BitLocker settings

Timeline

From the capture of 8 Oct 23:45 UTC · an earlier observation

Legacy capture: table structure or oversized sections are unavailable for extraction

Microsoft's revision log on this page · 114 entries

Dates from the page's own change log or history section. They describe earlier edits, not upcoming policy.

Configure BitLockerRequirement1 condition
Configure BitLockerRequirement1 condition
Configure BitLockerScope
Configure BitLockerException1 condition
Policy settings listException1 condition
Allow standard user encryptionRequirement
Choose drive encryption method and cipher strengthRecommendation
XTS-AES
Choose drive encryption method and cipher strengthRequirement
Configure recovery password rotationRequirementException1 condition
Disable new DMA devices when this computer is lockedException2 conditions
Disable new DMA devices when this computer is lockedRecommendation2 conditions
Prevent memory overwrite on restartException1 condition
Provide the unique identifiers for your organizationScope
Provide the unique identifiers for your organizationScope
Provide the unique identifiers for your organizationRequirement1 condition
Provide the unique identifiers for your organizationRequirementException1 condition
Require device encryptionRequirement1 condition
Require device encryptionRequirement1 condition
Require device encryptionRequirement1 condition
Require device encryptionRequirement1 condition
Require device encryptionRequirement1 condition
Require device encryptionRequirement1 condition
Require device encryptionRequirement1 condition
Require device encryptionRequirement1 condition
Require device encryptionException2 conditions
Validate smart card certificate usage rule complianceRequirement2 conditions
Validate smart card certificate usage rule complianceRequirement2 conditions
Allow enhanced PINs for startupScope
Allow enhanced PINs for startupRecommendation
Allow network unlock at startupRequirement1 condition
Allow network unlock at startupRecommendation1 condition
Allow Secure Boot for integrity validationException1 condition
Allow warning for other disk encryptionExceptionScope1 condition
Allow warning for other disk encryptionException1 condition
Allow warning for other disk encryptionException3 conditions
Choose how BitLocker-protected operating system drives can be recoveredRequirement1 condition
Choose how BitLocker-protected operating system drives can be recoveredRequirement
Choose how BitLocker-protected operating system drives can be recoveredRequirement
Choose how BitLocker-protected operating system drives can be recoveredException2 conditions
Choose how BitLocker-protected operating system drives can be recoveredException2 conditions
Choose how BitLocker-protected operating system drives can be recoveredScope1 condition
Configure minimum PIN length for startupRequirement
Configure minimum PIN length for startupRequirement
Configure minimum PIN length for startupException3 conditions
Configure minimum PIN length for startupRequirement1 condition
Configure minimum PIN length for startupException2 conditions
Configure preboot recovery message and URLScope1 condition
Configure preboot recovery message and URLRequirement2 conditions
Configure preboot recovery message and URLRecommendation
Configure TPM platform validation profile for BIOS-based firmware configurationsRequirement3 conditions
Configure TPM platform validation profile for BIOS-based firmware configurationsExceptionScope1 condition
Configure TPM platform validation profile for native UEFI firmware configurationsRequirement3 conditions
Configure TPM platform validation profile for native UEFI firmware configurationsExceptionScope1 condition
Configure TPM platform validation profile for native UEFI firmware configurationsRecommendation2 conditions
Configure TPM platform validation profile for native UEFI firmware configurationsException2 conditions
Configure TPM platform validation profile for native UEFI firmware configurationsRequirement
Configure use of passwords for operating system drivesRequirement
Configure use of passwords for operating system drivesException2 conditions
Configure use of passwords for operating system drivesRequirement
Configure use of passwords for operating system drivesScope1 condition
Disallow standard users from changing the PIN or passwordScope1 condition
Enable use of BitLocker authentication requiring preboot keyboard input on slatesRequirement2 conditions
Enable use of BitLocker authentication requiring preboot keyboard input on slatesRequirement1 condition
Enable use of BitLocker authentication requiring preboot keyboard input on slatesRequirement1 condition
Enable use of BitLocker authentication requiring preboot keyboard input on slatesExceptionRecommendation1 condition
Enable use of BitLocker authentication requiring preboot keyboard input on slatesRequirement
Enable use of BitLocker authentication requiring preboot keyboard input on slatesRequirement
Enforce drive encryption type on operating system drivesException1 condition
Enforce drive encryption type on operating system drivesException5 conditions
Require additional authentication at startupRequirement2 conditions
Require additional authentication at startupException3 conditions
Require additional authentication at startupRequirementException2 conditions
Require additional authentication at startupRequirement5 conditions
Require additional authentication at startupException2 conditions
Require additional authentication at startupRequirement2 conditions
Reset platform validation data after BitLocker recoveryRecommendation1 condition
Choose how BitLocker-protected fixed drives can be recoveredRequirement1 condition
Choose how BitLocker-protected fixed drives can be recoveredRequirement
Choose how BitLocker-protected fixed drives can be recoveredRequirement
Choose how BitLocker-protected fixed drives can be recoveredException2 conditions
Choose how BitLocker-protected fixed drives can be recoveredException2 conditions
Choose how BitLocker-protected fixed drives can be recoveredRequirement1 condition
Choose how BitLocker-protected fixed drives can be recoveredScope1 condition
Configure use of passwords for fixed data drivesRequirement1 condition
Configure use of passwords for fixed data drivesRequirement
Configure use of passwords for fixed data drivesException2 conditions
Configure use of passwords for fixed data drivesRequirement
Configure use of passwords for fixed data drivesScope1 condition
Deny write access to fixed drives not protected by BitLockerException2 conditions
Deny write access to fixed drives not protected by BitLockerRequirementScope4 conditions
BdeHdCfg
Enforce drive encryption type on fixed data drivesException1 condition
Enforce drive encryption type on fixed data drivesException5 conditions
Enforce drive encryption type on fixed data drivesScope
Choose how BitLocker-protected removable drives can be recoveredRequirement1 condition
Choose how BitLocker-protected removable drives can be recoveredRequirement
Choose how BitLocker-protected removable drives can be recoveredRequirement
Choose how BitLocker-protected removable drives can be recoveredException2 conditions
Choose how BitLocker-protected removable drives can be recoveredException2 conditions
Choose how BitLocker-protected removable drives can be recoveredRequirement1 condition
Choose how BitLocker-protected removable drives can be recoveredScope1 condition
Configure use of passwords for removable data drivesRequirement1 condition
Configure use of passwords for removable data drivesRequirement
Configure use of passwords for removable data drivesException2 conditions
Configure use of passwords for removable data drivesRequirement
Configure use of passwords for removable data drivesScope1 condition
Deny write access to removable drives not protected by BitLockerRequirement
Deny write access to removable drives not protected by BitLockerException1 condition
Deny write access to removable drives not protected by BitLockerException1 condition
Deny write access to removable drives not protected by BitLockerRequirement1 condition
Enforce drive encryption type on removable data drivesException1 condition
Enforce drive encryption type on removable data drivesException5 conditions
Removable drives excluded from encryptionScope
RemovableDrivesExcludedFromEncryption
BitLocker and policy settings complianceException3 conditions
Configure and manage serversRequirement1 condition

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.

Observed history and review priority

Captured 8 Oct 23:45 UTC; extracted 16 Oct 16:10 UTC. Extractor: microsoft-1/9/fc65ebeb286710c0a830833db8a7e5de7e266b79981fe9c7c34479be9369ad3c/legacy.

Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.

Retained observations · 2

Compact evidence remains available after full document bodies expire. Earlier extractions can have different vocabulary or capture limitations.

13 Oct 00:39 UTC · 123 candidates
8 Oct 23:45 UTC · 122 candidates