How to Manage BitLocker with Group Policy

BitLocker has several Group Policy settings located in Computer Configuration\Policies \Administrative Templates\Windows Components\BitLocker Drive Encryption that you can use to manage the available features. Table below lists these policies, which are written to the registry on targeted computers under the following registry key:

HKLM\Software\Policies\Microsoft\FVE Group Policy Settings for BitLocker Drive Encryption

Policy	Description
Store BitLocker Recovery Information In Active Directory Domain Services (Windows Server 2008 And Windows Vista)	Enabling this policy silently backs up BitLocker recovery information to AD DS. For computers running Windows 7 and Windows Server 2008 R2, enable the Fixed Data Drives \Choose How BitLocker-Protected Fixed Drives Can Be Recovered, Operating System Drives\Choose How BitLocker- Protected Operating System Drives Can Be Recovered, or Removable Data Drives\Choose How BitLocker-Protected Removable Drives Can Be Recovered policies.
Choose Default Folder For Recovery Password	Enabling this policy and configuring a default path for it sets the default folder to display when the user is saving recovery information for BitLocker. The user will have the ability to override the default.
Choose How Users Can Recover BitLocker-Protected Drives (Windows Server 2008 And Windows Vista)	Enabling this policy allows you to control which recovery mechanisms the user can choose. Disabling the recovery password will disable saving to a folder or printing the key because these actions require the 48-digit recovery password. Disabling the 256-bit recovery key will disable saving to a USB key. If you disable both options, you must enable AD DS backup or a policy error will occur. For computers running Windows 7 and Windows Server 2008 R2, enable the Fixed Data Drives\Choose How BitLocker-Protected Fixed Drives Can Be Recovered, Operating System Drives\Choose How BitLocker-Protected Operating System Drives Can Be Recovered, or Removable Data Drives\Choose How BitLocker- Protected Removable Drives Can Be Recovered policies.
Choose Drive Encryption Method And Cipher Strength	Enabling this policy allows configuration of the encryption method used by BitLocker Drive Encryption. The default if this key is not enabled is 128-bit AES with Diffuser. Other choices that can be configured are 256-bit AES with Diffuser, 128-bit AES, and 256-bit AES.
Prevent Memory Overwrite On Restart	Enabling this policy prevents Windows from overwriting memory on restarts. This potentially exposes BitLocker secrets but can improve restart performance.
Provide The Unique Identifiers For Your Organization	Enable this policy if you want to prevent users from mounting BitLocker-protected drives that might be from outside organizations.
Validate Smart Card Certificate Usage Rule Compliance	Enable this policy only if you want to restrict users to smart cards that have an object identifier (OID) that you specify.
Operating System Drives \Require Additional Authentication At Startup or Operating System Drives \Require Additional Authentication At Startup (Windows Server 2008 And Windows Vista)	Enabling this policy allows configuring additional startup options and allows enabling of BitLocker on a non-TPMcompatible computer. On TPM-compatible computers, a secondary authentication can be required at startup-either a USB key or a startup PIN, but not both.
Allow Enhanced PINs For Startup	Enhanced PINs permit the use of characters including uppercase and lowercase letters, symbols, numbers, and spaces. By default, enhanced PINs are disabled.
Operating System Drives \Configure Minimum PIN Length For Startup	Enables you to require a minimum PIN length.
Operating System Drives \Choose How BitLocker- Protected Operating System Drives Can Be Recovered	Enabling this policy allows you to control which recovery mechanisms the user can choose and whether recovery information is stored in the AD DS. Disabling the recovery password will disable saving to a folder or printing the key because these actions require the 48-digit recovery password. Disabling the 256-bit recovery key will disable saving to a USB key.
Operating System Drives \Configure TPM Platform Validation Profile	Enabling this policy allows detailed configuration of the PCR indices. Each index aligns with Windows features that run during startup.
Fixed Data Drives\Configure Use Of Smart Cards On Fixed Data Drives	Enables or requires smart cards for BitLocker to protect non-operating system volumes.
Fixed Data Drives\Deny Writer Access To Fixed Drives Not Protected By BitLocker	Requires drives to be BitLocker-protected before users can save files.
Fixed Data Drives\Allow Access To BitLocker-Protected Fixed Data Drives From Earlier Versions Of Windows	Allows you to prevent the BitLocker To Go Reader from being copied to fixed data drives, preventing users of earlier versions of Windows (including Windows Server 2008, Windows Vista, and Windows XP SP2 or SP3) from entering a password to access the drive.
Fixed Data Drives\Configure Use Of Passwords For Fixed Drives	Requires passwords to access BitLocker-protected fixed drives and configures password complexity.
Fixed Data Drives\Choose How BitLocker-Protected Fixed Drives Can Be Recovered	Enabling this policy allows you to control which recovery mechanisms the user can choose and whether recovery information is stored in the AD DS. Disabling the recovery password will disable saving to a folder or printing the key because these actions require the 48-digit recovery password. Disabling the 256-bit recovery key will disable saving to a USB key.

For information about BitLocker To Go policies (which are configured in the Removable Data Drives node), refer to the section titled "BitLocker To Go" earlier in this tutorial.

[Previous] [Contents] [Next]

How to Manage BitLocker with Group Policy

In this tutorial: