16 KiB
title, description, ms.collection, ms.topic, ms.date
| title | description | ms.collection | ms.topic | ms.date | |
|---|---|---|---|---|---|
| BitLocker policy settings | Learn about the policy settings to configure BitLocker. |
|
reference | 09/19/2023 |
BitLocker policy settings
This reference article describes the policy settings to configure BitLocker via configuration service provider (CSP) and group policy (GPO).
BitLocker and policies compliance
If a device isn't compliant with the existing policies, BitLocker may not be turned on, or BitLocker configuration may be modified until the computer is in a compliant state. When a drive becomes out of compliance with policy settings, only changes to the BitLocker configuration that will bring it into compliance are allowed. Such scenario could occur, for example, if a previously encrypted drive was brought out of compliance by change in policy settings.
If multiple changes are necessary to bring the drive into compliance, BitLocker protection may need to be suspended, the necessary changes made, and then protection resumed. Such situation could occur, for example, if a removable drive is initially configured for unlock with a password but then policy settings are changed to disallow passwords and require smart cards. In this situation, BitLocker protection needs to be suspended by using the manage-bde command-line tool, delete the password unlock method, and add the smart card method. After this process is complete, BitLocker is compliant with the policy setting, and BitLocker protection on the drive can be resumed.
In other scenarios, to bring the drive into compliance with a change in policy settings, BitLocker may need to be disabled and the drive decrypted followed by re-enabling BitLocker and then re-encrypting the drive. An example of this scenario is when the BitLocker encryption method or cipher strength is changed. The manage-bde command-line can also be used in this scenario to help bring the device into compliance.
Important
Most of the BitLocker settings are applied when BitLocker is initially turned on for a drive. Encryption isn't restarted if settings change.
Settings list
The list of settings is sorted alphabetically and organized in four tabs:
- Common settings: settings applicable to all BitLocker-protected drives
- Operating system drive: settings applicable to the drive where Windows is installed
- Fixed data drives: settings applicable to any local drives, except the operating system drive
- Removable data drives: settings applicable to any removable drives
:::image type="icon" source="images/locked-drive.svg"::: Common settings
The following table lists the BitLocker policies applicable to all drive types, indicating if they're applicable via configuration service provider (CSP) and/or group policy (GPO). Select the policy name for more details.
[!INCLUDE allow-standard-user-encryption] [!INCLUDE allow-suspension-of-bitlocker-protection] [!INCLUDE choose-default-folder-for-recovery-password] [!INCLUDE choose-drive-encryption-method-and-cipher-strength] [!INCLUDE configure-recovery-password-rotation] [!INCLUDE disable-new-dma-devices-when-this-computer-is-locked] [!INCLUDE prevent-memory-overwrite-on-restart] [!INCLUDE provide-the-unique-identifiers-for-your-organization] [!INCLUDE validate-smart-card-certificate-usage-rule-compliance]
:::image type="icon" source="images/os-drive.svg"::: Operating system drive
[!INCLUDE allow-devices-compliant-with-instantgo-or-hsti-to-opt-out-of-pre-boot-pin] [!INCLUDE allow-enhanced-pins-for-startup] [!INCLUDE allow-network-unlock-at-startup] [!INCLUDE allow-secure-boot-for-integrity-validation] [!INCLUDE allow-warning-for-other-disk-encryption] [!INCLUDE choose-how-bitlocker-protected-operating-system-drives-can-be-recovered] [!INCLUDE configure-minimum-pin-length-for-startup] [!INCLUDE configure-pre-boot-recovery-message-and-url] [!INCLUDE configure-tpm-platform-validation-profile-for-bios-based-firmware-configurations] [!INCLUDE configure-tpm-platform-validation-profile-for-native-uefi-firmware-configurations] [!INCLUDE configure-use-of-hardware-based-encryption-for-operating-system-drives] [!INCLUDE configure-use-of-passwords-for-operating-system-drives] [!INCLUDE disallow-standard-users-from-changing-the-pin-or-password] [!INCLUDE enable-use-of-bitlocker-authentication-requiring-preboot-keyboard-input-on-slates] [!INCLUDE enforce-drive-encryption-type-on-operating-system-drives] [!INCLUDE require-additional-authentication-at-startup] [!INCLUDE require-device-encryption] [!INCLUDE reset-platform-validation-data-after-bitlocker-recovery] [!INCLUDE use-enhanced-boot-configuration-data-validation-profile]
:::image type="icon" source="images/unlocked-drive.svg"::: Fixed data drives
[!INCLUDE choose-how-bitlocker-protected-fixed-drives-can-be-recovered] [!INCLUDE configure-use-of-hardware-based-encryption-for-fixed-data-drives] [!INCLUDE configure-use-of-passwords-for-fixed-data-drives] [!INCLUDE configure-use-of-smart-cards-on-fixed-data-drives] [!INCLUDE deny-write-access-to-fixed-drives-not-protected-by-bitlocker] [!INCLUDE enforce-drive-encryption-type-on-fixed-data-drives]
:::image type="icon" source="images/unlocked-drive.svg"::: Removable data drives
[!INCLUDE choose-how-bitlocker-protected-removable-drives-can-be-recovered] [!INCLUDE configure-use-of-hardware-based-encryption-for-removable-data-drives] [!INCLUDE configure-use-of-passwords-for-removable-data-drives] [!INCLUDE configure-use-of-smart-cards-on-removable-data-drives] [!INCLUDE control-use-of-bitlocker-on-removable-drives] [!INCLUDE deny-write-access-to-removable-drives-not-protected-by-bitlocker] [!INCLUDE enforce-drive-encryption-type-on-removable-data-drives] [!INCLUDE removable-drives-excluded-from-encryption]
Platform Configuration Register (PCR)
A platform validation profile consists of a set of PCR indices that range from 0 to 23. The scope of the values can be specific to the version of the operating system.
Changing from the default platform validation profile affects the security and manageability of a computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs.
About PCR 7
PCR 7 measures the state of Secure Boot. With PCR 7, BitLocker can use Secure Boot for integrity validation. Secure Boot ensures that the computer's preboot environment loads only firmware that is digitally signed by authorized software publishers. PCR 7 measurements indicate whether Secure Boot is on and which keys are trusted on the platform. If Secure Boot is on and the firmware measures PCR 7 correctly per the UEFI specification, BitLocker can bind to this information rather than to PCRs 0, 2, and 4, which have the measurements of the exact firmware and Bootmgr images loaded. This process reduces the likelihood of BitLocker starting in recovery mode as a result of firmware and image updates, and it provides with greater flexibility to manage the preboot configuration.
PCR 7 measurements must follow the guidance that is described in Appendix A Trusted Execution Environment EFI Protocol.
PCR 7 measurements are a mandatory logo requirement for systems that support Modern Standby (also known as Always On, Always Connected PCs), such as the Microsoft Surface RT. On such systems, if the TPM with PCR 7 measurement and secure boot are correctly configured, BitLocker binds to PCR 7 and PCR 11 by default.