TPM with External Key (Require Startup USB Key At Every Startup)

In addition to the protection described in the previous paragraph, the TPM requires an external key provided by the user (see Figure below). This requires the user to insert a USB flash drive (or any other BIOS-enumerable storage device) containing the key, effectively authenticating both the user and the integrity of the computer. This can protect the data in the event the computer is stolen while the computer is shut down or in hibernation; resuming from standby does not require BitLocker protection. For this authentication technique to be effective, the user must store the external key separately from the computer to reduce the risk that they will be stolen simultaneously.

Note A n excellent way to prevent yourself from losing your startup key and to avoid leaving it connected to your computer is to connect your USB startup key to your key ring. If you leave the USB key connected, it is more likely to be stolen with the computer, and malicious software might be able to copy the key.