Configure TPM platform validation profile (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2) (Windows 10 Group Policy)

What it does

This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection. If you enable this policy setting before turning on BitLocker, you can configure the boot components that the TPM will validate before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM will not release the encryption key to unlock the drive and the computer will instead display the BitLocker Recovery console and require that either the recovery password or recovery key be provided to unlock the drive. If you disable or do not configure this policy setting, the TPM uses the default platform validation profile or the platform validation profile specified by the setup script. A platform validation profile consists of a set of Platform Configuration Register (PCR) indices ranging from 0 to 23, The default platform validation profile secures the encryption key against changes to the Core Root of Trust of Measurement (CRTM), BIOS, and Platform Extensions (PCR 0), the Option ROM Code (PCR 2), the Master Boot Record (MBR) Code (PCR 4), the NTFS Boot Sector (PCR 8), the NTFS Boot Block (PCR 9), the Boot Manager (PCR 10), and the BitLocker Access Control (PCR 11). The descriptions of PCR settings for computers that use an Extensible Firmware Interface (EFI) are different than the PCR settings described for computers that use a standard BIOS. Warning: Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending upon inclusion or exclusion (respectively) of the PCRs.

What it writes

Hive: HKEY_LOCAL_MACHINE
Registry key: SOFTWARE\Policies\Microsoft\FVE\PlatformValidation
Value name: Enabled
When enabled: DWORD 1
When disabled: DWORD 0

Why it needs changes for Intune

Policy references a Windows supportedOn definition.
ADMX-INTUNE-WINDOWS-SUPPORTEDON-REFERENCE

In Intune

No native CSP; import the ADMX (needs changes first).

From Microsoft's Policy CSP DDF files (DDF v2 Files, February 2026), read 18 Oct 2026.

Options

Option	Type	Registry value	Allowed values
PCR 0: Core Root of Trust of Measurement (CRTM), BIOS, and Platform ExtensionsDefault: checked	Checkbox	`0`	On (1) or off (0)
PCR 1: Platform and Motherboard Configuration and Data	Checkbox	`1`	On (1) or off (0)
PCR 2: Option ROM CodeDefault: checked	Checkbox	`2`	On (1) or off (0)
PCR 3: Option ROM Configuration and Data	Checkbox	`3`	On (1) or off (0)
PCR 4: Master Boot Record (MBR) CodeDefault: checked	Checkbox	`4`	On (1) or off (0)
PCR 5: Master Boot Record (MBR) Partition Table	Checkbox	`5`	On (1) or off (0)
PCR 6: State Transition and Wake Events	Checkbox	`6`	On (1) or off (0)
PCR 7: Computer Manufacturer-Specific	Checkbox	`7`	On (1) or off (0)
PCR 8: NTFS Boot SectorDefault: checked	Checkbox	`8`	On (1) or off (0)
PCR 9: NTFS Boot BlockDefault: checked	Checkbox	`9`	On (1) or off (0)
PCR 10: Boot ManagerDefault: checked	Checkbox	`10`	On (1) or off (0)
PCR 11: BitLocker Access ControlDefault: checked	Checkbox	`11`	On (1) or off (0)
PCR 12: Reserved for Future Use	Checkbox	`12`	On (1) or off (0)
PCR 13: Reserved for Future Use	Checkbox	`13`	On (1) or off (0)
PCR 14: Reserved for Future Use	Checkbox	`14`	On (1) or off (0)
PCR 15: Reserved for Future Use	Checkbox	`15`	On (1) or off (0)
PCR 16: Reserved for Future Use	Checkbox	`16`	On (1) or off (0)
PCR 17: Reserved for Future Use	Checkbox	`17`	On (1) or off (0)
PCR 18: Reserved for Future Use	Checkbox	`18`	On (1) or off (0)
PCR 19: Reserved for Future Use	Checkbox	`19`	On (1) or off (0)
PCR 20: Reserved for Future Use	Checkbox	`20`	On (1) or off (0)
PCR 21: Reserved for Future Use	Checkbox	`21`	On (1) or off (0)
PCR 22: Reserved for Future Use	Checkbox	`22`	On (1) or off (0)
PCR 23: Reserved for Future Use	Checkbox	`23`	On (1) or off (0)

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

State Enabled Disabled Not configured

Enabled · Computer · template defaults

Registry file (.reg)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation]
"0"=dword:00000001
"1"=dword:00000001
"10"=dword:00000001
"11"=dword:00000001
"12"=dword:00000001
"13"=dword:00000001
"14"=dword:00000001
"15"=dword:00000001
"16"=dword:00000001
"17"=dword:00000001
"18"=dword:00000001
"19"=dword:00000001
"2"=dword:00000001
"20"=dword:00000001
"21"=dword:00000001
"22"=dword:00000001
"23"=dword:00000001
"3"=dword:00000001
"4"=dword:00000001
"5"=dword:00000001
"6"=dword:00000001
"7"=dword:00000001
"8"=dword:00000001
"9"=dword:00000001
"Enabled"=dword:00000001

PowerShell

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Configure TPM platform validation profile (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2)
# Name: PlatformValidation_Deprecated_Name
# Scope: Machine
# State: Enabled
# Source: VolumeEncryption.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name 'Enabled' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '0' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '1' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '2' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '3' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '4' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '5' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '6' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '7' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '8' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '9' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '10' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '11' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '12' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '13' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '14' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '15' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '16' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '17' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '18' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '19' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '20' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '21' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '22' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '23' -PropertyType 'DWord' -Value 1

The OMA-URI is an inferred ADMX-backed Policy CSP candidate derived from the source ADMX file name and policy name.
Some Microsoft policies use built-in Policy CSP pages whose area names don't match the ADMX file name, so verify the candidate against Microsoft Learn before deployment.
The generated payload is incomplete because one or more ADMX element values were not supplied: PlatformValidation_Deprecated_Setting1, PlatformValidation_Deprecated_Setting3, PlatformValidation_Deprecated_Setting5, PlatformValidation_Deprecated_Setting6, PlatformValidation_Deprecated_Setting7, PlatformValidation_Deprecated_Setting12, PlatformValidation_Deprecated_Setting13, PlatformValidation_Deprecated_Setting14, PlatformValidation_Deprecated_Setting15, PlatformValidation_Deprecated_Setting16, PlatformValidation_Deprecated_Setting17, PlatformValidation_Deprecated_Setting18, PlatformValidation_Deprecated_Setting19, PlatformValidation_Deprecated_Setting20, PlatformValidation_Deprecated_Setting21, PlatformValidation_Deprecated_Setting22, PlatformValidation_Deprecated_Setting23

ADMX profile candidate (OMA-URI)

./Device/Vendor/MSFT/Policy/Config/ADMX_VolumeEncryption/PlatformValidation_Deprecated_Name

Intune remediation scripts

Detection

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' { return [uint64]$actual -eq [uint64]$Expected }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Configure TPM platform validation profile (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2)
# Name: PlatformValidation_Deprecated_Name
# Scope: Machine
# State: Enabled
# Source: VolumeEncryption.admx

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name 'Enabled' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\Enabled') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '0' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\0') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '1' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\1') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '2' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\2') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '3' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\3') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '4' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\4') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '5' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\5') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '6' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\6') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '7' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\7') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '8' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\8') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '9' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\9') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '10' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\10') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '11' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\11') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '12' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\12') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '13' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\13') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '14' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\14') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '15' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\15') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '16' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\16') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '17' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\17') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '18' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\18') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '19' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\19') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '20' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\20') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '21' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\21') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '22' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\22') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '23' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation\23') | Out-Null
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

Remediation

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Configure TPM platform validation profile (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2)
# Name: PlatformValidation_Deprecated_Name
# Scope: Machine
# State: Enabled
# Source: VolumeEncryption.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name 'Enabled' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '0' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '1' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '2' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '3' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '4' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '5' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '6' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '7' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '8' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '9' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '10' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '11' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '12' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '13' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '14' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '15' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '16' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '17' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '18' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '19' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '20' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '21' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '22' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation' -Name '23' -PropertyType 'DWord' -Value 1

History 2 retained releases

22H2 · 1.015 Jul 2024
- Wording changed.
1607 · 2.015 Jul 2024
- Already present in the first release ChangeIntel keeps.

Template

Internal name: PlatformValidation_Deprecated_Name
Namespace: Microsoft.Policies.VolumeEncryption
Template file: VolumeEncryption.admx
Release: Windows 10 22H2 · 1.0 · file set bc15f6a5271783ee…

Definition, editor controls and support

Definition

<policy class="Machine" displayName="$(string.PlatformValidation_Deprecated_Name)" explainText="$(string.PlatformValidation_Deprecated_Help)" key="SOFTWARE\Policies\Microsoft\FVE\PlatformValidation" name="PlatformValidation_Deprecated_Name" presentation="$(presentation.PlatformValidation_Deprecated_Name)" valueName="Enabled" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.VolumeEncryption:FVEOSCategory" />
      <supportedOn ref="Microsoft.Policies.Windows:SUPPORTED_Windows7ToVista" />
      <enabledValue>
        <decimal value="1" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
      <elements>
        <boolean id="PlatformValidation_Deprecated_Setting0" valueName="0">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting1" valueName="1">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting2" valueName="2">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting3" valueName="3">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting4" valueName="4">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting5" valueName="5">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting6" valueName="6">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting7" valueName="7">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting8" valueName="8">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting9" valueName="9">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting10" valueName="10">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting11" valueName="11">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting12" valueName="12">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting13" valueName="13">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting14" valueName="14">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting15" valueName="15">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting16" valueName="16">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting17" valueName="17">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting18" valueName="18">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting19" valueName="19">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting20" valueName="20">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting21" valueName="21">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting22" valueName="22">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_Deprecated_Setting23" valueName="23">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
      </elements>
    </policy>

Editor controls

<presentation id="PlatformValidation_Deprecated_Name" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <text>A platform validation profile consists of a set of Platform Configuration Register (PCR) indices. Each PCR index is associated with components that run when Windows starts.</text>
        <text>Use the check boxes below to choose the PCR indices to include in the profile.</text>
        <text>Exercise caution when changing this setting.</text>
        <text>We recommend the default of PCRs 0, 2, 4, 8, 9, 10, and 11.</text>
        <text>For BitLocker protection to take effect, you must include PCR 11.</text>

        <text>Consult online documentation for more information about the benefits and risks of changing the default TPM platform validation profile.</text>

        <checkBox defaultChecked="true" refId="PlatformValidation_Deprecated_Setting0">PCR 0: Core Root of Trust of Measurement (CRTM), BIOS, and Platform Extensions</checkBox>
        <checkBox refId="PlatformValidation_Deprecated_Setting1">PCR 1: Platform and Motherboard Configuration and Data</checkBox>
        <checkBox defaultChecked="true" refId="PlatformValidation_Deprecated_Setting2">PCR 2: Option ROM Code</checkBox>
        <checkBox refId="PlatformValidation_Deprecated_Setting3">PCR 3: Option ROM Configuration and Data</checkBox>
        <checkBox defaultChecked="true" refId="PlatformValidation_Deprecated_Setting4">PCR 4: Master Boot Record (MBR) Code</checkBox>
        <checkBox refId="PlatformValidation_Deprecated_Setting5">PCR 5: Master Boot Record (MBR) Partition Table</checkBox>
        <checkBox refId="PlatformValidation_Deprecated_Setting6">PCR 6: State Transition and Wake Events</checkBox>
        <checkBox refId="PlatformValidation_Deprecated_Setting7">PCR 7: Computer Manufacturer-Specific</checkBox>
        <checkBox defaultChecked="true" refId="PlatformValidation_Deprecated_Setting8">PCR 8: NTFS Boot Sector</checkBox>
        <checkBox defaultChecked="true" refId="PlatformValidation_Deprecated_Setting9">PCR 9: NTFS Boot Block</checkBox>
        <checkBox defaultChecked="true" refId="PlatformValidation_Deprecated_Setting10">PCR 10: Boot Manager</checkBox>
        <checkBox defaultChecked="true" refId="PlatformValidation_Deprecated_Setting11">PCR 11: BitLocker Access Control</checkBox>
        <checkBox refId="PlatformValidation_Deprecated_Setting12">PCR 12: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_Deprecated_Setting13">PCR 13: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_Deprecated_Setting14">PCR 14: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_Deprecated_Setting15">PCR 15: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_Deprecated_Setting16">PCR 16: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_Deprecated_Setting17">PCR 17: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_Deprecated_Setting18">PCR 18: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_Deprecated_Setting19">PCR 19: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_Deprecated_Setting20">PCR 20: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_Deprecated_Setting21">PCR 21: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_Deprecated_Setting22">PCR 22: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_Deprecated_Setting23">PCR 23: Reserved for Future Use</checkBox>
      </presentation>

Supported platforms and category

Microsoft.Policies.Products:product:MicrosoftWindows
sha256:4b3cb6917b5e5b7cd142c0157f10882786b3e9ee67c29fd7b8f4c6cb2eec5fe7
Microsoft.Policies.VolumeEncryption:category:FVECategory
<category displayName="$(string.FVECategory)" name="FVECategory" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />
    </category>
Microsoft.Policies.VolumeEncryption:category:FVEOSCategory
<category displayName="$(string.FVEOSCategory)" name="FVEOSCategory" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.VolumeEncryption:FVECategory" />
    </category>
Microsoft.Policies.Windows:category:WindowsComponents
<category displayName="$(string.WindowsComponents)" explainText="$(string.WindowsComponents_Help)" name="WindowsComponents" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.Windows:definition:SUPPORTED_Windows7ToVista
<definition displayName="$(string.SUPPORTED_Windows7ToVista)" name="SUPPORTED_Windows7ToVista" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <range maxVersionIndex="6" minVersionIndex="4" ref="Microsoft.Policies.Products:MicrosoftWindows" />
        </or>
      </definition>
Microsoft.Policies.Products:product:MicrosoftWindows
<product displayName="$(string.MicrosoftWindows)" name="MicrosoftWindows" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <majorVersion displayName="$(string.MicrosoftWindows2000)" name="MicrosoftWindows2000" versionIndex="1">
          <minorVersion displayName="$(string.MicrosoftWindows2000_RTM)" name="MicrosoftWindows2000_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP1)" name="MicrosoftWindows2000_SP1" versionIndex="1" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP2)" name="MicrosoftWindows2000_SP2" versionIndex="2" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP3)" name="MicrosoftWindows2000_SP3" versionIndex="3" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP4)" name="MicrosoftWindows2000_SP4" versionIndex="4" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsXP)" name="MicrosoftWindowsXP" versionIndex="2">
          <minorVersion displayName="$(string.MicrosoftWindowsXP_RTM)" name="MicrosoftWindowsXP_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindowsXP_SP1)" name="MicrosoftWindowsXP_SP1" versionIndex="1" />
          <minorVersion displayName="$(string.MicrosoftWindowsXP_SP2)" name="MicrosoftWindowsXP_SP2" versionIndex="2" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer2003)" name="MicrosoftWindowsServer2003" versionIndex="3">
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_RTM)" name="MicrosoftWindowsServer2003_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_SP1)" name="MicrosoftWindowsServer2003_SP1" versionIndex="1" />
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_R2)" name="MicrosoftWindowsServer2003_R2" versionIndex="2" />
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_SP2)" name="MicrosoftWindowsServer2003_SP2" versionIndex="3" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsVista)" name="MicrosoftWindowsVista" versionIndex="4">
          <minorVersion displayName="$(string.MicrosoftWindowsVista_RTM)" name="MicrosoftWindowsVista_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindowsVista_SP1)" name="MicrosoftWindowsVista_SP1" versionIndex="1" />
        </majorVersion>
        <majorVersion displayName="$(string.WindowsServer2008)" name="WindowsServer2008" versionIndex="5">
          <minorVersion displayName="$(string.WindowsServer2008_RTM)" name="WindowsServer2008_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.WindowsServer2008_R2)" name="WindowsServer2008_R2" versionIndex="1" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows7)" name="MicrosoftWindows7" versionIndex="6">
          <minorVersion displayName="$(string.MicrosoftWindows7_RTM)" name="MicrosoftWindows7_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer8)" name="MicrosoftWindowsServer8" versionIndex="7">
           <minorVersion displayName="$(string.MicrosoftWindowsServer8_RTM)" name="MicrosoftWindowsServer8_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows8)" name="MicrosoftWindows8" versionIndex="8">
          <minorVersion displayName="$(string.MicrosoftWindows8_RTM)" name="MicrosoftWindows8_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_RT)" name="MicrosoftWindows_RT" versionIndex="9">
          <minorVersion displayName="$(string.MicrosoftWindows_RT_RTM)" name="MicrosoftWindows_RT_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer_6_3)" name="MicrosoftWindowsServer_6_3" versionIndex="10">
           <minorVersion displayName="$(string.MicrosoftWindowsServer_6_3_RTM)" name="MicrosoftWindowsServer_6_3_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_6_3)" name="MicrosoftWindows_6_3" versionIndex="11">
          <minorVersion displayName="$(string.MicrosoftWindows_6_3_RTM)" name="MicrosoftWindows_6_3_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_6_3_RT)" name="MicrosoftWindows_6_3_RT" versionIndex="12">
            <minorVersion displayName="$(string.MicrosoftWindows_6_3_RT_RTM)" name="MicrosoftWindows_6_3_RT_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer_10_0)" name="MicrosoftWindowsServer_10_0" versionIndex="13">
            <minorVersion displayName="$(string.MicrosoftWindowsServer_10_0_RTM)" name="MicrosoftWindowsServer_10_0_RTM" versionIndex="0" />
          </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_10_0)" name="MicrosoftWindows_10_0" versionIndex="14">
            <minorVersion displayName="$(string.MicrosoftWindows_10_0_RTM)" name="MicrosoftWindows_10_0_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_10_0_RT)" name="MicrosoftWindows_10_0_RT" versionIndex="15">
            <minorVersion displayName="$(string.MicrosoftWindows_10_0_RT_RTM)" name="MicrosoftWindows_10_0_RT_RTM" versionIndex="0" />
        </majorVersion>
      </product>
<strings><string id="Microsoft.Policies.Products:MicrosoftWindows">Windows operating system</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000">Windows 2000 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_RTM">Windows 2000</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP1">Windows 2000 Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP2">Windows 2000 Service Pack 2</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP3">Windows 2000 Service Pack 3</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP4">Windows 2000 Service Pack 4</string><string id="Microsoft.Policies.Products:MicrosoftWindows7">Windows 7 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows7_RTM">Windows 7</string><string id="Microsoft.Policies.Products:MicrosoftWindows8">Windows 8 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows8_RTM">Windows 8</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003">Windows Server 2003 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_R2">Windows Server 2003 R2</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_RTM">Windows Server 2003</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_SP1">Windows Server 2003 Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_SP2">Windows Server 2003 Service Pack 2</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer8">Windows Server 2012 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer8_RTM">Windows Server 2012</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_10_0">Windows Server 2016 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_10_0_RTM">Windows Server 2016</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_6_3">Windows Server 2012 R2 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_6_3_RTM">Windows Server 2012 R2</string><string id="Microsoft.Policies.Products:MicrosoftWindowsVista">Windows Vista operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsVista_RTM">Windows Vista</string><string id="Microsoft.Policies.Products:MicrosoftWindowsVista_SP1">Windows Vista Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP">Windows XP operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP_RTM">Windows XP</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP_SP1">Windows XP Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP_SP2">Windows XP Service Pack 2</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0">Windows 10 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0_RT">Windows 10 RT operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0_RTM">Windows 10</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0_RT_RTM">Windows 10 RT</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3">Windows 8.1 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3_RT">Windows RT 8.1 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3_RTM">Windows 8.1</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3_RT_RTM">Windows RT 8.1</string><string id="Microsoft.Policies.Products:MicrosoftWindows_RT">Windows RT operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_RT_RTM">Windows RT</string><string id="Microsoft.Policies.Products:WindowsServer2008">Windows Server 2008 operating systems</string><string id="Microsoft.Policies.Products:WindowsServer2008_R2">Windows Server 2008 R2</string><string id="Microsoft.Policies.Products:WindowsServer2008_RTM">Windows Server 2008</string></strings>
Microsoft.Policies.VolumeEncryption:category:FVECategory
<category displayName="$(string.FVECategory)" name="FVECategory" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />
    </category>
<strings><string id="Microsoft.Policies.VolumeEncryption:FVECategory">BitLocker Drive Encryption</string></strings>
Microsoft.Policies.VolumeEncryption:category:FVEOSCategory
<category displayName="$(string.FVEOSCategory)" name="FVEOSCategory" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.VolumeEncryption:FVECategory" />
    </category>
<strings><string id="Microsoft.Policies.VolumeEncryption:FVEOSCategory">Operating System Drives</string></strings>
Microsoft.Policies.Windows:category:WindowsComponents
<category displayName="$(string.WindowsComponents)" explainText="$(string.WindowsComponents_Help)" name="WindowsComponents" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Windows:WindowsComponents">Windows Components</string><string id="Microsoft.Policies.Windows:WindowsComponents_Help">Contains settings for operating system components.</string></strings>
Microsoft.Policies.Windows:definition:SUPPORTED_Windows7ToVista
<definition displayName="$(string.SUPPORTED_Windows7ToVista)" name="SUPPORTED_Windows7ToVista" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <range maxVersionIndex="6" minVersionIndex="4" ref="Microsoft.Policies.Products:MicrosoftWindows" />
        </or>
      </definition>
<strings><string id="Microsoft.Policies.Windows:SUPPORTED_Windows7ToVista">Windows Server 2008, Windows 7, and Windows Vista</string></strings>