Bitlocker on 1709 Enhanced PIN

[Sheridan]

Maybe I'm missing something but we have GPOs that set Enhanced PINs for Bitlocker, yet on a brand new business HP laptop (with TPM 2 chip) we only get the pin/usb/autmatically unlock options when enabling it.

 

Ideally I'd like the password on boot option to unlock but it just won't appear - the GPO is being applied correctly. If it detects tpm does it disable this option?

[kennysarmy]

Maybe I'm missing something but we have GPOs that set Enhanced PINs for Bitlocker, yet on a brand new business HP laptop (with TPM 2 chip) we only get the pin/usb/autmatically unlock options when enabling it.

 

Ideally I'd like the password on boot option to unlock but it just won't appear - the GPO is being applied correctly. If it detects tpm does it disable this option?

 

 

According to this you can have pin / usb and use TPM

 

https://www.youtube.com/watch?v=OwUpH1uMZFQ

[Sheridan]

Its seems that if TPM is detected only PIN/USB is allowed - if you disable the TPM (in the bios) then you can specify to have a password (not pin) at boot.

 

I know TPM is probably better but as we widely used truecrypt staff are familiar with the password on boot option.