For a few months now, many professionals and business users have been reporting the appearance of a strange one error 65000 with BitLocker, the well-known solution integrated into Windows that allows you to encrypt partitions, volumes and entire systems. Now, after a series of checks, Microsoft has confirmed the existence of the problem which seems to affect the machines managed through BitLocker Configuration Service Provider (CSP).
CSP is a software component that offers a set of configurations and settings managed via MDM (Mobile Device Management) or other centralized device administration solutions. BitLocker CSP contains a set of parameters that help control and customize the behavior of BitLocker on a Windows device. These parameters can be used to implement security policiesdefine cryptographic options, enable or disable certain BitLocker features, and more.
What causes error 65000 with BitLocker?
Microsoft explains that in network environments where BitLocker CSP is in use, i sistemi client such as Windows 11 22H2, Windows 10 22H2, Windows 11 21H2, Windows 10 21H2 and Windows 10 Enterprise LTSC 2019 can expose error 65000. The systems affected by the issue are those that use data encryption policies con BitLocker quali FixedDrivesEncryptionType e SystemDrivesEncryptionType.
Both policy allow you to configure the type of encryption used by BitLocker drive encryption. The full encryption allows you to request encryption of the entire unit; the encryption of only the space used is limited to intervening on the data actually stored. The difference is that in the first case, the preference affects the various storage units connected to the system; in the second, however, on thesystem unit where Windows 10 or Windows 11 is installed.
However, the error 65000 problem does not affect any version of Windows Server.
How to Fix BitLocker Error 65000
At present, Microsoft has not yet released any corrective update. Technicians are currently working to remedy the situation but the company does not share a date for the possible release of the patch.
In the meantime, the company led by Satya Nadella limits itself to recommending simply deactivating the policy in question, until the problem is resolved.
The operation can also be carried out by Microsoft Intune, cloud-based device and application management platform. Intune allows IT administrators to manage centrally devices and applications within an organization, facilitating device security and compliance operations.
In this case, the settings to be set to “Not configured” are the following two: “Apply drive encryption type to fixed data drives” and “Apply drive encryption type to operating system drives.”
What you can do with BitLocker CSP
Using BitLocker CSP, the IT administrators can centrally define and enforce BitLocker configurations on managed devices within an enterprise environment. System and network administrators can specify the encryption algorithm and related options key managementrequire a password to boot the operating system, configure recovery options, establish integration with the TPM chip.
In this regard, we remind you that it has become essential to set a PIN in BitLocker: bypassing BitLocker and unlocking the system, with the consequent possibility for an attacker to access potentially confidential data, is possible with a logic analyzer and a rather economical equipment. This is if BitLocker relies only on the chip TPM and, therefore, the encryption key travels in clear text between this component and the processor.
