Windows 11 24H2 BitLocker SSD Slowdown: Benchmarks & How to Disable Software Encryption (2026 Guide)

Starting with Windows 11 Version 24H2, Microsoft quietly enabled BitLocker device encryption by default on both Windows 11 Pro and Windows 11 Home editions during clean installations and major feature updates. While encryption enhances data security on lost or stolen laptops, the default implementation relies on software-based XTS-AES 128 encryption executed by the CPU. On modern PCIe 4.0 and PCIe 5.0 NVMe solid-state drives, this overhead creates a massive performance penalty—slashing random and sequential write speeds by up to 45%.

Storage Benchmarks: Software BitLocker vs. Hardware Encryption vs. Unencrypted

Independent testing across high-performance drives including the Samsung 990 PRO (PCIe 4.0) and Crucial T705 (PCIe 5.0) confirms that software BitLocker throttles high-queue-depth storage operations. Every data block written to disk must be processed through the Windows kernel encryption filter driver before reaching NVMe flash memory.

Why Windows 11 Defaults to Software Encryption Over Hardware OPAL

Virtually all high-end NVMe solid-state drives include dedicated hardware cryptographic processors compliant with the TCG Opal 2.0 standard. Hardware encryption offloads cryptographic tasks directly to the SSD controller, producing zero CPU overhead and zero bandwidth degradation.

However, following historical vulnerabilities in certain third-party SSD firmware encryption implementations, Microsoft made the decision in Windows 10 and reinforced it in Windows 11 to force software-only encryption (XTS-AES) by default. When 24H2 auto-encrypts during setup, it ignores your drive's hardware engine and routes every storage read/write request through the CPU kernel.

Step-by-Step: How to Check If Your Drive Is Affected

You can verify your current BitLocker encryption status and encryption method within 10 seconds:

1. Right-click the Windows Start Menu and select Terminal (Admin) or PowerShell (Admin).
2. Run the following command:

   manage-bde -status c:

3. Inspect the output fields:
   • Conversion Status: If it states "Fully Encrypted" or "Encryption in Progress", BitLocker is active.
   • Encryption Method: If it shows XTS-AES 128 or XTS-AES 256, your drive is suffering from software CPU overhead.

How to Disable BitLocker and Restore Maximum NVMe Speed

For desktop gaming rigs, home workstations, and video editing workstations where physical drive theft is not a realistic threat vector, disabling BitLocker immediately restores peak sequential and random storage speeds:

1. In PowerShell (Admin), execute the decryption command:

   manage-bde -off c:

2. Windows will begin decrypting the drive in the background. You can monitor the decryption progress in real time with:

   manage-bde -status c:

3. Depending on your SSD capacity and used space, decryption takes between 3 to 15 minutes. Once Conversion Status reports "Fully Decrypted" and Protection Status reports "Protection Off", full factory storage throughput is completely restored.

Preventing Windows 11 24H2 from Auto-Encrypting on Clean Install

If you plan to perform a clean installation of Windows 11 24H2 via USB installation media, you can prevent auto-encryption from initiating during the setup wizard:

• When creating installation media with Rufus, check the option: "Remove requirement for automatic BitLocker device encryption".
• Alternatively, during initial Windows setup on the language selection screen, press Shift + F10 to launch Command Prompt, open regedit, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BitLocker, and create a DWORD (32-bit) named PreventDeviceEncryption with a value of 1.

Frequently Asked Questions