My infrastructue uses BitLocker encrypted drives with TPM but no start up PIN. Recovery keys are stored in the AD. A few of my users are worried that no startup PIN is insecure as to the old WinMagic setup with a startup PIN before booting the OS.
In our design it is clearly stated that the most important thing is that the hard drive is encrypted in case the computer is stolen or lost.
What can I tell my concerned users, that will make them understand that the startup PIN does not really introduce any extra security.