The following article contains information about creating and using BitLocker with a Personal Identification Number (PIN).
Table of Contents:
- How to Create a BitLocker Pre-Boot Security Prompt Requiring a Personal Identification Number (PIN)
- Activate the TPM
- Enable BitLocker
- Edit the Group Policy
- Use the Command Prompt to Create a PIN
- Windows 10 Steps
How to Create a BitLocker Pre-Boot Security Prompt Requiring a Personal Identification Number (PIN)
As an extra layer of security, an administrator may choose to create a BitLocker preboot security prompt requiring a Personal Identification Number (PIN). This feature is available in Windows 7 Enterprise and Ultimate, and Windows 8 Enterprise and Ultimate. It can only be enabled on systems with a Trusted Platform Module (TPM) chip, typically a Latitude, OptiPlex, or Dell Precision system.
The process below is an advanced procedure and should only be attempted with the knowledge of the system administrator. The details are written for the audience of a system administrator.
Activate the TPM
Back to Top
- Use the security features of your system’s BIOS to enable the TPM.
- Check the box to clear the TPM, apply changes, and exit the BIOS.
- Boot into the BIOS again and use the security features of your system’s BIOS to activate the TPM.
- Apply changes and exit the BIOS.
Back to Top
- Boot into Windows.
- Use the preferred Microsoft process to Enable BitLocker and encrypt the entire disk containing the Operating System.
Edit the Group Policy
Back to Top
- Open the Group Policy Editor by using the "Run…" executable, typing in "gpedit.msc" and clicking the "OK" button.
- Navigate to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
- In the right pane, double-click "Require additional authentication at startup" and a popup box will open.
- Make sure the "Enabled" option is chosen so that all other options below will be active.
- Uncheck the box for "Allow BitLocker without a compatible TPM."
- For the choice of "Configure TPM startup:", choose "Allow TPM."
- For the choice of "Configure TPM startup PIN:", choose "Require startup PIN with TPM."
- For the choice of "Configure TPM startup key:", choose "Allow startup key with TPM."
- For the choice of "Configure TPM startup key and PIN:", choose "Allow startup key and PIN with TPM."
- Click the "Apply" button and then the "OK" button to save the changes in the Local Group Policy Editor.
Use the Command Prompt to Create a PIN
Back to Top
- Open an elevated Command Prompt window with administrator rights.
- Excluding the quotation marks, enter the command "manage-bde -protectors -add c: -TPMAndPIN".
- You are prompted to enter the PIN. Enter a number between four and seven digits. The cursor will not register the keystrokes as you enter the number.
- Hit the Enter key to save the PIN, and you are prompted to enter the PIN again to confirm. Hit the Enter key again to save the PIN confirmation.
- Excluding the quotation marks, enter the command "manage-bde -status."
- The BitLocker Drive Encryption status shows the "Key Protectors:" as "Numerical Password," "TPM and PIN."
- Now, each time the user boots the system, they receive a BitLocker preboot security prompt requiring the PIN to be entered before access to the operating system is granted.
Windows 10 Steps
The following link contains steps for Windows 10:
BitLocker Group Policy Settings
If you have further questions about this article, contact Dell Technical Support. Back to Top