the customer's site, I decrypt with

gpg4win

The only reason for full encryption is if someone
bad is going to look at your unused space.
Bleach bit can take care of that too.

On 2/11/2022 9:21 PM, T wrote:
> On 2/11/22 17:00, VanguardLH wrote:
>> T wrote:
>>
>>> W10-21H2
>>>
>>> I had a customer yesterday with an EXCRUCIATING
>>> slow computer.  Okay I was psyched.  These
>>> ar fun to fix and the customers shower you
>>> with praise.
>>> ...
>>> Okay since it was boot slow too, I booted into
>>> Fedora Linux to see if it was his hardware or
>>> his OS.  Ran like a champ from the Fedora
>>> flash drive.
>>> ...
>>> Into settings and off with the bitlocker.  Waited about
>>> a half hour for the drive to decrypt whilst working
>>> on their other computers.
>>>
>>> Problem solved.  The dead came back to life.  The
>>> customer was very, very pleased.
>>
>> There is no point in encrypting the software unless you're into
>> development of software, and store highly sensitive code on your
>> computer (but, in that case, the company should provide a secure laptop
>> for you to work on their code when away from work).  None of the
>> software, the OS or any apps you installed, need to be secured as anyone
>> can get that stuff.  It's only the data that needs to be protected, and
>> only some of it.  Instead of using Bitlocker, or another whole-disk
>> encryption scheme, just use Veracrypt to contain encrypted containers
>> that you load on-demand when you need to access the sensitive data, and
>> configure Veracrypt to unload a container when idle for too long, or on
>> logoff/shutdown.  Bitlocker is overkill in most scenarios where *some*
>> encryption is desired for protection.
>>
>> https://silicophilic.com/does-bitlocker-slow-down-windows-10/
>>
>> There are a lot of reasons why Bitlocker will make a computer slow
>> (search online on "bitlocker slow"), the first of which is that
>> encryption ALWAYS slows access.
>
> Very good advice.
>
> When I have to take something private to a customer
> site, I encrypt with gpg (Linux)
>
>     gpg -c foobar.txt
>
>     Enter passphrase:
>     Repeat passphrase:
>
> This will create the file:
>
>     foobar.txt.gpg
>
> When I get to the customer's site, I decrypt with
>
>     gpg4win
>
>
> The only reason for full encryption is if someone
> bad is going to look at your unused space.
> Bleach bit can take care of that too.

If Bitlocker is using the drive FDE, there will be no
impact on CPU operation. Internal FDE runs at wire-speed.

Windows 7 had Elephant Diffuser, and that would make
it slower.

Windows 10 had Elephant Diffuser removed.

It's possible Windows 11 supports two options, software
Bitlocker and FDE as methods. I don't know if there
is any special command that tells you the FDE option is
available.

There are utilities like manage-bde.exe, bdeunlock.exe ,
repair-bde.exe, but it's hard to see how all of those
could run off C: when there is trouble.

When a customer hard drive fails, the very last thing you
want at scavenging time, is to have all the files ruined
with BitLocker. If you know the customer never makes
backups, taking BitLocker off is probably a good idea.
It's a tech, which is a Power User thing, not something
to "saddle a victim with". We're trying to not make
this a "write once read never" technology.

Paul

On 2/11/22 19:22, Paul wrote:
> On 2/11/2022 9:21 PM, T wrote:
>> On 2/11/22 17:00, VanguardLH wrote:
>>> T wrote:
>>>
>>>> W10-21H2
>>>>
>>>> I had a customer yesterday with an EXCRUCIATING
>>>> slow computer.  Okay I was psyched.  These
>>>> ar fun to fix and the customers shower you
>>>> with praise.
>>>> ...
>>>> Okay since it was boot slow too, I booted into
>>>> Fedora Linux to see if it was his hardware or
>>>> his OS.  Ran like a champ from the Fedora
>>>> flash drive.
>>>> ...
>>>> Into settings and off with the bitlocker.  Waited about
>>>> a half hour for the drive to decrypt whilst working
>>>> on their other computers.
>>>>
>>>> Problem solved.  The dead came back to life.  The
>>>> customer was very, very pleased.
>>>
>>> There is no point in encrypting the software unless you're into
>>> development of software, and store highly sensitive code on your
>>> computer (but, in that case, the company should provide a secure laptop
>>> for you to work on their code when away from work).  None of the
>>> software, the OS or any apps you installed, need to be secured as anyone
>>> can get that stuff.  It's only the data that needs to be protected, and
>>> only some of it.  Instead of using Bitlocker, or another whole-disk
>>> encryption scheme, just use Veracrypt to contain encrypted containers
>>> that you load on-demand when you need to access the sensitive data, and
>>> configure Veracrypt to unload a container when idle for too long, or on
>>> logoff/shutdown.  Bitlocker is overkill in most scenarios where *some*
>>> encryption is desired for protection.
>>>
>>> https://silicophilic.com/does-bitlocker-slow-down-windows-10/
>>>
>>> There are a lot of reasons why Bitlocker will make a computer slow
>>> (search online on "bitlocker slow"), the first of which is that
>>> encryption ALWAYS slows access.
>>
>> Very good advice.
>>
>> When I have to take something private to a customer
>> site, I encrypt with gpg (Linux)
>>
>>      gpg -c foobar.txt
>>
>>      Enter passphrase:
>>      Repeat passphrase:
>>
>> This will create the file:
>>
>>      foobar.txt.gpg
>>
>> When I get to the customer's site, I decrypt with
>>
>>      gpg4win
>>
>>
>> The only reason for full encryption is if someone
>> bad is going to look at your unused space.
>> Bleach bit can take care of that too.
>
> If Bitlocker is using the drive FDE, there will be no
> impact on CPU operation. Internal FDE runs at wire-speed.
>
> Windows 7 had Elephant Diffuser, and that would make
> it slower.
>
> Windows 10 had Elephant Diffuser removed.
>
> It's possible Windows 11 supports two options,  software
> Bitlocker and FDE as methods. I don't know if there
> is any special command that tells you the FDE option is
> available.
>
> There are utilities like manage-bde.exe, bdeunlock.exe ,
> repair-bde.exe, but it's hard to see how all of those
> could run off C: when there is trouble.
>
> When a customer hard drive fails, the very last thing you
> want at scavenging time, is to have all the files ruined
> with BitLocker. If you know the customer never makes
> backups, taking BitLocker off is probably a good idea.
> It's a tech, which is a Power User thing, not something
> to "saddle a victim with". We're trying to not make
> this a "write once read never" technology.
>
>    Paul
good advice!
the customer thinks a former fired employee did it

T wrote:
> Hi All,
>
> W10-21H2
>
> This one was a new one  on me!
>
> I had a customer yesterday with an EXCRUCIATING
> slow computer.  Okay I was psyched.  These
> ar fun to fix and the customers shower you
> with praise.
>
> I started by disable Fast Boot (fast startup).  Didn't
> help.
>
> Check Windows logs -- nothings showed.
>
> Check hard drive health -- working perfectly for a
> 7200 rpm
>
> Prune stale Autoruns - no change.
>
> Remove a bit of junkware - no change
>
> Check running process against Virus Total -- nothing.
>
> Okay since it was boot slow too, I booted into
> Fedora Linux to see if it was his hardware or
> his OS.  Ran like a champ from the Fedora
> flash drive.
>
> Whilst in Fedora, I decided to prune his tmp files.
> Fedora is a lot fasted at that and no locked files.
> What a minute, I can't open his main C: drive.  Fedora
> says it is encrypted.  So into gparted and damned if
> that partition is not listed as "bitlocker".
>
> So back into Windows, whilst resisting falling asleep
> waiting for it to boot, asked everyone, including
> the owner why the drive was encrypted.  No one knew and stated that if
> someone stole the computer, they would
> not care about what was on the hard drive.
>
> Into settings and off with the bitlocker.  Waited about
> a half hour for the drive to decrypt whilst working
> on their other computers.
>
> Problem solved.  The dead came back to life.  The
> customer was very, very pleased.
>
> Just when you think you've seen everything!
>
> :-)
>
> -T

BitLocker default enabled has been around for awhile.
At one time, MSFT Surface devices had Bitlocker enabled OOBE, Secure
Boot was on and TPM chip present. Haven't had a newer on in possession
lately, they may still be.

When an MSA logon was used, the BitLocker recovery key(stored in the TPM
module) was uploaded to the MSA account(account.microsoft.com) in the
device's recovery key setting.
If one, later chose to add a local account, delete the MSA account and
not use the MSA with expiration and subsequent closure by MSFT, the
Recovery key disappeared into the black hole of nothing.

Some OEM's followed the same practice for machines(laptops and tablet
sold as 'business' devices). In these cases the expectation remained
the same - MSA logon(personal, school or work type MSA) to store the
Recovery key that was present in the TPM module on the MSA's online account.

Since, it appears that none of the above was in place on the system you
worked on, the presence of BitLocker being enabled and the fact that
your were able to turn Bitlocker off indicates that the user or someone
with access to the pc enabled Bitlocker and for any possible reason(not
all make sense either).

--
....w¡ñ§±¤ñ