Introduction
Remove disk encryption from managed devices via automation. This action disables BitLocker on Windows and FileVault on macOS — useful when decommissioning devices, preparing for OS reinstallation, or responding to specific operational requirements.
⚠️ WARNING: Disabling disk encryption removes a key layer of data protection from the device. Data on the drive will no longer be encrypted at rest. Confirm this is intentional before adding this action to an automation that runs broadly.
Disable Disk Encryption
From the automation pipeline in edit mode, click + Add action and select Disable disk encryption from the Security category. The action panel opens with two sections: Action type (pre-set to Disable disk encryption) and Step configuration.
Configuring the Step
Disk Drive
🖥️ PLATFORM NOTE:
Windows: Both options are available. Any drive targets all attached encrypted drives; System drive only targets the boot/OS drive. Uses BitLocker.
macOS: Always treated as System drive only, regardless of which option is selected. Uses FileVault.
Linux: Not supported. This action is not implemented on Linux.
The Disk drive dropdown controls which drives Level targets for decryption.
Option | Behavior |
Any drive | Disables encryption on all drives on the device. Windows only. |
System drive only | Disables encryption on the OS drive only. Applies to both Windows and macOS. |
Conditions
The Conditions section lets you restrict when this action runs based on device attributes or the outcome of a previous action. Expand the section to add conditions.
See Action Conditions for the full reference on condition types, operators, and values.
Additional Options
Expand Additional options for execution settings including action name, failure behavior, output variables, and retries.
See Actions Overview for the full reference on additional options available on every action.
FAQ
Does this action work on Linux? No. Disk encryption is not implemented for Linux. If your automation targets a mixed-OS group, only Windows and macOS devices will execute this step.
What encryption does this disable on each platform? BitLocker on Windows and FileVault on macOS. Level uses the OS-native decryption process.
Why is "Any drive" labeled Windows only? macOS always targets the system drive only, regardless of which option is selected. The Any drive option has no additional effect on macOS.
Will disabling encryption require a reboot? No. Level runs
Disable-BitLockerwhich kicks off decryption in the background and returns immediately — no restart required. The volume stays accessible the entire time. Decryption continues at the OS level after the action completes, so on large or heavily used drives the process may take some time to finish. The action also skips gracefully if the drive is already unencrypted or decryption is already in progress, returning success in both cases.What happens if the device is offline when the action runs? The action queues and resumes once the device comes back online.
Who can add or modify this action in an automation? Technicians with permission to edit automations in the relevant group. See Workspace → Permissions for access control configuration.