Description: This policy setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption method has no effect if the drive is already encrypted, or if encryption is in progress. If you enable this policy setting you will be able to configure an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually. For fixed and operating system drives, we recommend that you use the XTS-AES algorithm. For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the drive will be used in other devices that are not running Windows 10 (Version 1511). If you disable or do not configure this policy setting, BitLocker will use AES with the same bit strength (128-bit or 256-bit) as the "Choose drive encryption method and cipher strength (Windows Vista, Windows Server 2008, Windows 7)" and "Choose drive encryption method and cipher strength" policy settings (in that order), if they are set. If none of the policies are set, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method specified by the setup script.

Why It's Important: This setting makes sure that all drives are protected using strong, modern encryption standards. It lets IT choose the best method for each type of drive, like using XTS-AES 256-bit for internal drives and AES-CBC for USB drives that might be used on older systems. This helps keep sensitive data safe from theft or tampering, even if the device is lost or stolen. It’s like choosing the strongest lock for each kind of door—ensuring security without sacrificing compatibility.-

Learn More

Description: This policy setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This policy setting is applied when you turn on BitLocker. The "Allow data recovery agent" check box is used to specify whether a data recovery agent can be used with BitLocker-protected fixed data drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents. In "Configure user storage of BitLocker recovery information" select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. Select "Omit recovery options from the BitLocker setup wizard" to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. In "Save BitLocker recovery information to Active Directory Domain Services" choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select "Backup recovery password and key package", both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "Backup recovery password only," only the recovery password is stored in AD DS. Select the "Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives" check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. Note: If the "Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives" check box is selected, a recovery password is automatically generated. If you enable this policy setting, you can control the methods available to users to recover data from BitLocker-protected fixed data drives. If this policy setting is not configured or disabled, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS.

Why It's Important: This setting makes sure there’s a safe and reliable way to unlock encrypted drives if something goes wrong—like a forgotten password or hardware issue. It allows recovery info (like a special unlock key) to be backed up securely to the organization’s system, so IT can help restore access without losing data. It’s like having a spare key stored in a secure vault, just in case someone gets locked out. This keeps data protected while still allowing recovery when needed.

Learn More

Description: This policy setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer. If you enable this policy setting, all fixed data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access. If you disable or do not configure this policy setting, all fixed data drives on the computer will be mounted with read and write access.

Why It's Important: This setting helps protect sensitive data by making sure that only encrypted drives can be used to store or modify files. If a drive isn’t protected by BitLocker, it becomes read-only—meaning users can view files but can’t add or change anything. It’s like saying, “You can look, but you can’t touch,” unless the drive is locked with encryption. This prevents data from being stored in unsafe places and helps enforce security standards across all devices.

Learn More

Description: This policy setting allows you to configure the encryption type used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose used space only encryption to require that only the portion of the drive used to store data is encrypted when BitLocker is turned on. If you enable this policy setting the encryption type that BitLocker will use to encrypt drives is defined by this policy and the encryption type option will not be presented in the BitLocker setup wizard. If you disable or do not configure this policy setting, the BitLocker setup wizard will ask the user to select the encryption type before turning on BitLocker.

Why It's Important: This setting ensures that BitLocker follows a consistent encryption method across all devices, based on what IT decides. It removes the option for users to choose during setup, which helps avoid mistakes and keeps security standards uniform. Whether encrypting the whole drive or just the parts with data, this policy makes sure the method is enforced automatically—like choosing one trusted way to lock every door, so no one accidentally leaves one unlocked.

Learn More

Description: This policy setting allows users on devices that are compliant with InstantGo or Microsoft Hardware Security Test Interface (HSTI) to not have a PIN for pre-boot authentication. This overrides the "Require startup PIN with TPM" and "Require startup key and PIN with TPM" options of the "Require additional authentication at startup" policy on compliant hardware. If you enable this policy setting, users on InstantGo and HSTI compliant devices will have the choice to turn on BitLocker without pre-boot authentication. If this policy is not enabled, the options of "Require additional authentication at startup" policy apply.

Why It's Important: This setting allows modern, secure devices to start up without needing a PIN every time, making the experience smoother for users while still keeping the system protected. These devices already meet strict security requirements, so requiring a PIN may be unnecessary and could slow things down. It’s like trusting a high-security smart lock to open without needing a code—because the hardware itself is already secure enough. However, this should only be used on verified, compliant devices to avoid weakening security.

Learn More

Description: This policy setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with or without a Trusted Platform Module (TPM). This policy setting is applied when you turn on BitLocker. Note: Only one of the additional authentication options can be required at startup, otherwise a policy error occurs. If you want to use BitLocker on a computer without a TPM, select the "Allow BitLocker without a compatible TPM" check box. In this mode either a password or a USB drive is required for start-up. When using a startup key, the key information used to encrypt the drive is stored on the USB drive, creating a USB key. When the USB key is inserted the access to the drive is authenticated and the drive is accessible. If the USB key is lost or unavailable or if you have forgotten the password then you will need to use one of the BitLocker recovery options to access the drive. On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 6-digit to 20-digit personal identification number (PIN), or both. If you enable this policy setting, users can configure advanced startup options in the BitLocker setup wizard. If you disable or do not configure this policy setting, users can configure only basic options on computers with a TPM. Note: If you want to require the use of a startup PIN and a USB flash drive, you must configure BitLocker settings using the command-line tool manage-bde instead of the BitLocker Drive Encryption setup wizard.

Why It's Important: This setting adds a layer of protection before the operating system even starts. Instead of relying only on the built-in security chip (TPM), it requires the user to enter something—like a PIN or insert a USB key—to unlock the drive. This helps prevent unauthorized access if someone tries to boot the computer without permission. It’s like needing both a key and a code to open a safe, making it much harder for attackers to get in.

Learn More

Description: This policy setting allows you to configure whether or not enhanced startup PINs are used with BitLocker. Enhanced startup PINs permit the use of characters including uppercase and lowercase letters, symbols, numbers, and spaces. This policy setting is applied when you turn on BitLocker. If you enable this policy setting, all new BitLocker startup PINs set will be enhanced PINs. Note: Not all computers may support enhanced PINs in the pre-boot environment. It is strongly recommended that users perform a system check during BitLocker setup. If you disable or do not configure this policy setting, enhanced PINs will not be used.

Why It's Important: This setting improves security by allowing more complex PINs when unlocking a device at startup. Instead of just using numbers like “1234,” users can create stronger combinations like “Pa$$w0rd!” which are much harder to guess or crack. It’s like upgrading from a basic lock to one with a custom code that’s tougher to break. This helps protect encrypted data from unauthorized access, especially in environments where security is a top priority.

Learn More

Description: This policy setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This policy setting is applied when you turn on BitLocker. The "Allow certificate-based data recovery agent" check box is used to specify whether a data recovery agent can be used with BitLocker-protected operating system drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents. In "Configure user storage of BitLocker recovery information" select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. Select "Omit recovery options from the BitLocker setup wizard" to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. In "Save BitLocker recovery information to Active Directory Domain Services", choose which BitLocker recovery information to store in AD DS for operating system drives. If you select "Backup recovery password and key package", both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "Backup recovery password only," only the recovery password is stored in AD DS. Select the "Do not enable BitLocker until recovery information is stored in AD DS for operating system drives" check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. Note: If the "Do not enable BitLocker until recovery information is stored in AD DS for operating system drives" check box is selected, a recovery password is automatically generated. If you enable this policy setting, you can control the methods available to users to recover data from BitLocker-protected operating system drives. If this policy setting is disabled or not configured, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS.

Why It's Important: This setting ensures that if someone gets locked out of their encrypted system drive—like forgetting a PIN or if the TPM fails—there’s a secure and reliable way to recover access. It lets IT define how recovery info is stored and used, such as saving recovery passwords in Active Directory or preventing users from choosing their own recovery options. This helps avoid data loss and keeps recovery consistent and secure across all devices. It’s like making sure every locked door has a backup key stored in a trusted place, and only the right people know how to use it.

Learn More

Description: This policy setting allows you to configure the encryption type used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose used space only encryption to require that only the portion of the drive used to store data is encrypted when BitLocker is turned on. If you enable this policy setting the encryption type that BitLocker will use to encrypt drives is defined by this policy and the encryption type option will not be presented in the BitLocker setup wizard. If you disable or do not configure this policy setting, the BitLocker setup wizard will ask the user to select the encryption type before turning on BitLocker.

Why It's Important: This setting ensures that BitLocker uses a consistent encryption approach across all devices, based on what IT decides. It removes the option for users to choose during setup, which helps avoid mistakes and keeps security standards uniform. Whether encrypting the whole drive or just the parts with data, this policy makes sure the method is enforced automatically—like choosing one trusted way to lock every door, so no one accidentally leaves one unlocked.

Learn More

Description: This policy setting allows you to configure the encryption type used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose used space only encryption to require that only the portion of the drive used to store data is encrypted when BitLocker is turned on. If you enable this policy setting the encryption type that BitLocker will use to encrypt drives is defined by this policy and the encryption type option will not be presented in the BitLocker setup wizard. If you disable or do not configure this policy setting, the BitLocker setup wizard will ask the user to select the encryption type before turning on BitLocker.

Why It's Important: This setting ensures that BitLocker uses a consistent encryption approach across all devices, based on what IT decides. It removes the option for users to choose during setup, which helps avoid mistakes and keeps security standards uniform. Whether encrypting the whole drive or just the parts with data, this policy makes sure the method is enforced automatically—like choosing one trusted way to lock every door, so no one accidentally leaves one unlocked.

Learn More

Description: This policy setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This policy setting is applied when you turn on BitLocker. The "Allow certificate-based data recovery agent" check box is used to specify whether a data recovery agent can be used with BitLocker-protected operating system drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents. In "Configure user storage of BitLocker recovery information" select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. Select "Omit recovery options from the BitLocker setup wizard" to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. In "Save BitLocker recovery information to Active Directory Domain Services", choose which BitLocker recovery information to store in AD DS for operating system drives. If you select "Backup recovery password and key package", both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "Backup recovery password only," only the recovery password is stored in AD DS. Select the "Do not enable BitLocker until recovery information is stored in AD DS for operating system drives" check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. Note: If the "Do not enable BitLocker until recovery information is stored in AD DS for operating system drives" check box is selected, a recovery password is automatically generated. If you enable this policy setting, you can control the methods available to users to recover data from BitLocker-protected operating system drives. If this policy setting is disabled or not configured, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS.

Why It's Important: This setting ensures that if someone gets locked out of their encrypted system drive—like forgetting a PIN or if the TPM fails—there’s a secure and reliable way to recover access. It lets IT define how recovery info is stored and used, such as saving recovery passwords in Active Directory or preventing users from choosing their own recovery options. This helps avoid data loss and keeps recovery consistent and secure across all devices. It’s like making sure every locked door has a backup key stored in a trusted place, and only the right people know how to use it.

Learn More

Description: This policy setting allows users to turn on authentication options that require user input from the pre-boot environment, even if the platform lacks pre-boot input capability. The Windows touch keyboard (such as that used by tablets) isn't available in the pre-boot environment where BitLocker requires additional information such as a PIN or Password. If you enable this policy setting, devices must have an alternative means of pre-boot input (such as an attached USB keyboard). If this policy is not enabled, the Windows Recovery Environment must be enabled on tablets to support the entry of the BitLocker recovery password. When the Windows Recovery Environment is not enabled and this policy is not enabled, you cannot turn on BitLocker on a device that uses the Windows touch keyboard. Note that if you do not enable this policy setting, options in the "Require additional authentication at startup" policy might not be available on such devices. These options include: - Configure TPM startup PIN: Required/Allowed - Configure TPM startup key and PIN: Required/Allowed - Configure use of passwords for operating system drives.

Why It's Important: This setting makes it possible to use secure BitLocker features—like entering a PIN before Windows starts—on tablets or other devices that don’t have built-in keyboards. Since touchscreens don’t work in the pre-boot environment, enabling this policy means users must connect a physical keyboard (like USB) to enter their credentials. It’s like adding a manual lock to a touchscreen device to make sure only authorized users can unlock it before Windows loads. This helps maintain strong security even on mobile or slate-style devices.

Learn More

Description: This policy setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption method has no effect if the drive is already encrypted, or if encryption is in progress. If you enable this policy setting you will be able to configure an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually. For fixed and operating system drives, we recommend that you use the XTS-AES algorithm. For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the drive will be used in other devices that are not running Windows 10 (Version 1511). If you disable or do not configure this policy setting, BitLocker will use AES with the same bit strength (128-bit or 256-bit) as the "Choose drive encryption method and cipher strength (Windows Vista, Windows Server 2008, Windows 7)" and "Choose drive encryption method and cipher strength" policy settings (in that order), if they are set. If none of the policies are set, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method specified by the setup script.”

Why It's Important: This setting makes sure that all drives are protected using strong, modern encryption standards. It lets IT choose the best method for each type of drive, like using XTS-AES 256-bit for internal drives and AES-CBC for USB drives that might be used on older systems. This helps keep sensitive data safe from theft or tampering, even if the device is lost or stolen. It’s like choosing the strongest lock for each kind of door—ensuring security without sacrificing compatibility.

Learn More

Description: This policy setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This policy setting is applied when you turn on BitLocker. The "Allow data recovery agent" check box is used to specify whether a data recovery agent can be used with BitLocker-protected fixed data drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents. In "Configure user storage of BitLocker recovery information" select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. Select "Omit recovery options from the BitLocker setup wizard" to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. In "Save BitLocker recovery information to Active Directory Domain Services" choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select "Backup recovery password and key package", both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "Backup recovery password only," only the recovery password is stored in AD DS. Select the "Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives" check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. Note: If the "Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives" check box is selected, a recovery password is automatically generated. If you enable this policy setting, you can control the methods available to users to recover data from BitLocker-protected fixed data drives. If this policy setting is not configured or disabled, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS.

Why It's Important: This setting makes sure there’s a safe and reliable way to unlock encrypted drives if something goes wrong—like a forgotten password or hardware issue. It allows recovery info (like a special unlock key) to be backed up securely to the organization’s system, so IT can help restore access without losing data. It’s like having a spare key stored in a secure vault, just in case someone gets locked out. This keeps data protected while still allowing recovery when needed.

Learn More

Description: This policy setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer. If you enable this policy setting, all fixed data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access. If you disable or do not configure this policy setting, all fixed data drives on the computer will be mounted with read and write access.

Why It's Important: This setting helps protect sensitive data by making sure that only encrypted drives can be used to store or modify files. If a drive isn’t protected by BitLocker, it becomes read-only—meaning users can view files but can’t add or change anything. It’s like saying, “You can look, but you can’t touch,” unless the drive is locked with encryption. This prevents data from being stored in unsafe places and helps enforce security standards across all devices.

Learn More

Description: This policy setting allows you to configure the encryption type used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose used space only encryption to require that only the portion of the drive used to store data is encrypted when BitLocker is turned on. If you enable this policy setting the encryption type that BitLocker will use to encrypt drives is defined by this policy and the encryption type option will not be presented in the BitLocker setup wizard. If you disable or do not configure this policy setting, the BitLocker setup wizard will ask the user to select the encryption type before turning on BitLocker.

Why It's Important: This setting ensures that BitLocker follows a consistent encryption method across all devices, based on what IT decides. It removes the option for users to choose during setup, which helps avoid mistakes and keeps security standards uniform. Whether encrypting the whole drive or just the parts with data, this policy makes sure the method is enforced automatically—like choosing one trusted way to lock every door, so no one accidentally leaves one unlocked.

Learn More

Description: This policy setting allows users on devices that are compliant with InstantGo or Microsoft Hardware Security Test Interface (HSTI) to not have a PIN for pre-boot authentication. This overrides the "Require startup PIN with TPM" and "Require startup key and PIN with TPM" options of the "Require additional authentication at startup" policy on compliant hardware. If you enable this policy setting, users on InstantGo and HSTI compliant devices will have the choice to turn on BitLocker without pre-boot authentication. If this policy is not enabled, the options of "Require additional authentication at startup" policy apply.

Why It's Important: [coming soon]

Learn More

Description: This policy setting allows you to configure whether or not enhanced startup PINs are used with BitLocker. Enhanced startup PINs permit the use of characters including uppercase and lowercase letters, symbols, numbers, and spaces. This policy setting is applied when you turn on BitLocker. If you enable this policy setting, all new BitLocker startup PINs set will be enhanced PINs. Note: Not all computers may support enhanced PINs in the pre-boot environment. It is strongly recommended that users perform a system check during BitLocker setup. If you disable or do not configure this policy setting, enhanced PINs will not be used.

Why It's Important: Allowing enhanced PINs helps strengthen pre-boot authentication by enabling more complex and secure credentials. It reduces the risk of unauthorized access and aligns with modern password standards. SHIELD enables this policy to improve protection without sacrificing usability. It’s like upgrading from a simple lock to one with a custom combination—harder to break, easier to trust.

Learn More

Description: This policy setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This policy setting is applied when you turn on BitLocker. The "Allow certificate-based data recovery agent" check box is used to specify whether a data recovery agent can be used with BitLocker-protected operating system drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents. In "Configure user storage of BitLocker recovery information" select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. Select "Omit recovery options from the BitLocker setup wizard" to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. In "Save BitLocker recovery information to Active Directory Domain Services", choose which BitLocker recovery information to store in AD DS for operating system drives. If you select "Backup recovery password and key package", both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "Backup recovery password only," only the recovery password is stored in AD DS. Select the "Do not enable BitLocker until recovery information is stored in AD DS for operating system drives" check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. Note: If the "Do not enable BitLocker until recovery information is stored in AD DS for operating system drives" check box is selected, a recovery password is automatically generated. If you enable this policy setting, you can control the methods available to users to recover data from BitLocker-protected operating system drives. If this policy setting is disabled or not configured, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS.

Why It's Important: Enabling this policy helps enforce secure and consistent recovery procedures across the organization. It ensures recovery credentials are backed up before encryption begins, supports centralized recovery through AD DS, and prevents users from bypassing or misconfiguring recovery options. SHIELD enables this policy to maintain control over recovery data and ensure encrypted systems remain accessible under authorized conditions. It’s like requiring a spare key to be stored securely before locking the door—ensuring recoverability without compromising security.

Learn More

Description: This policy setting allows you to configure a minimum length for a Trusted Platform Module (TPM) startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits and can have a maximum length of 20 digits. If you enable this policy setting, you can require a minimum number of digits to be used when setting the startup PIN. If you disable or do not configure this policy setting, users can configure a startup PIN of any length between 6 and 20 digits.

Why It's Important: This policy is like requiring a stronger lock on the front door. By enforcing a minimum PIN length, SHIELD ensures that users can’t choose weak or easily guessable PINs when starting up their devices. It helps protect against brute-force attacks and aligns authentication strength with the organization’s security standards. It also ensures that every device follows the same rules, making security more consistent and manageable. Even when shorter PINs are allowed, the system adjusts TPM behavior to maintain protection, keeping encrypted drives secure from unauthorized access.

Learn More

Description: This policy setting lets you configure the entire recovery message or replace the existing URL that are displayed on the pre-boot key recovery screen when the OS drive is locked. If you select the "Use default recovery message and URL" option, the default BitLocker recovery message and URL will be displayed in the pre-boot key recovery screen. If you have previously configured a custom recovery message or URL and want to revert to the default message, you must keep the policy enabled and select the "Use default recovery message and URL" option. If you select the "Use custom recovery message" option, the message you type in the "Custom recovery message option" text box will be displayed in the pre-boot key recovery screen. If a recovery URL is available, include it in the message. If you select the "Use custom recovery URL" option, the URL you type in the "Custom recovery URL option" text box will replace the default URL in the default recovery message, which will be displayed in the pre-boot key recovery screen. Note: Not all characters and languages are supported in pre-boot. It is strongly recommended that you test that the characters you use for the custom message or URL appear correctly on the pre-boot recovery screen.

Why It's Important: This policy is like leaving a helpful note next to a locked door explaining how to find the key. By customizing the recovery message and URL, SHIELD ensures users get clear, relevant instructions when they’re locked out of their encrypted system. It reduces confusion, speeds up recovery, and helps users contact the right support resources. It also allows organizations to maintain consistent branding and messaging, making the recovery process feel more professional and user-friendly. This improves both security and usability during critical recovery moments.

Learn More

Description: This policy setting allows users to turn on authentication options that require user input from the pre-boot environment, even if the platform lacks pre-boot input capability. The Windows touch keyboard (such as that used by tablets) isn't available in the pre-boot environment where BitLocker requires additional information such as a PIN or Password. If you enable this policy setting, devices must have an alternative means of pre-boot input (such as an attached USB keyboard). If this policy is not enabled, the Windows Recovery Environment must be enabled on tablets to support the entry of the BitLocker recovery password. When the Windows Recovery Environment is not enabled and this policy is not enabled, you cannot turn on BitLocker on a device that uses the Windows touch keyboard. Note that if you do not enable this policy setting, options in the "Require additional authentication at startup" policy might not be available on such devices. These options include: - Configure TPM startup PIN: Required/Allowed - Configure TPM startup key and PIN: Required/Allowed - Configure use of passwords for operating system drives.

Why It's Important: This policy is like making sure a tablet has a backup keyboard before locking it with a PIN. SHIELD enables this setting to allow secure startup authentication on devices that don’t have built-in keyboards, like tablets. It ensures that even these devices can use strong BitLocker protections without being locked out. By requiring an external keyboard, it makes sure users can still enter their PIN or password securely, keeping encryption consistent across all device types while maintaining usability.

Learn More

Description: This policy setting allows you to configure the encryption type used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose used space only encryption to require that only the portion of the drive used to store data is encrypted when BitLocker is turned on. If you enable this policy setting the encryption type that BitLocker will use to encrypt drives is defined by this policy and the encryption type option will not be presented in the BitLocker setup wizard. If you disable or do not configure this policy setting, the BitLocker setup wizard will ask the user to select the encryption type before turning on BitLocker.

Why It's Important: This policy is like deciding whether to lock every drawer in a cabinet or just the ones with items inside—and making sure everyone follows that rule. By enforcing the encryption type, SHIELD ensures that all devices use the same level of protection, whether it's full disk encryption for maximum security or used space only for faster setup. It removes the guesswork from users, prevents inconsistent configurations, and aligns with organizational standards. This helps maintain a predictable and secure environment across all encrypted systems.

Learn More

Description: This policy setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with or without a Trusted Platform Module (TPM). This policy setting is applied when you turn on BitLocker. Note: Only one of the additional authentication options can be required at startup, otherwise a policy error occurs. If you want to use BitLocker on a computer without a TPM, select the "Allow BitLocker without a compatible TPM" check box. In this mode either a password or a USB drive is required for start-up. When using a startup key, the key information used to encrypt the drive is stored on the USB drive, creating a USB key. When the USB key is inserted the access to the drive is authenticated and the drive is accessible. If the USB key is lost or unavailable or if you have forgotten the password then you will need to use one of the BitLocker recovery options to access the drive. On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 6-digit to 20-digit personal identification number (PIN), or both. If you enable this policy setting, users can configure advanced startup options in the BitLocker setup wizard. If you disable or do not configure this policy setting, users can configure only basic options on computers with a TPM. Note: If you want to require the use of a startup PIN and a USB flash drive, you must configure BitLocker settings using the command-line tool manage-bde instead of the BitLocker Drive Encryption setup wizard.

Why It's Important: This policy is like adding a second lock to your front door for extra protection. By requiring additional authentication at startup, SHIELD ensures that even if someone has physical access to a device, they still need a PIN, password, or USB key to unlock it. It strengthens security by preventing unauthorized access before the operating system even loads. This is especially important for devices that store sensitive data or operate in high-risk environments. It also gives organizations flexibility to choose the authentication method that best fits their security needs.

Learn More

Description: This policy setting controls the use of BitLocker on removable data drives. This policy setting is applied when you turn on BitLocker. When this policy setting is enabled you can select property settings that control how users can configure BitLocker. Choose "Allow users to apply BitLocker protection on removable data drives" to permit the user to run the BitLocker setup wizard on a removable data drive. Choose "Allow users to suspend and decrypt BitLocker on removable data drives" to permit the user to remove BitLocker Drive encryption from the drive or suspend the encryption while maintenance is performed. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information on suspending BitLocker protection. If you do not configure this policy setting, users can use BitLocker on removable disk drives. If you disable this policy setting, users cannot use BitLocker on removable disk drives.

Why It's Important: This policy is like setting rules for locking up portable storage. By enabling it, SHIELD ensures that removable drives follow the organization’s encryption standards, preventing users from making risky or inconsistent choices. It helps protect sensitive data on portable devices, reduces the chance of data leaks, and ensures that encryption is applied properly. It also gives IT teams control over how and when users can modify encryption settings, keeping security tight and predictable.

Learn More

Description: This policy setting configures whether BitLocker protection is required for a computer to be able to write data to a removable data drive. If you enable this policy setting, all removable data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access. If the "Deny write access to devices configured in another organization" option is selected, only drives with identification fields matching the computer's identification fields will be given write access. When a removable data drive is accessed it will be checked for valid identification field and allowed identification fields. These fields are defined by the "Provide the unique identifiers for your organization" policy setting. If you disable or do not configure this policy setting, all removable data drives on the computer will be mounted with read and write access. Note: This policy setting can be overridden by the policy settings under User Configuration\Administrative Templates\System\Removable Storage Access. If the "Removable Disks: Deny write access" policy setting is enabled this policy setting will be ignored.

Why It's Important: This policy is like refusing to write on a document unless it’s stored in a locked cabinet. By denying write access to unprotected removable drives, SHIELD ensures that sensitive data isn’t accidentally saved to insecure devices. It helps prevent data leaks, enforces encryption compliance, and protects information when drives are taken outside the organization. This keeps portable storage secure and ensures that only trusted, encrypted devices can be used to handle organizational data.

Learn More

Description: Allows Admin to disable all UI (notification for encryption and warning prompt for other disk encryption) and turn on encryption on the user machines silently. Warning: When you enable BitLocker on a device with third party encryption, it may render the device unusable and will require reinstallation of Windows. Note: This policy takes effect only if "RequireDeviceEncryption" policy is set to 1. The format is integer. The expected values for this policy are: 1 = This is the default, when the policy is not set. Warning prompt and encryption notification is allowed. 0 = Disables the warning prompt and encryption notification. Starting in Windows 10, next major update, the value 0 only takes affect on Azure Active Directory joined devices. Windows will attempt to silently enable BitLocker for value 0.

Why It's Important: This policy is like skipping the warning signs when locking a door, trusting that the system knows what it’s doing. By disabling warnings for other disk encryption, SHIELD ensures that BitLocker can be deployed silently and consistently across devices without user interruption. This supports streamlined onboarding and automation in enterprise environments. However, it also assumes that SHIELD has validated the absence of conflicting encryption tools—since enabling BitLocker over third-party encryption could render devices unusable. Enforcing this policy helps maintain control over encryption standards while minimizing user friction.

Learn More

Description: Allows Admin to configure Numeric Recovery Password Rotation upon use for OS and fixed drives on AAD and Hybrid domain joined devices. When not configured, Rotation is turned on by default for AAD only and off on Hybrid. The Policy will be effective only when Active Directory back up for recovery password is configured to required. For OS drive: Turn on "Do not enable Bitlocker until recovery information is stored to AD DS for operating system drives" For Fixed drives: Turn on "Do not enable Bitlocker until recovery information is stored to AD DS for fixed data drives" Supported Values: 0 - Numeric Recovery Passwords rotation OFF. 1 - Numeric Recovery Passwords Rotation upon use ON for AAD joined devices. Default value 2 - Numeric Recovery Passwords Rotation upon use ON for both AAD and Hybrid devices.

Why It's Important: This policy is like changing the combination on a lock after someone uses the backup key. By enabling recovery password rotation, SHIELD ensures that once a recovery password is used, it is automatically replaced with a new one—reducing the risk of reuse or exposure. It strengthens protection against insider threats, supports compliance with key management best practices, and ensures that recovery credentials remain secure across the tenant.-

Learn More