Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running Windows 7 RTM and have both physical drives BitLockered. Because my machine has a TPM it will boot all very nicely when I turn it on. But my employers would prefer if I was challenged for a password at boot time.

I have found this article: http://4sysops.com/archives/review-windows-7-bitlocker/ that tells me which group policy flags to set to get it BitLocker to challenge for a PIN at startup.

What I can't find is how to set this PIN given the system is already encrypted?

I have also come across http://technet.microsoft.com/en-us/library/dd875532%28WS.10%29.aspx and am curious to know which of these recommendations it is safe to apply to an already encrypted system?

share|improve this question
add comment

4 Answers

Found the answer, assuming you have BitLocker up and running, make the changes:

To enable TPM & PIN at boot:

Using the Group Policy Editor (Start -> gpedit.msc and press Enter), go to :

Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > Bitlocker Drive Encryption > Operating System Drives

and open the key

"Require additional authentication at startup"

Then enable that Key and set "Configure TPM startup Pin:" to "Require startup PIN with TPM"

To set the actual PIN use in a CMD prompt

manage-bde -protectors -add c: -TPMAndPIN 

This will prompt you for a PIN which it then requires you to enter at Boot.

share|improve this answer
2  
I think it's "cscript manage-bde.wsf -protectors -add c: -TPMAndPIN" - right? Also, I think that changing the group policy isn't necessary unless you want to force the use of TPM+PIN on subsequently encrypted volumes. In this case, just adding the PIN (via the "manage-bde" cmd) is what is desired. Anyway, +1 for all the detail! –  Garrett Aug 18 '09 at 13:25
    
Thanks, we've been looking for this answer for the last 2 weeks. –  Richard Clayton May 6 '11 at 15:36
    
On Windows 8.1, you have to modify Group Policy and enable the aforementioned key (no need to change it to 'require' though; the default 'allow' is fine). If you don't, the latter command will fail and tell you to modify Group Policy. –  Sam Jan 22 at 9:01
add comment

I found it wouldnt work without the Group Policy set. When trying to set the PIN it returned an error stating this policy had not been set in Group Policy

share|improve this answer
add comment

Windows 7 - type in search box(start) 'cmd" right click on the program found above; 'cmd' and select 'run as administrator" then use manage-bde -protectors -add c: -TPMAndPIN as stated above

share|improve this answer
add comment

http://technet.microsoft.com/en-us/library/dd875513(WS.10).aspx#BKMK_protectors

run as admin to delete the associated protectors: cscript manage-bde.wsf -protectors -delete

Then add just the TPM only: cscript manage-bde.wsf -protectors -add -tpm

To check which protectors are being used by your system run cscript manage-bde.wsf -status

If you are using Win 7 change manage-bde.wsf to manage-bde.exe and you are good to go.

share|improve this answer
add comment

protected by Sam Nov 29 '11 at 10:38

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.