Configure TPM platform validation profile for BIOS-based firmware configurations

This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection.

Important: This group policy only applies to computers with BIOS configurations or to computers with UEFI firmware with a Compatibility Service Module (CSM) enabled. Computers using a native UEFI firmware configuration store different values into the Platform Configuration Registers (PCRs). Use the "Configure TPM platform validation profile for native UEFI firmware configurations" group policy setting to configure the TPM PCR profile for computers using native UEFI firmware.

If you enable this policy setting before turning on BitLocker, you can configure the boot components that the TPM will validate before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM will not release the encryption key to unlock the drive and the computer will instead display the BitLocker Recovery console and require that either the recovery password or recovery key be provided to unlock the drive.

If you disable or do not configure this policy setting, BitLocker uses the default platform validation profile or the platform validation profile specified by the setup script. A platform validation profile consists of a set of Platform Configuration Register (PCR) indices ranging from 0 to 23. The default platform validation profile secures the encryption key against changes to the Core Root of Trust of Measurement (CRTM), BIOS, and Platform Extensions (PCR 0), the Option ROM Code (PCR 2), the Master Boot Record (MBR) Code (PCR 4), the NTFS Boot Sector (PCR 8), the NTFS Boot Block (PCR 9), the Boot Manager (PCR 10), and the BitLocker Access Control (PCR 11).

Warning: Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending upon inclusion or exclusion (respectively) of the PCRs.

Supported on: At least Windows 8
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value NameEnabled
Value TypeREG_DWORD
Enabled Value1
Disabled Value0

A platform validation profile consists of a set of Platform Configuration Register (PCR) indices. Each PCR index is associated with components that run when Windows starts.

Use the check boxes below to choose the PCR indices to include in the profile.

Exercise caution when changing this setting.

We recommend the default of PCRs 0, 2, 4, 8, 9, 10, and 11.

For BitLocker protection to take effect, you must include PCR 11.

Consult online documentation for more information about the benefits and risks of changing the default TPM platform validation profile.

PCR 0: Core Root of Trust of Measurement (CRTM), BIOS, and Platform Extensions
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name0
Value TypeREG_DWORD
Default Value1
True Value1
False Value0
PCR 1: Platform and Motherboard Configuration and Data
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name1
Value TypeREG_DWORD
Default Value0
True Value1
False Value0
PCR 2: Option ROM Code
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name2
Value TypeREG_DWORD
Default Value1
True Value1
False Value0
PCR 3: Option ROM Configuration and Data
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name3
Value TypeREG_DWORD
Default Value0
True Value1
False Value0
PCR 4: Master Boot Record (MBR) Code
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name4
Value TypeREG_DWORD
Default Value1
True Value1
False Value0
PCR 5: Master Boot Record (MBR) Partition Table
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name5
Value TypeREG_DWORD
Default Value0
True Value1
False Value0
PCR 6: State Transition and Wake Events
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name6
Value TypeREG_DWORD
Default Value0
True Value1
False Value0
PCR 7: Computer Manufacturer-Specific
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name7
Value TypeREG_DWORD
Default Value0
True Value1
False Value0
PCR 8: NTFS Boot Sector
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name8
Value TypeREG_DWORD
Default Value1
True Value1
False Value0
PCR 9: NTFS Boot Block
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name9
Value TypeREG_DWORD
Default Value1
True Value1
False Value0
PCR 10: Boot Manager
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name10
Value TypeREG_DWORD
Default Value1
True Value1
False Value0
PCR 11: BitLocker Access Control
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name11
Value TypeREG_DWORD
Default Value1
True Value1
False Value0
PCR 12: Reserved for Future Use
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name12
Value TypeREG_DWORD
Default Value0
True Value1
False Value0
PCR 13: Reserved for Future Use
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name13
Value TypeREG_DWORD
Default Value0
True Value1
False Value0
PCR 14: Reserved for Future Use
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name14
Value TypeREG_DWORD
Default Value0
True Value1
False Value0
PCR 15: Reserved for Future Use
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name15
Value TypeREG_DWORD
Default Value0
True Value1
False Value0
PCR 16: Reserved for Future Use
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name16
Value TypeREG_DWORD
Default Value0
True Value1
False Value0
PCR 17: Reserved for Future Use
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name17
Value TypeREG_DWORD
Default Value0
True Value1
False Value0
PCR 18: Reserved for Future Use
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name18
Value TypeREG_DWORD
Default Value0
True Value1
False Value0
PCR 19: Reserved for Future Use
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name19
Value TypeREG_DWORD
Default Value0
True Value1
False Value0
PCR 20: Reserved for Future Use
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name20
Value TypeREG_DWORD
Default Value0
True Value1
False Value0
PCR 21: Reserved for Future Use
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name21
Value TypeREG_DWORD
Default Value0
True Value1
False Value0
PCR 22: Reserved for Future Use
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name22
Value TypeREG_DWORD
Default Value0
True Value1
False Value0
PCR 23: Reserved for Future Use
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value Name23
Value TypeREG_DWORD
Default Value0
True Value1
False Value0

volumeencryption.admx

Administrative Templates (Computers)

Administrative Templates (Users)