Is it true that all Windows 10 SKUs have full-disk encryption turned on by default?
And this automatic full-disk encryption is called "device encryption", which is really the same as BitLocker but without any way for the user to control it? And you can't get BitLocker on the Home edition?
If you immediately set up BitLocker, it allows you to save or print your key instead of sending it to Microsoft. But does it use the same key as the default "device encryption" that was already sent to Microsoft? BitLocker doesn't create a new key and re-encrypt the drive?
And the TPM automatically loads your key into RAM when the device is powered on, so it's still vulnerable when the device is not in your possession?
Are you safe if you (1) create a local account instead of a Microsoft account, (2) use BitLocker instead of device encryption, (3) save your key locally instead of sending it to Microsoft, and (4) require a separate PIN or key to boot the computer in addition to the local Windows account??
It would be helpful to describe exactly how to create a local account, because the Windows 10 setup procedure hides this pretty well. It looks like the only option is to use an existing Microsoft account or create a new one during setup.
And it would be great to explain how to create a secondary PIN or key since that doesn't show up in the BitLocker UI until you edit the local policy[1].
[1] https://weikingteh.wordpress.com/2011/04/18/how-to-enable-bi...