Configure TPM platform validation profile for native UEFI firmware configurations (Windows 11 Group Policy)

What it does

This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection. Important: This group policy only applies to computers with a native UEFI firmware configuration. Computers with BIOS or UEFI firmware with a Compatibility Service Module (CSM) enabled store different values into the Platform Configuration Registers (PCRs). Use the "Configure TPM platform validation profile for BIOS-based firmware configurations" group policy setting to configure the TPM PCR profile for computers with BIOS configurations or computers with UEFI firmware with a CSM enabled. If you enable this policy setting before turning on BitLocker, you can configure the boot components that the TPM will validate before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM will not release the encryption key to unlock the drive and the computer will instead display the BitLocker Recovery console and require that either the recovery password or recovery key be provided to unlock the drive. If you disable or do not configure this policy setting, BitLocker uses the default platform validation profile for the available hardware or the platform validation profile specified by the setup script. A platform validation profile consists of a set of Platform Configuration Register (PCR) indices ranging from 0 to 23. On PCs that lack Secure Boot State (PCR 7) support, the default platform validation profile secures the encryption key against changes to the core system firmware executable code (PCR 0), extended or pluggable executable code (PCR 2), boot manager (PCR 4), and the BitLocker access control (PCR 11). When Secure Boot State (PCR7) support is available, the default platform validation profile secures the encryption key using Secure Boot State (PCR 7) and the BitLocker access control (PCR 11). Warning: Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending upon inclusion or exclusion (respectively) of the PCRs. Specifically, setting this policy with PCR 7 omitted, will override the "Allow Secure Boot for integrity validation" group policy, preventing BitLocker from using Secure Boot for platform or Boot Configuration Data (BCD) integrity validation. Setting this policy may result in BitLocker recovery when firmware is updated. If you set this policy to include PCR 0, suspend BitLocker prior to applying firmware updates. It is recommended to not configure this policy, to allow Windows to select the PCR profile for the best combination of security and usability based on the available hardware on each PC.

What it writes

Hive: HKEY_LOCAL_MACHINE
Registry key: SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI
Value name: Enabled
When enabled: DWORD 1
When disabled: DWORD 0

Why it needs changes for Intune

Policy references a Windows supportedOn definition.
ADMX-INTUNE-WINDOWS-SUPPORTEDON-REFERENCE

In Intune

No native CSP; import the ADMX (needs changes first).

From Microsoft's Policy CSP DDF files (DDF v2 Files, February 2026), read 18 Oct 2026.

Options

Option	Type	Registry value	Allowed values
PCR 0: Core System Firmware executable codeDefault: checked	Checkbox	`0`	On (1) or off (0)
PCR 1: Core System Firmware data	Checkbox	`1`	On (1) or off (0)
PCR 2: Extended or pluggable executable codeDefault: checked	Checkbox	`2`	On (1) or off (0)
PCR 3: Extended or pluggable firmware data	Checkbox	`3`	On (1) or off (0)
PCR 4: Boot ManagerDefault: checked	Checkbox	`4`	On (1) or off (0)
PCR 5: GPT / Partition Table	Checkbox	`5`	On (1) or off (0)
PCR 6: Resume from S4 and S5 Power State Events	Checkbox	`6`	On (1) or off (0)
PCR 7: Secure Boot State	Checkbox	`7`	On (1) or off (0)
PCR 8: Initialized to 0 with no Extends (reserved for future use)	Checkbox	`8`	On (1) or off (0)
PCR 9: Initialized to 0 with no Extends (reserved for future use)	Checkbox	`9`	On (1) or off (0)
PCR 10: Initialized to 0 with no Extends (reserved for future use)	Checkbox	`10`	On (1) or off (0)
PCR 11: BitLocker Access ControlDefault: checked	Checkbox	`11`	On (1) or off (0)
PCR 12: Data events and highly volatile events	Checkbox	`12`	On (1) or off (0)
PCR 13: Boot Module Details	Checkbox	`13`	On (1) or off (0)
PCR 14: Boot Authorities	Checkbox	`14`	On (1) or off (0)
PCR 15: Reserved for Future Use	Checkbox	`15`	On (1) or off (0)
PCR 16: Reserved for Future Use	Checkbox	`16`	On (1) or off (0)
PCR 17: Reserved for Future Use	Checkbox	`17`	On (1) or off (0)
PCR 18: Reserved for Future Use	Checkbox	`18`	On (1) or off (0)
PCR 19: Reserved for Future Use	Checkbox	`19`	On (1) or off (0)
PCR 20: Reserved for Future Use	Checkbox	`20`	On (1) or off (0)
PCR 21: Reserved for Future Use	Checkbox	`21`	On (1) or off (0)
PCR 22: Reserved for Future Use	Checkbox	`22`	On (1) or off (0)
PCR 23: Reserved for Future Use	Checkbox	`23`	On (1) or off (0)

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

State Enabled Disabled Not configured

Enabled · Computer · template defaults

Registry file (.reg)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI]
"0"=dword:00000001
"1"=dword:00000001
"10"=dword:00000001
"11"=dword:00000001
"12"=dword:00000001
"13"=dword:00000001
"14"=dword:00000001
"15"=dword:00000001
"16"=dword:00000001
"17"=dword:00000001
"18"=dword:00000001
"19"=dword:00000001
"2"=dword:00000001
"20"=dword:00000001
"21"=dword:00000001
"22"=dword:00000001
"23"=dword:00000001
"3"=dword:00000001
"4"=dword:00000001
"5"=dword:00000001
"6"=dword:00000001
"7"=dword:00000001
"8"=dword:00000001
"9"=dword:00000001
"Enabled"=dword:00000001

PowerShell

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Configure TPM platform validation profile for native UEFI firmware configurations
# Name: PlatformValidation_UEFI_Name
# Scope: Machine
# State: Enabled
# Source: VolumeEncryption.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name 'Enabled' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '0' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '1' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '2' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '3' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '4' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '5' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '6' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '7' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '8' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '9' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '10' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '11' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '12' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '13' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '14' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '15' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '16' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '17' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '18' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '19' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '20' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '21' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '22' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '23' -PropertyType 'DWord' -Value 1

The OMA-URI is an inferred ADMX-backed Policy CSP candidate derived from the source ADMX file name and policy name.
Some Microsoft policies use built-in Policy CSP pages whose area names don't match the ADMX file name, so verify the candidate against Microsoft Learn before deployment.
The generated payload is incomplete because one or more ADMX element values were not supplied: PlatformValidation_UEFI_Setting1, PlatformValidation_UEFI_Setting3, PlatformValidation_UEFI_Setting5, PlatformValidation_UEFI_Setting6, PlatformValidation_UEFI_Setting7, PlatformValidation_UEFI_Setting8, PlatformValidation_UEFI_Setting9, PlatformValidation_UEFI_Setting10, PlatformValidation_UEFI_Setting12, PlatformValidation_UEFI_Setting13, PlatformValidation_UEFI_Setting14, PlatformValidation_UEFI_Setting15, PlatformValidation_UEFI_Setting16, PlatformValidation_UEFI_Setting17, PlatformValidation_UEFI_Setting18, PlatformValidation_UEFI_Setting19, PlatformValidation_UEFI_Setting20, PlatformValidation_UEFI_Setting21, PlatformValidation_UEFI_Setting22, PlatformValidation_UEFI_Setting23

ADMX profile candidate (OMA-URI)

./Device/Vendor/MSFT/Policy/Config/ADMX_VolumeEncryption/PlatformValidation_UEFI_Name

Intune remediation scripts

Detection

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' { return [uint64]$actual -eq [uint64]$Expected }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Configure TPM platform validation profile for native UEFI firmware configurations
# Name: PlatformValidation_UEFI_Name
# Scope: Machine
# State: Enabled
# Source: VolumeEncryption.admx

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name 'Enabled' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\Enabled') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '0' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\0') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '1' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\1') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '2' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\2') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '3' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\3') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '4' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\4') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '5' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\5') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '6' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\6') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '7' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\7') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '8' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\8') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '9' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\9') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '10' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\10') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '11' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\11') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '12' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\12') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '13' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\13') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '14' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\14') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '15' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\15') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '16' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\16') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '17' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\17') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '18' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\18') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '19' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\19') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '20' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\20') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '21' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\21') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '22' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\22') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '23' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI\23') | Out-Null
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

Remediation

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Configure TPM platform validation profile for native UEFI firmware configurations
# Name: PlatformValidation_UEFI_Name
# Scope: Machine
# State: Enabled
# Source: VolumeEncryption.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name 'Enabled' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '0' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '1' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '2' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '3' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '4' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '5' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '6' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '7' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '8' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '9' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '10' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '11' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '12' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '13' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '14' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '15' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '16' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '17' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '18' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '19' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '20' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '21' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '22' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '23' -PropertyType 'DWord' -Value 1

History 5 retained releases

24H2 · 1.030 Sep 2024
- Translations changed; choose a language above to compare its wording.
22H2 · 1.015 Jul 2024
- Already present in the first release ChangeIntel keeps.

3 later releases left it unchanged.

Template

Internal name: PlatformValidation_UEFI_Name
Namespace: Microsoft.Policies.VolumeEncryption
Template file: VolumeEncryption.admx
Release: Windows 11 25H2 · 1.0 · file set de4e49983ebd651f…

Definition, editor controls and support

Definition

<policy class="Machine" displayName="$(string.PlatformValidation_UEFI_Name)" explainText="$(string.PlatformValidation_UEFI_Help)" key="SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI" name="PlatformValidation_UEFI_Name" presentation="$(presentation.PlatformValidation_UEFI_Name)" valueName="Enabled" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.VolumeEncryption:FVEOSCategory" />
      <supportedOn ref="Microsoft.Policies.Windows:SUPPORTED_Windows8" />
      <enabledValue>
        <decimal value="1" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
      <elements>
        <boolean id="PlatformValidation_UEFI_Setting0" valueName="0">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting1" valueName="1">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting2" valueName="2">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting3" valueName="3">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting4" valueName="4">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting5" valueName="5">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting6" valueName="6">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting7" valueName="7">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting8" valueName="8">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting9" valueName="9">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting10" valueName="10">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting11" valueName="11">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting12" valueName="12">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting13" valueName="13">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting14" valueName="14">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting15" valueName="15">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting16" valueName="16">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting17" valueName="17">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting18" valueName="18">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting19" valueName="19">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting20" valueName="20">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting21" valueName="21">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting22" valueName="22">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <boolean id="PlatformValidation_UEFI_Setting23" valueName="23">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
      </elements>
    </policy>

Editor controls

<presentation id="PlatformValidation_UEFI_Name" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <text>A platform validation profile consists of a set of Platform Configuration Register (PCR) indices. Each PCR index is associated with components that run when Windows starts.</text>
        <text>Use the check boxes below to choose the PCR indices to include in the profile.</text>
        <text>Exercise caution when changing this setting.</text>
        <text>We recommend the default of PCRs 0, 2, 4, and 11.</text>
        <text>For BitLocker protection to take effect, you must include PCR 11.</text>

        <text>Consult online documentation for more information about the benefits and risks of changing the default TPM platform validation profile.</text>

        <checkBox defaultChecked="true" refId="PlatformValidation_UEFI_Setting0">PCR 0: Core System Firmware executable code</checkBox>
        <checkBox refId="PlatformValidation_UEFI_Setting1">PCR 1: Core System Firmware data</checkBox>
        <checkBox defaultChecked="true" refId="PlatformValidation_UEFI_Setting2">PCR 2: Extended or pluggable executable code</checkBox>
        <checkBox refId="PlatformValidation_UEFI_Setting3">PCR 3: Extended or pluggable firmware data</checkBox>
        <checkBox defaultChecked="true" refId="PlatformValidation_UEFI_Setting4">PCR 4: Boot Manager</checkBox>
        <checkBox refId="PlatformValidation_UEFI_Setting5">PCR 5: GPT / Partition Table</checkBox>
        <checkBox refId="PlatformValidation_UEFI_Setting6">PCR 6: Resume from S4 and S5 Power State Events</checkBox>
        <checkBox refId="PlatformValidation_UEFI_Setting7">PCR 7: Secure Boot State</checkBox>
        <checkBox refId="PlatformValidation_UEFI_Setting8">PCR 8: Initialized to 0 with no Extends (reserved for future use)</checkBox>
        <checkBox refId="PlatformValidation_UEFI_Setting9">PCR 9: Initialized to 0 with no Extends (reserved for future use)</checkBox>
        <checkBox refId="PlatformValidation_UEFI_Setting10">PCR 10: Initialized to 0 with no Extends (reserved for future use)</checkBox>
        <checkBox defaultChecked="true" refId="PlatformValidation_UEFI_Setting11">PCR 11: BitLocker Access Control</checkBox>
        <checkBox refId="PlatformValidation_UEFI_Setting12">PCR 12: Data events and highly volatile events</checkBox>
        <checkBox refId="PlatformValidation_UEFI_Setting13">PCR 13: Boot Module Details</checkBox>
        <checkBox refId="PlatformValidation_UEFI_Setting14">PCR 14: Boot Authorities</checkBox>
        <checkBox refId="PlatformValidation_UEFI_Setting15">PCR 15: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_UEFI_Setting16">PCR 16: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_UEFI_Setting17">PCR 17: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_UEFI_Setting18">PCR 18: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_UEFI_Setting19">PCR 19: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_UEFI_Setting20">PCR 20: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_UEFI_Setting21">PCR 21: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_UEFI_Setting22">PCR 22: Reserved for Future Use</checkBox>
        <checkBox refId="PlatformValidation_UEFI_Setting23">PCR 23: Reserved for Future Use</checkBox>
      </presentation>

Supported platforms and category

Microsoft.Policies.Products:product:MicrosoftWindows
sha256:4b3cb6917b5e5b7cd142c0157f10882786b3e9ee67c29fd7b8f4c6cb2eec5fe7
Microsoft.Policies.VolumeEncryption:category:FVECategory
<category displayName="$(string.FVECategory)" name="FVECategory" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />
    </category>
Microsoft.Policies.VolumeEncryption:category:FVEOSCategory
<category displayName="$(string.FVEOSCategory)" name="FVEOSCategory" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.VolumeEncryption:FVECategory" />
    </category>
Microsoft.Policies.Windows:category:WindowsComponents
<category displayName="$(string.WindowsComponents)" explainText="$(string.WindowsComponents_Help)" name="WindowsComponents" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.Windows:definition:SUPPORTED_Windows8
<definition displayName="$(string.SUPPORTED_Windows8)" name="SUPPORTED_Windows8" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <range minVersionIndex="7" ref="Microsoft.Policies.Products:MicrosoftWindows" />
        </or>
      </definition>
Microsoft.Policies.Products:product:MicrosoftWindows
<product displayName="$(string.MicrosoftWindows)" name="MicrosoftWindows" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <majorVersion displayName="$(string.MicrosoftWindows2000)" name="MicrosoftWindows2000" versionIndex="1">
          <minorVersion displayName="$(string.MicrosoftWindows2000_RTM)" name="MicrosoftWindows2000_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP1)" name="MicrosoftWindows2000_SP1" versionIndex="1" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP2)" name="MicrosoftWindows2000_SP2" versionIndex="2" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP3)" name="MicrosoftWindows2000_SP3" versionIndex="3" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP4)" name="MicrosoftWindows2000_SP4" versionIndex="4" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsXP)" name="MicrosoftWindowsXP" versionIndex="2">
          <minorVersion displayName="$(string.MicrosoftWindowsXP_RTM)" name="MicrosoftWindowsXP_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindowsXP_SP1)" name="MicrosoftWindowsXP_SP1" versionIndex="1" />
          <minorVersion displayName="$(string.MicrosoftWindowsXP_SP2)" name="MicrosoftWindowsXP_SP2" versionIndex="2" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer2003)" name="MicrosoftWindowsServer2003" versionIndex="3">
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_RTM)" name="MicrosoftWindowsServer2003_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_SP1)" name="MicrosoftWindowsServer2003_SP1" versionIndex="1" />
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_R2)" name="MicrosoftWindowsServer2003_R2" versionIndex="2" />
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_SP2)" name="MicrosoftWindowsServer2003_SP2" versionIndex="3" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsVista)" name="MicrosoftWindowsVista" versionIndex="4">
          <minorVersion displayName="$(string.MicrosoftWindowsVista_RTM)" name="MicrosoftWindowsVista_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindowsVista_SP1)" name="MicrosoftWindowsVista_SP1" versionIndex="1" />
        </majorVersion>
        <majorVersion displayName="$(string.WindowsServer2008)" name="WindowsServer2008" versionIndex="5">
          <minorVersion displayName="$(string.WindowsServer2008_RTM)" name="WindowsServer2008_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.WindowsServer2008_R2)" name="WindowsServer2008_R2" versionIndex="1" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows7)" name="MicrosoftWindows7" versionIndex="6">
          <minorVersion displayName="$(string.MicrosoftWindows7_RTM)" name="MicrosoftWindows7_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer8)" name="MicrosoftWindowsServer8" versionIndex="7">
           <minorVersion displayName="$(string.MicrosoftWindowsServer8_RTM)" name="MicrosoftWindowsServer8_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows8)" name="MicrosoftWindows8" versionIndex="8">
          <minorVersion displayName="$(string.MicrosoftWindows8_RTM)" name="MicrosoftWindows8_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_RT)" name="MicrosoftWindows_RT" versionIndex="9">
          <minorVersion displayName="$(string.MicrosoftWindows_RT_RTM)" name="MicrosoftWindows_RT_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer_6_3)" name="MicrosoftWindowsServer_6_3" versionIndex="10">
           <minorVersion displayName="$(string.MicrosoftWindowsServer_6_3_RTM)" name="MicrosoftWindowsServer_6_3_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_6_3)" name="MicrosoftWindows_6_3" versionIndex="11">
          <minorVersion displayName="$(string.MicrosoftWindows_6_3_RTM)" name="MicrosoftWindows_6_3_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_6_3_RT)" name="MicrosoftWindows_6_3_RT" versionIndex="12">
            <minorVersion displayName="$(string.MicrosoftWindows_6_3_RT_RTM)" name="MicrosoftWindows_6_3_RT_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer_10_0)" name="MicrosoftWindowsServer_10_0" versionIndex="13">
            <minorVersion displayName="$(string.MicrosoftWindowsServer_10_0_RTM)" name="MicrosoftWindowsServer_10_0_RTM" versionIndex="0" />
          </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_10_0)" name="MicrosoftWindows_10_0" versionIndex="14">
            <minorVersion displayName="$(string.MicrosoftWindows_10_0_RTM)" name="MicrosoftWindows_10_0_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_10_0_RT)" name="MicrosoftWindows_10_0_RT" versionIndex="15">
            <minorVersion displayName="$(string.MicrosoftWindows_10_0_RT_RTM)" name="MicrosoftWindows_10_0_RT_RTM" versionIndex="0" />
        </majorVersion>
      </product>
<strings><string id="Microsoft.Policies.Products:MicrosoftWindows">Windows operating system</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000">Windows 2000 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_RTM">Windows 2000</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP1">Windows 2000 Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP2">Windows 2000 Service Pack 2</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP3">Windows 2000 Service Pack 3</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP4">Windows 2000 Service Pack 4</string><string id="Microsoft.Policies.Products:MicrosoftWindows7">Windows 7 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows7_RTM">Windows 7</string><string id="Microsoft.Policies.Products:MicrosoftWindows8">Windows 8 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows8_RTM">Windows 8</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003">Windows Server 2003 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_R2">Windows Server 2003 R2</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_RTM">Windows Server 2003</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_SP1">Windows Server 2003 Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_SP2">Windows Server 2003 Service Pack 2</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer8">Windows Server 2012 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer8_RTM">Windows Server 2012</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_10_0">Windows Server 2016 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_10_0_RTM">Windows Server 2016</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_6_3">Windows Server 2012 R2 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_6_3_RTM">Windows Server 2012 R2</string><string id="Microsoft.Policies.Products:MicrosoftWindowsVista">Windows Vista operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsVista_RTM">Windows Vista</string><string id="Microsoft.Policies.Products:MicrosoftWindowsVista_SP1">Windows Vista Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP">Windows XP operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP_RTM">Windows XP</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP_SP1">Windows XP Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP_SP2">Windows XP Service Pack 2</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0">Windows 10 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0_RT">Windows 10 RT operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0_RTM">Windows 10</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0_RT_RTM">Windows 10 RT</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3">Windows 8.1 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3_RT">Windows RT 8.1 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3_RTM">Windows 8.1</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3_RT_RTM">Windows RT 8.1</string><string id="Microsoft.Policies.Products:MicrosoftWindows_RT">Windows RT operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_RT_RTM">Windows RT</string><string id="Microsoft.Policies.Products:WindowsServer2008">Windows Server 2008 operating systems</string><string id="Microsoft.Policies.Products:WindowsServer2008_R2">Windows Server 2008 R2</string><string id="Microsoft.Policies.Products:WindowsServer2008_RTM">Windows Server 2008</string></strings>
Microsoft.Policies.VolumeEncryption:category:FVECategory
<category displayName="$(string.FVECategory)" name="FVECategory" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />
    </category>
<strings><string id="Microsoft.Policies.VolumeEncryption:FVECategory">BitLocker Drive Encryption</string></strings>
Microsoft.Policies.VolumeEncryption:category:FVEOSCategory
<category displayName="$(string.FVEOSCategory)" name="FVEOSCategory" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.VolumeEncryption:FVECategory" />
    </category>
<strings><string id="Microsoft.Policies.VolumeEncryption:FVEOSCategory">Operating System Drives</string></strings>
Microsoft.Policies.Windows:category:WindowsComponents
<category displayName="$(string.WindowsComponents)" explainText="$(string.WindowsComponents_Help)" name="WindowsComponents" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Windows:WindowsComponents">Windows Components</string><string id="Microsoft.Policies.Windows:WindowsComponents_Help">Contains settings for operating system components.</string></strings>
Microsoft.Policies.Windows:definition:SUPPORTED_Windows8
<definition displayName="$(string.SUPPORTED_Windows8)" name="SUPPORTED_Windows8" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <range minVersionIndex="7" ref="Microsoft.Policies.Products:MicrosoftWindows" />
        </or>
      </definition>
<strings><string id="Microsoft.Policies.Windows:SUPPORTED_Windows8">At least Windows Server 2012, Windows 8 or Windows RT</string></strings>