No matter the user logged in, the drive remains encrypted. Rather than choosing single files and folders for encryption, BitLocker encrypts your entire drive. TPM chips are designed to sniff out unauthorized or tampering users quickly, in which case the chip will not give up the part of the decryption key it's holding. While it's generally recommended that the PC has a Trusted Platform Module (TPM) chip, there is a way you can turn on BitLocker without.Ī TPM chip is a special bit of hardware added to your motherboard that is used to hold bits of encryption keys. BitLockerīitLocker is another drive encryption feature special to Windows Pro, Enterprise, and Education. Not even administrators have access to the encrypted files, and, if your password was changed without your knowledge, your encrypted files would remain encrypted. Finally, since the entire drive is not encrypted, there's a chance of data leaking into temporary files where it could potentially be accessed.ĮFS is best viewed as a quick way to protect files and folders on a PC with multiple users. A user might also forget to manually encrypt a sensitive file, further leaving it open to snooping. The key is also protected with encryption, but it's not the same level of security you'd find with a Trusted Module Platform (TPM) chip.ĭespite the steps taken to protect EFS keys, someone with the time and means could eventually decipher the key.

Windows itself creates the encryption key, and it is saved locally.

For that reason, you want to choose a strong password for the account on your PC.Ĭompared to BitLocker whole-drive encryption, EFS isn't quite as secure. If another user is logged in, the files are inaccessible. When the user who encrypted the files is logged in, the files are accessible. It's very easy to use, often requiring just a couple of clicks to encrypt a file or folder. Encrypting File System (EFS) is a file encryption service in Windows 10 Pro, Enterprise, and Education editions.

Windows encryption software two step