How to Enable the Use of BitLocker on the System Volume on Computers Without TPM

BitLocker can store decryption keys on a USB flash drive instead of using a built-in TPM module. This allows you to use BitLocker on computers that do not have the TPM hardware. Using BitLocker in this configuration can be risky, however, because if the user loses the USB flash drive, the encrypted volume will no longer be accessible and the computer will not be able to start without the recovery key. Windows 7 does not make this option available by default.

To use BitLocker encryption on a computer without a compatible TPM, you will need to change a computer Group Policy setting by following these steps:

1. Open the Group Policy Editor by clicking Start, typing gpedit.msc, and then pressing Enter.
2. Navigate to Computer Configuration\Policies\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives\Require Additional Authentication At Startup. For computers running Windows Vista and Windows Server 2008 (prior to Windows Server 2008 R2), select the Require Additional Authentication At Startup (Windows Server 2008 And Windows Vista) policy.
3. Enable the setting and then select the Allow BitLocker Without A Compatible TPM check box.