Fix Windows 11 24H2 NVMe SSD Slowdown: BitLocker Benchmark Guide

Direct Answer: Windows 11 24H2 automatically enables software BitLocker Device Encryption on clean installs, reducing NVMe SSD random 4K write speeds by up to 45% and doubling access latency. To check if your drive is affected, open PowerShell as Administrator and run manage-bde -status C:. To permanently restore full native SSD speed, run manage-bde -off C: and allow the drive to decrypt in the background.

On our dev workbench, our team recently assembled three new high-performance engineering workstations running fresh, clean installations of Windows 11 24H2. Each rig was equipped with a top-tier PCIe Gen 4 or Gen 5 solid-state drive: a Samsung 990 Pro 2TB, a Western Digital Black SN850X, and a Crucial T700 Gen 5 drive capable of 12,000 MB/s.

After updating drivers and installing our development toolchains, we ran standard CrystalDiskMark benchmarks to establish our baseline storage performance.

The results were shocking:

# logs/storage_benchmark_baseline.log
[2026-09-09 11:24:02] [DRIVE] Samsung 990 Pro 2TB (PCIe 4.0 x4)
[2026-09-09 11:24:05] [BENCHMARK] SEQ1M Q8T1 Read:   7,420 MB/s (Normal)
[2026-09-09 11:24:12] [BENCHMARK] SEQ1M Q8T1 Write:  6,850 MB/s (Normal)
[2026-09-09 11:24:20] [BENCHMARK] RND4K Q1T1 Read:   54.2 MB/s (Expected: 88 MB/s) [-38%]
[2026-09-09 11:24:28] [BENCHMARK] RND4K Q1T1 Write:  142.1 MB/s (Expected: 260 MB/s) [-45%]
[2026-09-09 11:24:35] [LATENCY]   Random 4K Access:  58.4 us (Expected: 31.2 us) [+87%]

Our random 4K write performance had been slashed nearly in half, and random access latency had almost doubled.

We had not enabled BitLocker during installation. We had not set a password or recovery key. Yet when we opened an elevated command prompt and ran manage-bde -status, Windows reported: Conversion Status: Fully Encrypted (XTS-AES 128).

Windows 11 24H2 had silently encrypted our drives out-of-the-box. Just as our team documented when triaging BitLocker recovery screen loops and fine-tuning Windows 11 24H2 debloat and telemetry policies, silent background operating system defaults can have profound impacts on storage speed and production stability.

If your machine experiences broader system lockups during disk I/O, test your storage controller using our interactive Windows Error Fixer or consult our runbook on hardware crashes under load. Below is the architectural explanation of why software BitLocker cripples modern NVMe storage, our empirical benchmark data across PCIe Gen 4 and Gen 5 drives, and our step-by-step remediation runbook.

The 24H2 Policy Shift: Automatic Device Encryption

Starting with Windows 11 version 24H2, Microsoft expanded automatic BitLocker Device Encryption to all clean installations across both Home and Pro editions.

In previous Windows 10 and early Windows 11 builds, automatic encryption was restricted to specific OEM pre-built systems that passed strict hardware tests (Hardware Security Test Interface / HSTI).

In 24H2, Microsoft relaxed the hardware prerequisites:

1. DMA Protection & TPM 2.0: Any motherboard with modern processor virtualization (Intel VT-d / AMD-Vi) and an active TPM 2.0 chip qualifies.
2. Unified Policy: Clean installs from standard ISOs or Windows Update installations will automatically initiate background encryption the moment you log in with a Microsoft Account or set up an admin user.
3. Software-Only Default: Crucially, Windows 11 does not utilize the hardware encryption controller built into your SSD. It forces CPU-driven software encryption.

+-----------------------------------------------------------------------------------+
|               THE BITLOCKER SOFTWARE I/O INTERCEPTION PIPELINE                    |
+-----------------------------------------------------------------------------------+
| [Application / Game / Docker]                                                     |
|   Requests 4KB Random File Write                                                  |
|         |                                                                         |
|         v                                                                         |
| [Windows Storage Stack (NTFS / ReFS)]                                             |
|         |                                                                         |
|         v                                                                         |
| [BitLocker Filter Driver (fvevol.sys)]  <=== BOTTLENECK INTRODUCED!               |
|   1. Intercepts Raw Data Blocks in RAM                                            |
|   2. Dispatches AES-NI Encryption Task to CPU Cores                               |
|   3. Computes XTS-AES-128 Cipher Rounds                                           |
|   4. Latency Doubles from 31us to 58us!                                           |
|         |                                                                         |
|         v                                                                         |
| [NVMe Storage Controller Driver (stornvme.sys)]                                   |
|         |                                                                         |
|         v                                                                         |
| [Physical PCIe Gen 4/5 NVMe SSD]                                                  |
|   Writes Encrypted Blocks to 3D TLC/QLC NAND Flash                                |
+-----------------------------------------------------------------------------------+

The I/O Penalty: Why Software Encryption Chokes NVMe

Modern NVMe SSDs execute random reads and writes in sub-30 microseconds, but software encryption forces every 4KB block through a CPU interrupt barrier.

SATA SSDs and mechanical hard drives operate with millisecond-scale latency, meaning software encryption overhead was historically imperceptible.

PCIe Gen 4 (7,400 MB/s) and Gen 5 (14,000 MB/s) solid-state drives operate in a completely different universe:

• NAND flash read/write latency: ~15 to 30 microseconds.
• Queue Depth 1 Transactions: When compiling code, launching games, loading database indexes, or booting virtual machines, software requests thousands of unbatched, single-queue 4KB operations.

When fvevol.sys (the BitLocker volume filter driver) intercepts every 4KB transaction:

1. The CPU core must stop execution, execute AES-NI vector encryption instructions, and flush memory caches.
2. Under heavy multi-threaded write bursts, I/O requests pile up in queue wait states.
3. While peak multi-gigabyte sequential streaming transfers stay mostly intact (because the CPU can process large buffers concurrently), low-queue random 4K performance collapses by 20% to 45%.

Why Doesn’t Windows Use the SSD’s Built-in Hardware Encryption?

Every modern Samsung, Crucial, and Western Digital drive features a dedicated on-die hardware encryption engine (TCG Opal / Self-Encrypting Drive [SED]). Hardware encryption offloads 100% of cipher computations onto the SSD controller, resulting in zero CPU overhead and 0% performance loss.

However, in 2018, researchers discovered that multiple major SSD vendors had implemented flawed hardware encryption firmware that allowed master keys to be extracted without a password (documented under CVE-2018-12037 and CVE-2018-12038).

In response, Microsoft issued security advisory ADV190023 and updated Windows Group Policy so that BitLocker explicitly rejects hardware encryption and mandates software-only XTS-AES encryption by default.

Empirical Benchmarks: BitLocker On vs. Off on PCIe Gen 4 & Gen 5

Our workbench benchmarks across 3 top-tier NVMe SSDs prove that disabling software BitLocker restores up to 45% random write performance and cuts access latency in half.

Our team evaluated three distinct storage platforms on an AMD Ryzen 9 7950X / MSI X670E testbed running Windows 11 24H2 (Build 26100.1742):

• Drive A: Samsung 990 Pro 2TB (PCIe 4.0 x4 TLC)
• Drive B: WD Black SN850X 2TB (PCIe 4.0 x4 TLC)
• Drive C: Crucial T700 2TB (PCIe 5.0 x4 TLC)

All tests were performed using CrystalDiskMark 8.0.5 (5 passes, 4 GiB workload, Queue Depth 1, 1 Thread) after clean trim cycles:

Performance Comparison Matrix (BitLocker On vs Off)

Benchmark Takeaways

1. Sequential Speeds Mask the Issue: Looking solely at large sequential transfers (e.g. copying a 50GB ISO) will fool you into thinking BitLocker has minimal impact (only a 4% to 8% delta).
2. Random 4K is Where You Feel the System: Random 4K single-queue read and write speeds are the primary determinant of Windows boot times, app launch responsiveness, game asset loading, and IDE code indexing.
3. Gen 5 Suffers the Most: On our flagship Crucial T700 Gen 5 drive, random 4K write throughput leaped from 188 MB/s up to 314 MB/s simply by removing software BitLocker.

Step-by-Step Fix: Diagnosing and Disabling BitLocker

You can verify encryption status and safely decrypt your NVMe SSD in Windows 11 without losing any files or rebooting.

If your PC is a personal gaming desktop, a dedicated home-lab workstation, or an air-gapped system where physical drive theft is not a realistic threat, you can safely disable software BitLocker to reclaim your SSD’s native performance.

[!WARNING] If your device is an enterprise laptop containing sensitive customer data or company IP, consult your security compliance officer before modifying BitLocker policies. For laptops subject to physical loss or theft, data encryption may be legally mandatory.

Step 1: Check Current Encryption Status

Open PowerShell as Administrator and execute:

manage-bde -status

Inspect the output for your primary system volume (C:):

• Conversion Status: If this reads Fully Encrypted or Encryption in Progress, BitLocker is actively throttling I/O.
• Percentage Encrypted: Shows current progress.
• Encryption Method: Typically shows XTS-AES 128 (or XTS-AES 256).

Step 2: Begin Background Decryption

To completely decrypt the volume, run:

manage-bde -off C:

Windows will instantly begin decrypting all data blocks in the background. You do not need to restart your computer. You can continue working, browsing, or gaming while decryption proceeds.

Step 3: Monitor Decryption Progress

To monitor progress, run:

manage-bde -status C:

Watch the Percentage Encrypted metric. Depending on drive speed and stored data size (e.g., 500GB on a Gen 4 SSD), decryption typically takes between 5 and 15 minutes.

Once the status reports:

• Conversion Status: Fully Decrypted
• Percentage Encrypted: 0.0%
• Protection Status: Protection Off

Your SSD controller is completely freed from the software encryption pipeline. Re-run CrystalDiskMark, and you will immediately see your random 4K performance surge back to factory specifications.

Pro Tip: Prevent BitLocker During Future Clean Installs

If you reinstall Windows 11 24H2 frequently, you can block automatic encryption during setup using Rufus or a registry bypass.

To prevent Windows 11 24H2 from encrypting your drives upon setup:

Option A: Using Rufus (Recommended)

When creating a bootable USB drive using Rufus:

1. Select your Windows 11 24H2 ISO.
2. Click Start.
3. In the Windows User Experience customization dialog, ensure the checkbox marked “Remove requirement for automatic BitLocker Device Encryption” is checked.

Option B: Registry Bypass in Windows Setup

If booting from an official Microsoft Media Creation Tool USB:

1. At the initial Windows Setup screen, press Shift + F10 to open Command Prompt.
2. Type regedit and press Enter.
3. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BitLocker.
4. Create a new DWORD (32-bit) value named PreventDeviceEncryption and set its value to 1.
5. Close Registry Editor and continue normal setup.

Production Diagnostic Script: Test-BitLockerDiskSpeed.ps1

Use this automated PowerShell diagnostic script to inspect encryption status across all connected physical disks, measure real-time 4K write latency, and calculate your performance headroom.

Save this script as Test-BitLockerDiskSpeed.ps1 and run it from an elevated PowerShell terminal:

<#
.SYNOPSIS
    Test-BitLockerDiskSpeed.ps1
    Inspects Windows 11 BitLocker status, measures 4KB write latency,
    and flags SSD software encryption performance bottlenecks.
#>

# Ensure running as Administrator
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Error "This diagnostic script must be run as Administrator."
    exit 1
}

Clear-Host
Write-Host "======================================================================" -ForegroundColor Cyan
Write-Host "     WINDOWS 11 24H2 NVME SSD & BITLOCKER PERFORMANCE AUDIT" -ForegroundColor Cyan
Write-Host "======================================================================" -ForegroundColor Cyan

# 1. Query BitLocker Status via WMI
Write-Host "`n[*] Querying BitLocker Volume Protection Status..." -ForegroundColor Yellow
$volumes = Get-CimInstance -Namespace "root\CIMV2\Security\MicrosoftVolumeEncryption" -ClassName "Win32_EncryptableVolume"

foreach ($vol in $volumes) {
    $driveLetter = $vol.DriveLetter
    if (-not $driveLetter) { continue }

    $protectStatus = switch ($vol.ProtectionStatus) {
        0 { "Protection OFF (Decrypted / Unprotected)" }
        1 { "Protection ON (Actively Encrypted)" }
        2 { "Protection Unknown" }
    }

    $conversion = switch ($vol.ConversionStatus) {
        0 { "Fully Decrypted" }
        1 { "Fully Encrypted" }
        2 { "Encryption In Progress" }
        3 { "Decryption In Progress" }
        default { "Unknown" }
    }

    $encMethod = switch ($vol.EncryptionMethod) {
        0 { "None" }
        1 { "AES 128 (Legacy)" }
        2 { "AES 256 (Legacy)" }
        3 { "XTS-AES 128 (Software Default)" }
        4 { "XTS-AES 256 (Software)" }
        5 { "Hardware Encryption (OPAL/SED)" }
        default { "Custom / Other ($($vol.EncryptionMethod))" }
    }

    Write-Host "`n  Volume: [$driveLetter]" -ForegroundColor Green
    Write-Host "    - Protection Status:  $protectStatus"
    Write-Host "    - Conversion State:   $conversion"
    Write-Host "    - Encryption Engine:  $encMethod"

    if ($vol.ProtectionStatus -eq 1 -and $vol.EncryptionMethod -ne 5) {
        Write-Host "    [!] ALERT: Software CPU encryption active on this volume." -ForegroundColor Magenta
        Write-Host "        Random 4K I/O operations will incur a 20% to 45% latency penalty." -ForegroundColor Magenta
    }
}

# 2. Measure Single-Queue 4K Write Latency
Write-Host "`n[*] Benchmarking 4KB Random Write Latency on C:\ (1,000 Iterations)..." -ForegroundColor Yellow
$testFile = "$env:TEMP\ptw_nvme_lat_test.bin"
$buffer = New-Object byte[] 4096
(New-Object Random).NextBytes($buffer)

try {
    $fileStream = [System.IO.File]::Open($testFile, [System.IO.FileMode]::Create, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None)
    
    # Warmup
    for ($i = 0; $i -lt 50; $i++) {
        $fileStream.Position = 0
        $fileStream.Write($buffer, 0, 4096)
        $fileStream.Flush($true)
    }

    $sw = [System.Diagnostics.Stopwatch]::StartNew()
    $iterations = 1000
    for ($i = 0; $i -lt $iterations; $i++) {
        $fileStream.Position = 0
        $fileStream.Write($buffer, 0, 4096)
        $fileStream.Flush($true)
    }
    $sw.Stop()
    $fileStream.Close()

    $totalMs = $sw.Elapsed.TotalMilliseconds
    $avgUs = ($totalMs / $iterations) * 1000
    $iops = [math]::Round(1000000 / $avgUs)

    Write-Host "  [+] Benchmark Results:" -ForegroundColor Green
    Write-Host "      - Average 4K Write Latency: $([math]::Round($avgUs, 2)) microseconds"
    Write-Host "      - Single-Queue 4K IOPS:     $iops IOPS"

    if ($avgUs -gt 50.0) {
        Write-Host "  [!] VERDICT: Latency exceeds 50us (Consistent with software BitLocker overhead)." -ForegroundColor Red
        Write-Host "      Recommended: Run 'manage-bde -off C:' to restore native <35us NVMe latency." -ForegroundColor Yellow
    } else {
        Write-Host "  [+] VERDICT: Low-latency storage profile verified (<40us)." -ForegroundColor Green
    }
}
catch {
    Write-Error "Latency test encountered an error: $_"
}
finally {
    if (Test-Path $testFile) { Remove-Item $testFile -Force }
}

Write-Host "`n======================================================================" -ForegroundColor Cyan
Write-Host "  Audit complete. Reference: https://www.praveentechworld.com" -ForegroundColor Cyan
Write-Host "======================================================================`n"

Conclusion & Strategic Recommendations

Microsoft’s decision to enable BitLocker Device Encryption by default in Windows 11 24H2 was made with enterprise data security in mind. However, forcing CPU-driven software encryption across high-speed PCIe Gen 4 and Gen 5 NVMe drives imposes an undeniable 20% to 45% penalty on random 4K transactions.

Our Recommendation:

• Keep BitLocker ON on mobile corporate laptops where physical device loss or theft could expose sensitive organizational data.
• Turn BitLocker OFF on stationary gaming desktops, developer testbeds, and local AI workstations where physical access is secured, immediately reclaiming the raw speed and ultra-low latency you paid for when purchasing your NVMe SSD.