deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-12 21:37:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity
windows-itpro-docs/windows/security/operating-system-security/data-protection/bitlocker/includes/allow-secure-boot-for-integrity-validation.md
Paolo Matarazzo c7e9f009b8 Addition of PCR 4
2024-07-18 10:02:07 -04:00

2.1 KiB
Raw Blame History

author, ms.author, ms.date, ms.topic
author ms.author ms.date ms.topic
paolomatarazzo paoloma 07/18/2024 include

Allow Secure Boot for integrity validation

This policy setting allows you to configure whether Secure Boot is allowed as the platform integrity provider for BitLocker operating system drives.

Secure Boot ensures that the device's preboot environment only loads firmware that is digitally signed by authorized software publishers.

  • If you enable or don't configure this policy setting, BitLocker uses Secure Boot for platform integrity if the platform is capable of Secure Boot-based integrity validation
  • If you disable this policy setting, BitLocker uses legacy platform integrity validation, even on systems capable of Secure Boot-based integrity validation

When this policy is enabled and the hardware is capable of using Secure Boot for BitLocker scenarios, the Use enhanced Boot Configuration Data validation profile policy setting is ignored and Secure Boot verifies BCD settings according to the Secure Boot policy setting, which is configured separately from BitLocker.

Note

If the policy setting Configure TPM platform validation profile for native UEFI firmware configurations is enabled and has PCR 7 omitted, BitLocker is prevented from using Secure Boot for platform or Boot Configuration Data (BCD) integrity validation.

Warning

Disabling this policy might result in BitLocker recovery when manufacturer-specific firmware is updated. If this policy is disabled, suspend BitLocker prior to applying firmware updates.

Path
CSP Not available
GPO Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives

Note

To prevent boot manger roll-back attacks, Windows updates released on and after July 2024 changed the default PCR Validation Profile for UEFI with Secure Boot from 7, 11 to 4, 7, 11.