what is the best way to have yubikey always work on this ssd (encryption needed?

hi

i read that if someone has not bitlocker the ssd can be started without the yubikey login for win10. it is a problem. 

i read that the ssd has to be encrypted to avoid the yubikey being by passed in safe mode.

i also read some use bitlocker and some say to rely on samsung encryption wich i have no clue what that means.

the ssd is Samsung 860 EVO 2.5 SATA III 500GB INTERNAL SSD MZ-76E500B/AM

what are the steps in order to acheive a win10 with yubikey always asked? tx

I'm no expert in this subject, but I would think that by "Samsung" encryption,

they probably mean Samsung's own, built-in whole-drive encryption feature.

Absolutely need the drive encrypted for yubikey login to be worth anything. If not, one can get to all of the data on any windows based machine in about 60 seconds, yubikey or not.

Use bitlocker and a TPM chip to avoid putting in the password each boot, or bitlocker with password if you don't have a TPM chip. Also know that unless you use a different remote program, RDP doesn't like to work using yubikey auth (from a different machine to the one with yubikey auth) because it doesnt see the key when you're logging in from remote.

True, but rather than encrypt an entire drive, I think it's easier to just encrypt one folder.

Unless you need to encrypt the entire drive.

I doubt most home users need their Windows system files encrypted.