BitLocker settings

Dates from the page's own change log or history section. They describe earlier edits, not upcoming policy.

• Configure BitLockerRequirement1 condition
• Configure BitLockerRequirement1 condition
• Configure BitLockerScope
• Configure BitLockerException1 condition
• Policy settings listException1 condition
• Allow standard user encryptionRequirement
• Choose drive encryption method and cipher strengthRecommendation
  XTS-AES
• Choose drive encryption method and cipher strengthRequirement
• Configure recovery password rotationRequirementException1 condition
• Disable new DMA devices when this computer is lockedException2 conditions
• Disable new DMA devices when this computer is lockedRecommendation2 conditions
• Prevent memory overwrite on restartException1 condition
• Provide the unique identifiers for your organizationScope
• Provide the unique identifiers for your organizationScope
• Provide the unique identifiers for your organizationRequirement1 condition
• Provide the unique identifiers for your organizationRequirementException1 condition
• Require device encryptionRequirement1 condition
• Require device encryptionRequirement1 condition
• Require device encryptionRequirement1 condition
• Require device encryptionRequirement1 condition
• Require device encryptionRequirement1 condition
• Require device encryptionRequirement1 condition
• Require device encryptionRequirement1 condition
• Require device encryptionRequirement1 condition
• Require device encryptionException2 conditions
• Validate smart card certificate usage rule complianceRequirement2 conditions
• Validate smart card certificate usage rule complianceRequirement2 conditions
• Allow enhanced PINs for startupScope
• Allow enhanced PINs for startupRecommendation
• Allow network unlock at startupRequirement1 condition
• Allow network unlock at startupRecommendation1 condition
• Allow Secure Boot for integrity validationException1 condition
• Allow warning for other disk encryptionExceptionScope1 condition
• Allow warning for other disk encryptionException1 condition
• Allow warning for other disk encryptionException3 conditions
• Choose how BitLocker-protected operating system drives can be recoveredRequirement1 condition
• Choose how BitLocker-protected operating system drives can be recoveredRequirement
• Choose how BitLocker-protected operating system drives can be recoveredRequirement
• Choose how BitLocker-protected operating system drives can be recoveredException2 conditions
• Choose how BitLocker-protected operating system drives can be recoveredException2 conditions
• Choose how BitLocker-protected operating system drives can be recoveredScope1 condition
• Configure minimum PIN length for startupRequirement
• Configure minimum PIN length for startupRequirement
• Configure minimum PIN length for startupException3 conditions
• Configure minimum PIN length for startupRequirement1 condition
• Configure minimum PIN length for startupException2 conditions
• Configure preboot recovery message and URLScope1 condition
• Configure preboot recovery message and URLRequirement2 conditions
• Configure preboot recovery message and URLRecommendation
• Configure TPM platform validation profile for BIOS-based firmware configurationsRequirement3 conditions
• Configure TPM platform validation profile for BIOS-based firmware configurationsExceptionScope1 condition
• Configure TPM platform validation profile for native UEFI firmware configurationsRequirement3 conditions
• Configure TPM platform validation profile for native UEFI firmware configurationsExceptionScope1 condition
• Configure TPM platform validation profile for native UEFI firmware configurationsRecommendation2 conditions
• Configure TPM platform validation profile for native UEFI firmware configurationsException2 conditions
• Configure TPM platform validation profile for native UEFI firmware configurationsRequirement
• Configure use of passwords for operating system drivesRequirement
• Configure use of passwords for operating system drivesException2 conditions
• Configure use of passwords for operating system drivesRequirement
• Configure use of passwords for operating system drivesScope1 condition
• Disallow standard users from changing the PIN or passwordScope1 condition
• Enable use of BitLocker authentication requiring preboot keyboard input on slatesRequirement2 conditions
• Enable use of BitLocker authentication requiring preboot keyboard input on slatesRequirement1 condition
• Enable use of BitLocker authentication requiring preboot keyboard input on slatesRequirement1 condition
• Enable use of BitLocker authentication requiring preboot keyboard input on slatesExceptionRecommendation1 condition
• Enable use of BitLocker authentication requiring preboot keyboard input on slatesRequirement
• Enable use of BitLocker authentication requiring preboot keyboard input on slatesRequirement
• Enforce drive encryption type on operating system drivesException1 condition
• Enforce drive encryption type on operating system drivesException5 conditions
• Require additional authentication at startupRequirement2 conditions
• Require additional authentication at startupException3 conditions
• Require additional authentication at startupRequirementException2 conditions
• Require additional authentication at startupRequirement5 conditions
• Require additional authentication at startupException2 conditions
• Require additional authentication at startupRequirement2 conditions
• Reset platform validation data after BitLocker recoveryRecommendation1 condition
• Choose how BitLocker-protected fixed drives can be recoveredRequirement1 condition
• Choose how BitLocker-protected fixed drives can be recoveredRequirement
• Choose how BitLocker-protected fixed drives can be recoveredRequirement
• Choose how BitLocker-protected fixed drives can be recoveredException2 conditions
• Choose how BitLocker-protected fixed drives can be recoveredException2 conditions
• Choose how BitLocker-protected fixed drives can be recoveredRequirement1 condition
• Choose how BitLocker-protected fixed drives can be recoveredScope1 condition
• Configure use of passwords for fixed data drivesRequirement1 condition
• Configure use of passwords for fixed data drivesRequirement
• Configure use of passwords for fixed data drivesException2 conditions
• Configure use of passwords for fixed data drivesRequirement
• Configure use of passwords for fixed data drivesScope1 condition
• Deny write access to fixed drives not protected by BitLockerException2 conditions
• Deny write access to fixed drives not protected by BitLockerRequirementScope4 conditions
  BdeHdCfg
• Enforce drive encryption type on fixed data drivesException1 condition
• Enforce drive encryption type on fixed data drivesException5 conditions
• Enforce drive encryption type on fixed data drivesScope
• Choose how BitLocker-protected removable drives can be recoveredRequirement1 condition
• Choose how BitLocker-protected removable drives can be recoveredRequirement
• Choose how BitLocker-protected removable drives can be recoveredRequirement
• Choose how BitLocker-protected removable drives can be recoveredException2 conditions
• Choose how BitLocker-protected removable drives can be recoveredException2 conditions
• Choose how BitLocker-protected removable drives can be recoveredRequirement1 condition
• Choose how BitLocker-protected removable drives can be recoveredScope1 condition
• Configure use of passwords for removable data drivesRequirement1 condition
• Configure use of passwords for removable data drivesRequirement
• Configure use of passwords for removable data drivesException2 conditions
• Configure use of passwords for removable data drivesRequirement
• Configure use of passwords for removable data drivesScope1 condition
• Deny write access to removable drives not protected by BitLockerRequirement
• Deny write access to removable drives not protected by BitLockerException1 condition
• Deny write access to removable drives not protected by BitLockerException1 condition
• Deny write access to removable drives not protected by BitLockerRequirement1 condition
• Enforce drive encryption type on removable data drivesException1 condition
• Enforce drive encryption type on removable data drivesException5 conditions
• Removable drives excluded from encryptionScope
  RemovableDrivesExcludedFromEncryption
• BitLocker and policy settings complianceException3 conditions
• Configure and manage serversRequirement1 condition

Captured 8 Oct 23:45 UTC; extracted 16 Oct 16:10 UTC. Extractor: microsoft-1/9/fc65ebeb286710c0a830833db8a7e5de7e266b79981fe9c7c34479be9369ad3c/legacy.

Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.

Compact evidence remains available after full document bodies expire. Earlier extractions can have different vocabulary or capture limitations.

• 13 Oct 00:39 UTC · 123 candidates
• 8 Oct 23:45 UTC · 122 candidates