2

I'm setting up a Surface Pro 5 - m3, Windows 10. I have enabled several options for Bitlocker via GPO, one of which is Require additional authentication at startup, so that the user must enter a PIN before windows will load.

Using rsop.msc, I can see that the relevant GPO is enabled ...

enter image description here

However, when i come to activate/manage bitlocker, there is no option to set a PIN, just to use a USB flash drive, or have it unlocked automatically ...

enter image description here

This same policy has worked fine on the last 5+ Dell Optiplex and Inspiron desktops that I have set up, but I cannot figure out what the problem is with this tablet?! Thanks!

Just want to add that the tpm console says the tpm has a status of 'ready'.

Also, device manager shows that that TPM is version 2.0, and is working correctly ...

enter image description here

Improve this question
1
  • 1
    @PimpJuiceIT Thanks for your reply. Those options weren't enabled because I hadn't included them in my GPO (I wasn't fussed about minimum length, and I wasn't intending on using enhanced PINs). I enabled them both just to see if it made a difference, but unfortunately it didn't! Thanks for your help though :0)
    – 3-14159265358979323846264
    Aug 9, 2018 at 9:07

1 Answer 1

Reset to default
2

The answer was remarkably simple. You need to enable Enable use of BitLocker Authentication requiring preboot keyboard input on slates.

In short, some tablets don't provision a pre-boot on-screen keyboard, and thus would have no means to enter a PIN before boot.

After enabling this setting in my GPO, the required "Enter a PIN" option appeared as expected when I enabled Bitlocker on the OS drive.

Further reading Bitlocker PIN on Surface Pro 3 and Other Tablets

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .