Operating system drive encryption settings

This policy setting allows you to manage whether the operating system drive must be encrypted or not.

For higher security, when enabled with TPM + PIN protector, you may consider disable the following policies in System/Power Management/Sleep Settings:
Allow Standby States (S1-S3) When Sleeping (Plugged In)
Allow Standby States (S1-S3) When Sleeping (On Battery)

If you want to use BitLocker on a computer without a TPM, select the "Allow BitLocker without a compatible TPM" check box (supported on Windows 8 or higher). In this mode a password is required for start-up. If you forget the password then you will need to use one of the BitLocker recovery options to access the drive.

On a computer with a compatible TPM, two types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require the entry of a 4-digit to 20-digit personal identification number (PIN).

If you enable this policy setting, the user will have to put the operation system drive under BitLocker protection and drive will be encrypted.

If you disable this policy, the user will not be able to put the operating system drive under BitLocker protection. Note that applying this policy after the operating system drive is encrypted will result in its decryption.

If you do not configure this policy, then it is not required to put the operating system drive under BitLocker protection.

Supported on: At least Windows 7
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement
Value NameShouldEncryptOSDrive
Value TypeREG_DWORD
Enabled Value1
Disabled Value0

Allow BitLocker without a compatible TPM (requires a password)
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE
Value NameEnableBDEWithNoTPM
Value TypeREG_DWORD
Default Value1
True Value1
False Value0
Select protector for operating system drive:


  1. TPM only
    Registry HiveHKEY_LOCAL_MACHINE
    Registry PathSOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement
    Value NameOSDriveProtector
    Value TypeREG_DWORD
    Value1
    Registry HiveRegistry Path:Value NameValue TypeValue
    HKEY_LOCAL_MACHINESOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagementDisallowStandardUserPINResetREG_DWORD1
    HKEY_LOCAL_MACHINESOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagementUsePartialEncryptionKeyREG_DWORD2
    HKEY_LOCAL_MACHINESOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagementUsePINREG_DWORD2
    HKEY_LOCAL_MACHINESOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagementUseAdvancedStartupREG_DWORD1
    HKEY_LOCAL_MACHINESOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagementUseTPMREG_DWORD2
    HKEY_LOCAL_MACHINESOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagementUseTPMKeyREG_DWORD2
    HKEY_LOCAL_MACHINESOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagementUseTPMPINREG_DWORD2
    HKEY_LOCAL_MACHINESOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagementUseTPMKeyPINREG_DWORD2
  2. TPM and PIN
    Registry HiveHKEY_LOCAL_MACHINE
    Registry PathSOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement
    Value NameOSDriveProtector
    Value TypeREG_DWORD
    Value4
    Registry HiveRegistry Path:Value NameValue TypeValue
    HKEY_LOCAL_MACHINESOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagementDisallowStandardUserPINResetREG_DWORD1
    HKEY_LOCAL_MACHINESOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagementUsePartialEncryptionKeyREG_DWORD2
    HKEY_LOCAL_MACHINESOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagementUsePINREG_DWORD2
    HKEY_LOCAL_MACHINESOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagementUseAdvancedStartupREG_DWORD1
    HKEY_LOCAL_MACHINESOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagementUseTPMREG_DWORD2
    HKEY_LOCAL_MACHINESOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagementUseTPMKeyREG_DWORD2
    HKEY_LOCAL_MACHINESOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagementUseTPMPINREG_DWORD2
    HKEY_LOCAL_MACHINESOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagementUseTPMKeyPINREG_DWORD2

Settings for computers with a TPM:

Configure minimum PIN length for startup

Registry HiveHKEY_LOCAL_MACHINE
Registry PathSoftware\Policies\Microsoft\FVE
Value NameMinimumPIN
Value TypeREG_DWORD
Default Value4
Min Value4
Max Value20

bitlockermanagement.admx

Administrative Templates (Computers)

Administrative Templates (Users)