Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To force software-based BitLocker encryption on new USB sticks, SD cards, external hard drives, and other BitLocker To Go media, disable Configure use of hardware-based encryption for removable data drives in Group Policy. Open Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Removable Data Drives, set the policy to Disabled, apply it before enabling BitLocker, and then encrypt the drive. Microsoft states that disabling this setting prevents BitLocker from using hardware-based encryption and makes software-based encryption the default.
This setting does not convert a drive that is already encrypted. Existing media keep their current encryption method; converting one requires decrypting it and encrypting it again after the policy is effective.
As an Amazon Associate I earn from qualifying purchases.
How do you force software-based BitLocker encryption on a removable drive?
The change is made in Group Policy, not in the regular BitLocker control panel. Configure the policy before BitLocker is turned on for the removable volume.
- Open the applicable Local Group Policy Editor or a domain Group Policy object used by the computers that will encrypt the drives.
- Browse to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Removable Data Drives.
- Open Configure use of hardware-based encryption for removable data drives.
- Select Disabled, then apply and close the policy editor.
- With the policy in effect, enable BitLocker on the removable drive using BitLocker To Go. New encryption will use the software implementation rather than the drive’s hardware encryption.
Microsoft’s policy description is explicit: "If you disable this policy setting, BitLocker can’t use hardware-based encryption with removable data drives, and BitLocker software-based encryption will be used by default when the drive is encrypted."
Popular on Amazon
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
The setting is documented as a Group Policy control and is not available through the BitLocker configuration service provider (CSP). If your organization manages Windows through a mobile-management profile alone, this particular hardware-versus-software switch still requires an applicable Group Policy configuration.
What exactly does this policy cover?
The policy applies to removable data drives, the category used by BitLocker To Go. It is not a general switch for every BitLocker volume in Windows.
- USB flash drives: Removable USB storage is a primary BitLocker To Go use case.
- SD cards: Cards presented to Windows as removable data media are included.
- External hard drives: USB-connected removable hard drives fall within the documented scope.
- Other removable drives: The classification Windows assigns to the device matters; the policy is for removable data drives, not fixed internal disks.
Microsoft lists NTFS, FAT16, FAT32, and exFAT among the supported file systems for these removable drives. The policy determines which encryption implementation BitLocker uses when protection is newly enabled; it does not change the drive’s file system or reformat it by itself.
What is the difference between hardware and software BitLocker encryption?
Both approaches protect the removable volume with BitLocker, but the cryptographic work is performed in different places. A hardware-capable drive can encrypt and decrypt data in its own controller. With software-based BitLocker, Windows performs the cryptographic operations.
| Comparison | Hardware-based encryption | Software-based encryption |
|---|---|---|
| When it is selected | Used when the removable drive supports hardware encryption and policy permits it. | Used by default for new removable-drive encryption when the hardware-encryption policy is disabled. |
| Where cryptography runs | In the drive’s controller; keys remain on the drive and authentication occurs before unlock. | In the Windows software stack on the computer accessing the drive. |
| Performance and power | Microsoft describes hardware offload as capable of full data-rate operation with lower CPU and power use. | Does not use that drive-level offload, so the computer may spend more CPU time and power on encryption work. |
| Administrative control | Permitted or blocked by the removable-drive hardware-encryption Group Policy setting. | Selected for new encryption when that setting is disabled. |
| Cipher selection | Uses the algorithm selected by the drive at partition time; the ordinary BitLocker cipher policy does not control it. | Can follow the applicable software BitLocker encryption-method policy. |
| Changing the method later | Not changed merely by editing policy after the volume is encrypted. | Requires a new encryption operation if an existing volume used the other method. |
Disabling hardware use is therefore an administrative consistency choice, not a claim that software encryption is universally faster or more secure. It gives an organization a predictable Windows-based encryption path across supported removable media, while giving up the performance and power advantages Microsoft associates with hardware offload.
Also popular on Amazon
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
When does the policy take effect?
Most BitLocker policies are enforced when BitLocker is initially enabled. Changing the setting later does not restart encryption or silently convert a protected volume. A drive encrypted while hardware use was allowed remains hardware-encrypted even after an administrator subsequently disables the policy.
Plan the order of operations carefully:
- Set the Group Policy to Disabled.
- Allow the policy to apply to the computer that will perform the encryption.
- Only then turn on BitLocker for the new removable drive.
If the drive was already protected, treat it as a separate migration. Back up important files, decrypt the volume using your organization’s approved BitLocker procedure, confirm that the software-encryption policy is effective, and enable BitLocker again. Decrypting and re-encrypting can take substantial time on large media, so schedule the work when the drive can remain connected and powered. The policy edit alone is not a migration command.
How do you convert an existing hardware-encrypted USB drive?
There is no in-place policy switch that changes the encryption implementation of an already protected removable volume. Use a controlled decrypt-and-re-encrypt workflow instead.
1. Identify the drive and protect its contents
Confirm that you are working on the intended removable volume, and make a separate backup of any data that cannot be replaced. Keep the recovery information available before changing protection.
2. Decrypt the existing BitLocker volume
Use the normal BitLocker management workflow approved for your Windows edition and organization. Wait for decryption to finish; do not remove the drive during the operation.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteAlso popular on Amazon
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
3. Apply the software-encryption policy
Set Configure use of hardware-based encryption for removable data drives to Disabled in the applicable Group Policy scope. Do this while the volume is unencrypted, before starting BitLocker again.
4. Encrypt the drive again
Enable BitLocker To Go on the removable volume. Because the policy is now effective, the new encryption uses software-based BitLocker.
This workflow follows Microsoft’s documented timing rule: policy changes affect how BitLocker is configured when protection is enabled, not how an already encrypted volume is re-encrypted in place.
Which BitLocker policies are commonly confused with this setting?
Control use of BitLocker on removable drives
Control use of BitLocker on removable drives governs whether users may apply BitLocker to removable media and whether they may suspend or decrypt protection. It does not choose hardware versus software encryption. A computer can have this control configured and still need the separate hardware-encryption policy to force software encryption.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose drive encryption method and cipher strength
The ordinary Choose drive encryption method and cipher strength policy is also separate. Microsoft states that it does not govern hardware-based encryption; a hardware-encrypted drive uses the algorithm selected by the drive at partition time. Disabling hardware use is therefore the relevant step when the requirement is specifically to make new removable volumes software-encrypted.
Also popular on Amazon
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
How should administrators deploy the setting in a domain or on a standalone PC?
Use the same policy path, but choose the editor that matches your management model.
- Standalone computer: Configure the setting in the local Group Policy editor before users encrypt removable media.
- Domain-joined computers: Place the setting in the domain Group Policy object that applies to the target computers, then ensure the policy reaches those computers before BitLocker is enabled.
- Mixed environments: Keep the policy definition and the encryption timing consistent. A drive encrypted on a computer before the setting arrives will not be converted when the setting later appears.
Document the intended state as part of your removable-media procedure: hardware encryption is disabled, new BitLocker To Go volumes use software encryption, and existing volumes require a separate migration. Because Microsoft documents this control as GPO-only rather than CSP-based, do not assume that a mobile-management BitLocker profile contains an equivalent setting.
What should you check if a new drive still appears to use hardware encryption?
Work through the timing and scope checks before changing unrelated BitLocker settings.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Was the drive already encrypted? If yes, the policy change does not convert it. Decrypt and re-encrypt it under the effective policy.
- Was the policy disabled before encryption began? If the drive was encrypted first and the policy was changed afterward, its original method remains.
- Is the device actually a removable data drive? The setting targets the BitLocker To Go removable-data class. A fixed disk follows different policy scope.
- Is the policy applied to the computer doing the encryption? A setting in an unrelated local or domain scope cannot affect the operation until it is effective on that computer.
- Are you changing the cipher-strength policy instead? That policy does not disable hardware encryption. Confirm that the specifically named hardware-based-encryption setting is set to Disabled.
Do not infer the encryption method solely from the drive’s advertised transfer speed. The decisive factors are the drive’s capabilities, the policy state at the time BitLocker was enabled, and whether the volume was previously encrypted.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Is forcing software encryption worth the performance cost?
The answer depends on the reason for standardizing the implementation. Microsoft describes hardware-encrypted drives as reducing CPU and power use because cryptographic processing is offloaded to the drive, and they can operate at the drive’s full data rate. Blocking hardware use may remove those benefits, particularly during large transfers or on systems with limited processing headroom.
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Administrators may still prefer software encryption when they need a uniform Windows-controlled baseline across different removable-drive models. The policy also avoids relying on each drive’s own hardware algorithm selection, since the normal BitLocker cipher policy does not control hardware encryption. Weigh that consistency against the expected CPU, power, and throughput impact on the computers that will use the media.
What is the correct operational checklist?
- Confirm that the requirement concerns BitLocker To Go removable data drives.
- Open the Group Policy path under Removable Data Drives.
- Set Configure use of hardware-based encryption for removable data drives to Disabled.
- Apply the policy before enabling BitLocker on each new drive.
- Record that the setting is Group Policy-based and unavailable through the BitLocker CSP.
- Handle already encrypted media through a deliberate decrypt-and-re-encrypt operation.
- Keep the separate BitLocker-use and cipher-strength policies aligned with, but distinct from, this hardware-encryption decision.
Frequently Asked Questions
Does disabling hardware encryption affect BitLocker on an internal Windows drive?
No. The setting is scoped to removable data drives used by BitLocker To Go. Internal fixed volumes are outside this particular policy path and require the policies intended for fixed operating-system or data drives.
Can a BitLocker CSP profile replace this Group Policy setting?
Microsoft documents this hardware-encryption control as available through Group Policy and not through the BitLocker CSP. A management system using only CSP settings therefore cannot provide this exact switch.
Will changing the cipher algorithm force a removable drive to use software encryption?
No. The cipher-strength policy is separate, and Microsoft says it does not apply to hardware-based encryption. To force software encryption, disable the dedicated hardware-based-encryption policy before enabling BitLocker.
Why would two identical USB drives use different encryption methods?
The method is determined when BitLocker is initially enabled. One drive may have been encrypted before the policy was disabled, while the other was encrypted afterward, so changing the policy does not make their existing methods match automatically.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems
