Windows-Setup/Group Policies/Computer Configuration/Windows Components/Bitlocker Drive Encryption.md

# Bitlocker Drive Encryption

`Computer Configuration\Administrative Templates\Windows Components\Bitlocker Drive Encryption`

Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later) -> Enable -> XTS-AES 256-bit for operating system, fixed data, and removable drives.

**The disable new DMA devices when computer is locked should only be enabled if your computer does not support kernel DMA protection.**

## Operating System Drives

- Require additional authentication at startup -> Enabled -> Do not allow TPM, Allow startup PIN with TPM, Do not allow startup key with TPM, Allow startup key and PIN with TPM. (**This is especially important as we do not want the TPM to automatically release the encryption key at boot.**)
- Allow enhanced PINs for startup -> Enabled.
- Configure TPM platform validation profile for native UEFI firmware configurations -> Enabled -> PCR 0,1,2,3,3,4,5,6,7,11
Update Signed-off-by: Tommy <contact@tommytran.io> 2023-11-06 09:07:29 -05:00			`# Bitlocker Drive Encryption`

Restructure Signed-off-by: Tommy <contact@tommytran.io> 2023-11-07 02:21:23 -05:00			`Computer Configuration\Administrative Templates\Windows Components\Bitlocker Drive Encryption`
Update Signed-off-by: Tommy <contact@tommytran.io> 2023-11-06 09:07:29 -05:00
			`Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later) -> Enable -> XTS-AES 256-bit for operating system, fixed data, and removable drives.`

Mention the disable new DMA devices policy Signed-off-by: Tommy <contact@tommytran.io> 2023-11-14 16:18:42 -05:00			`The disable new DMA devices when computer is locked should only be enabled if your computer does not support kernel DMA protection.`

Update Signed-off-by: Tommy <contact@tommytran.io> 2023-11-06 09:07:29 -05:00			`## Operating System Drives`

Fix formatting Signed-off-by: Tommy <contact@tommytran.io> 2023-11-06 10:12:37 -05:00			`- Require additional authentication at startup -> Enabled -> Do not allow TPM, Allow startup PIN with TPM, Do not allow startup key with TPM, Allow startup key and PIN with TPM. (This is especially important as we do not want the TPM to automatically release the encryption key at boot.)`
Updated PCR bindings Signed-off-by: Tommy <contact@tommytran.io> 2023-11-20 17:41:38 -05:00			`- Allow enhanced PINs for startup -> Enabled.`
Add PCR 6 Signed-off-by: Tommy <contact@tommytran.io> 2023-11-20 17:46:33 -05:00			`- Configure TPM platform validation profile for native UEFI firmware configurations -> Enabled -> PCR 0,1,2,3,3,4,5,6,7,11`