BitLocker settings

Settings and overrides named on this page

Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.

• RemovableDrivesExcludedFromEncryption
• XTS-AES

Requirements, exceptions and scope

• GuidanceException1 condition1 passage

  While many of the BitLocker policy settings can be configured using both CSP and GPO, there are some settings that are only available using one…

• Policy settings listException1 condition1 passage
• Allow standard user encryptionRequirement1 passage
• Choose drive encryption method and cipher strengthRequirementRecommendation2 passages
  XTS-AES
• Configure recovery password rotationRequirementException1 condition1 passage
• Disable new DMA devices when this computer is lockedExceptionRecommendation4 conditions2 passages
• Prevent memory overwrite on restartException1 condition1 passage
• Provide the unique identifiers for your organizationRequirementExceptionScope2 conditions4 passages
• Require device encryptionRequirementException10 conditions9 passages
• Validate smart card certificate usage rule complianceRequirement4 conditions2 passages
• Allow enhanced PINs for startupScopeRecommendation2 passages
• Allow network unlock at startupRequirementRecommendation2 conditions2 passages
• Allow Secure Boot for integrity validationException1 condition1 passage
• Allow warning for other disk encryptionExceptionScope3 conditions3 passages
• Choose how BitLocker-protected operating system drives can be recoveredRequirementExceptionScope6 conditions6 passages
• Configure minimum PIN length for startupRequirementException6 conditions5 passages
• Configure preboot recovery message and URLRequirementScopeRecommendation3 conditions3 passages
• Configure TPM platform validation profile for BIOS-based firmware configurationsRequirementExceptionScope4 conditions2 passages
• Configure TPM platform validation profile for native UEFI firmware configurationsRequirementExceptionScopeRecommendation8 conditions5 passages
• Configure use of passwords for operating system drivesRequirementExceptionScope3 conditions4 passages
• Disallow standard users from changing the PIN or passwordScope1 condition1 passage
• Enable use of BitLocker authentication requiring preboot keyboard input on slatesRequirementExceptionRecommendation5 conditions6 passages
• Enforce drive encryption type on operating system drivesException5 conditions2 passages
• Require additional authentication at startupRequirementException16 conditions6 passages
• Reset platform validation data after BitLocker recoveryRecommendation1 condition1 passage
• Choose how BitLocker-protected fixed drives can be recoveredRequirementExceptionScope7 conditions7 passages
• Configure use of passwords for fixed data drivesRequirementExceptionScope4 conditions5 passages
• Deny write access to fixed drives not protected by BitLockerRequirementExceptionScope5 conditions4 passages
• Enforce drive encryption type on fixed data drivesException5 conditions2 passages
• BitLocker policy settingsScope1 passage
• Choose how BitLocker-protected removable drives can be recoveredRequirementExceptionScope7 conditions7 passages
• Configure use of passwords for removable data drivesRequirementExceptionScope4 conditions5 passages
• Deny write access to removable drives not protected by BitLockerRequirementException2 conditions5 passages
• Enforce drive encryption type on removable data drivesException5 conditions2 passages
• Removable drives excluded from encryptionScope2 passages
  RemovableDrivesExcludedFromEncryption
• BitLocker and policy settings complianceException3 conditions1 passage
• Configure and manage serversRequirement1 condition1 passage

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.