Configure TPM platform validation profile for BIOS-based firmware configurations (Windows 11 Group Policy)

What it does

This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection. Important: This group policy only applies to computers with BIOS configurations or to computers with UEFI firmware with a Compatibility Service Module (CSM) enabled. Computers using a native UEFI firmware configuration store different values into the Platform Configuration Registers (PCRs). Use the "Configure TPM platform validation profile for native UEFI firmware configurations" group policy setting to configure the TPM PCR profile for computers using native UEFI firmware. If you enable this policy setting before turning on BitLocker, you can configure the boot components that the TPM will validate before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM will not release the encryption key to unlock the drive and the computer will instead display the BitLocker Recovery console and require that either the recovery password or recovery key be provided to unlock the drive. If you disable or do not configure this policy setting, BitLocker uses the default platform validation profile or the platform validation profile specified by the setup script. A platform validation profile consists of a set of Platform Configuration Register (PCR) indices ranging from 0 to 23. The default platform validation profile secures the encryption key against changes to the Core Root of Trust of Measurement (CRTM), BIOS, and Platform Extensions (PCR 0), the Option ROM Code (PCR 2), the Master Boot Record (MBR) Code (PCR 4), the NTFS Boot Sector (PCR 8), the NTFS Boot Block (PCR 9), the Boot Manager (PCR 10), and the BitLocker Access Control (PCR 11). Warning: Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending upon inclusion or exclusion (respectively) of the PCRs.

What it writes

Hive: HKEY_LOCAL_MACHINE
Registry key: SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS
Value name: Enabled
When enabled: DWORD 1
When disabled: DWORD 0

In Intune

No native CSP; import the ADMX (Intune-ready).

From Microsoft's Policy CSP DDF files (DDF v2 Files, February 2026), read 18 Oct 2026.

Options

Option	Type	Registry value	Allowed values
PCR 0: Core Root of Trust of Measurement (CRTM), BIOS, and Platform ExtensionsDefault: checked	Checkbox	`0`	On (1) or off (0)
PCR 1: Platform and Motherboard Configuration and Data	Checkbox	`1`	On (1) or off (0)
PCR 2: Option ROM CodeDefault: checked	Checkbox	`2`	On (1) or off (0)
PCR 3: Option ROM Configuration and Data	Checkbox	`3`	On (1) or off (0)
PCR 4: Master Boot Record (MBR) CodeDefault: checked	Checkbox	`4`	On (1) or off (0)
PCR 5: Master Boot Record (MBR) Partition Table	Checkbox	`5`	On (1) or off (0)
PCR 6: State Transition and Wake Events	Checkbox	`6`	On (1) or off (0)
PCR 7: Computer Manufacturer-Specific	Checkbox	`7`	On (1) or off (0)
PCR 8: NTFS Boot SectorDefault: checked	Checkbox	`8`	On (1) or off (0)
PCR 9: NTFS Boot BlockDefault: checked	Checkbox	`9`	On (1) or off (0)
PCR 10: Boot ManagerDefault: checked	Checkbox	`10`	On (1) or off (0)
PCR 11: BitLocker Access ControlDefault: checked	Checkbox	`11`	On (1) or off (0)
PCR 12: Reserved for Future Use	Checkbox	`12`	On (1) or off (0)
PCR 13: Reserved for Future Use	Checkbox	`13`	On (1) or off (0)
PCR 14: Reserved for Future Use	Checkbox	`14`	On (1) or off (0)
PCR 15: Reserved for Future Use	Checkbox	`15`	On (1) or off (0)
PCR 16: Reserved for Future Use	Checkbox	`16`	On (1) or off (0)
PCR 17: Reserved for Future Use	Checkbox	`17`	On (1) or off (0)
PCR 18: Reserved for Future Use	Checkbox	`18`	On (1) or off (0)
PCR 19: Reserved for Future Use	Checkbox	`19`	On (1) or off (0)
PCR 20: Reserved for Future Use	Checkbox	`20`	On (1) or off (0)
PCR 21: Reserved for Future Use	Checkbox	`21`	On (1) or off (0)
PCR 22: Reserved for Future Use	Checkbox	`22`	On (1) or off (0)
PCR 23: Reserved for Future Use	Checkbox	`23`	On (1) or off (0)

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

State Enabled Disabled Not configured

Enabled · Computer · template defaults

Registry file (.reg)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS]
"0"=dword:00000001
"1"=dword:00000001
"10"=dword:00000001
"11"=dword:00000001
"12"=dword:00000001
"13"=dword:00000001
"14"=dword:00000001
"15"=dword:00000001
"16"=dword:00000001
"17"=dword:00000001
"18"=dword:00000001
"19"=dword:00000001
"2"=dword:00000001
"20"=dword:00000001
"21"=dword:00000001
"22"=dword:00000001
"23"=dword:00000001
"3"=dword:00000001
"4"=dword:00000001
"5"=dword:00000001
"6"=dword:00000001
"7"=dword:00000001
"8"=dword:00000001
"9"=dword:00000001
"Enabled"=dword:00000001

PowerShell

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Configure TPM platform validation profile for BIOS-based firmware configurations
# Name: PlatformValidation_BIOS_Name
# Scope: Machine
# State: Enabled
# Source: VolumeEncryption.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name 'Enabled' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '0' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '1' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '2' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '3' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '4' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '5' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '6' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '7' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '8' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '9' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '10' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '11' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '12' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '13' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '14' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '15' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '16' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '17' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '18' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '19' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '20' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '21' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '22' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '23' -PropertyType 'DWord' -Value 1

The OMA-URI is an inferred ADMX-backed Policy CSP candidate derived from the source ADMX file name and policy name.
Some Microsoft policies use built-in Policy CSP pages whose area names don't match the ADMX file name, so verify the candidate against Microsoft Learn before deployment.
The generated payload is incomplete because one or more ADMX element values were not supplied: PlatformValidation_BIOS_Setting1, PlatformValidation_BIOS_Setting3, PlatformValidation_BIOS_Setting5, PlatformValidation_BIOS_Setting6, PlatformValidation_BIOS_Setting7, PlatformValidation_BIOS_Setting12, PlatformValidation_BIOS_Setting13, PlatformValidation_BIOS_Setting14, PlatformValidation_BIOS_Setting15, PlatformValidation_BIOS_Setting16, PlatformValidation_BIOS_Setting17, PlatformValidation_BIOS_Setting18, PlatformValidation_BIOS_Setting19, PlatformValidation_BIOS_Setting20, PlatformValidation_BIOS_Setting21, PlatformValidation_BIOS_Setting22, PlatformValidation_BIOS_Setting23

ADMX profile candidate (OMA-URI)

./Device/Vendor/MSFT/Policy/Config/ADMX_VolumeEncryption/PlatformValidation_BIOS_Name

Intune remediation scripts

Detection

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' { return [uint64]$actual -eq [uint64]$Expected }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Configure TPM platform validation profile for BIOS-based firmware configurations
# Name: PlatformValidation_BIOS_Name
# Scope: Machine
# State: Enabled
# Source: VolumeEncryption.admx

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name 'Enabled' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\Enabled') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '0' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\0') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '1' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\1') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '2' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\2') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '3' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\3') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '4' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\4') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '5' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\5') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '6' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\6') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '7' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\7') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '8' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\8') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '9' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\9') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '10' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\10') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '11' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\11') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '12' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\12') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '13' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\13') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '14' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\14') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '15' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\15') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '16' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\16') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '17' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\17') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '18' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\18') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '19' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\19') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '20' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\20') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '21' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\21') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '22' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\22') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '23' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS\23') | Out-Null
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

Remediation

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Configure TPM platform validation profile for BIOS-based firmware configurations
# Name: PlatformValidation_BIOS_Name
# Scope: Machine
# State: Enabled
# Source: VolumeEncryption.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name 'Enabled' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '0' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '1' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '2' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '3' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '4' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '5' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '6' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '7' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '8' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '9' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '10' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '11' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '12' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '13' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '14' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '15' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '16' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '17' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '18' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '19' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '20' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '21' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '22' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS' -Name '23' -PropertyType 'DWord' -Value 1

History 5 retained releases

22H2 · 1.015 Jul 2024
- Already present in the first release ChangeIntel keeps.

4 later releases left it unchanged.

Template

Internal name: PlatformValidation_BIOS_Name
Namespace: Microsoft.Policies.VolumeEncryption
Template file: VolumeEncryption.admx
Release: Windows 11 25H2 · 1.0 · file set de4e49983ebd651f…

Definition, editor controls and support

Definition

<policy class="Machine" displayName="$(string.PlatformValidation_BIOS_Name)" explainText="$(string.PlatformValidation_BIOS_Help)" key="SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_BIOS" name="PlatformValidation_BIOS_Name" presentation="$(presentation.PlatformValidation_BIOS_Name)" valueName="Enabled" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.VolumeEncryption:FVEOSCategory" />
      <supportedOn ref="Microsoft.Policies.VolumeEncryption:SUPPORTED_Windows8NoARM" />
      <enabledValue>
        <decimal value="1" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
      <elements>
        <boolean id="PlatformValidation_BIOS_Setting0" valueName="0">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting1" valueName="1">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting2" valueName="2">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting3" valueName="3">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting4" valueName="4">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting5" valueName="5">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting6" valueName="6">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting7" valueName="7">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting8" valueName="8">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting9" valueName="9">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting10" valueName="10">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting11" valueName="11">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting12" valueName="12">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting13" valueName="13">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting14" valueName="14">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting15" valueName="15">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting16" valueName="16">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting17" valueName="17">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting18" valueName="18">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting19" valueName="19">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting20" valueName="20">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting21" valueName="21">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting22" valueName="22">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_BIOS_Setting23" valueName="23">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
      </elements>
    </policy>

Editor controls

<presentation id="PlatformValidation_BIOS_Name" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <text>A platform validation profile consists of a set of Platform Configuration Register (PCR) indices. Each PCR index is associated with components that run when Windows starts.</text>
        <text>Use the check boxes below to choose the PCR indices to include in the profile.</text>
        <text>Exercise caution when changing this setting.</text>
        <text>We recommend the default of PCRs 0, 2, 4, 8, 9, 10, and 11.</text>
        <text>For BitLocker protection to take effect, you must include PCR 11.</text>

        <text>Consult online documentation for more information about the benefits and risks of changing the default TPM platform validation profile.</text>

        <checkBox defaultChecked="true" refId="PlatformValidation_BIOS_Setting0">PCR 0: Core Root of Trust of Measurement (CRTM), BIOS, and Platform Extensions</checkBox>
        <checkBox refId="PlatformValidation_BIOS_Setting1">PCR 1: Platform and Motherboard Configuration and Data</checkBox>
        <checkBox defaultChecked="true" refId="PlatformValidation_BIOS_Setting2">PCR 2: Option ROM Code</checkBox>
        <checkBox refId="PlatformValidation_BIOS_Setting3">PCR 3: Option ROM Configuration and Data</checkBox>
        <checkBox defaultChecked="true" refId="PlatformValidation_BIOS_Setting4">PCR 4: Master Boot Record (MBR) Code</checkBox>
        <checkBox refId="PlatformValidation_BIOS_Setting5">PCR 5: Master Boot Record (MBR) Partition Table</checkBox>
        <checkBox refId="PlatformValidation_BIOS_Setting6">PCR 6: State Transition and Wake Events</checkBox>
        <checkBox refId="PlatformValidation_BIOS_Setting7">PCR 7: Computer Manufacturer-Specific</checkBox>
        <checkBox defaultChecked="true" refId="PlatformValidation_BIOS_Setting8">PCR 8: NTFS Boot Sector</checkBox>
        <checkBox defaultChecked="true" refId="PlatformValidation_BIOS_Setting9">PCR 9: NTFS Boot Block</checkBox>
        <checkBox defaultChecked="true" refId="PlatformValidation_BIOS_Setting10">PCR 10: Boot Manager</checkBox>
        <checkBox defaultChecked="true" refId="PlatformValidation_BIOS_Setting11">PCR 11: BitLocker Access Control</checkBox>
        <checkBox refId="PlatformValidation_BIOS_Setting12">PCR 12: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_BIOS_Setting13">PCR 13: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_BIOS_Setting14">PCR 14: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_BIOS_Setting15">PCR 15: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_BIOS_Setting16">PCR 16: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_BIOS_Setting17">PCR 17: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_BIOS_Setting18">PCR 18: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_BIOS_Setting19">PCR 19: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_BIOS_Setting20">PCR 20: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_BIOS_Setting21">PCR 21: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_BIOS_Setting22">PCR 22: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_BIOS_Setting23">PCR 23: Reserved for Future Use</checkBox>
      </presentation>

Supported platforms and category

Microsoft.Policies.VolumeEncryption:category:FVECategory
<category displayName="$(string.FVECategory)" name="FVECategory" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />
    </category>
Microsoft.Policies.VolumeEncryption:category:FVEOSCategory
<category displayName="$(string.FVEOSCategory)" name="FVEOSCategory" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.VolumeEncryption:FVECategory" />
    </category>
Microsoft.Policies.VolumeEncryption:definition:SUPPORTED_Windows8NoARM
<definition displayName="$(string.SUPPORTED_Windows8NoARM)" name="SUPPORTED_Windows8NoARM" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.Windows:category:WindowsComponents
<category displayName="$(string.WindowsComponents)" explainText="$(string.WindowsComponents_Help)" name="WindowsComponents" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.VolumeEncryption:category:FVECategory
<category displayName="$(string.FVECategory)" name="FVECategory" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />
    </category>
<strings><string id="Microsoft.Policies.VolumeEncryption:FVECategory">BitLocker Drive Encryption</string></strings>
Microsoft.Policies.VolumeEncryption:category:FVEOSCategory
<category displayName="$(string.FVEOSCategory)" name="FVEOSCategory" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.VolumeEncryption:FVECategory" />
    </category>
<strings><string id="Microsoft.Policies.VolumeEncryption:FVEOSCategory">Operating System Drives</string></strings>
Microsoft.Policies.VolumeEncryption:definition:SUPPORTED_Windows8NoARM
<definition displayName="$(string.SUPPORTED_Windows8NoARM)" name="SUPPORTED_Windows8NoARM" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.VolumeEncryption:SUPPORTED_Windows8NoARM">At least Windows Server 2012 or Windows 8</string></strings>
Microsoft.Policies.Windows:category:WindowsComponents
<category displayName="$(string.WindowsComponents)" explainText="$(string.WindowsComponents_Help)" name="WindowsComponents" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Windows:WindowsComponents">Windows Components</string><string id="Microsoft.Policies.Windows:WindowsComponents_Help">Contains settings for operating system components.</string></strings>