I'm setting up a Surface Pro 5 - m3, Windows 10. I have enabled several options for Bitlocker via GPO, one of which is Require additional authentication at startup, so that the user must enter a PIN before windows will load.

Using rsop.msc, I can see that the relevant GPO is enabled ...

enter image description here

However, when i come to activate/manage bitlocker, there is no option to set a PIN, just to use a USB flash drive, or have it unlocked automatically ...

enter image description here

This same policy has worked fine on the last 5+ Dell Optiplex and Inspiron desktops that I have set up, but I cannot figure out what the problem is with this tablet?! Thanks!

Just want to add that the tpm console says the tpm has a status of 'ready'.

Also, device manager shows that that TPM is version 2.0, and is working correctly ...

enter image description here

  • 1
    @PimpJuiceIT Thanks for your reply. Those options weren't enabled because I hadn't included them in my GPO (I wasn't fussed about minimum length, and I wasn't intending on using enhanced PINs). I enabled them both just to see if it made a difference, but unfortunately it didn't! Thanks for your help though :0) – 3-14159265358979323846264 Aug 9 '18 at 9:07

The answer was remarkably simple. You need to enable Enable use of BitLocker Authentication requiring preboot keyboard input on slates.

In short, some tablets don't provision a pre-boot on-screen keyboard, and thus would have no means to enter a PIN before boot.

After enabling this setting in my GPO, the required "Enter a PIN" option appeared as expected when I enabled Bitlocker on the OS drive.

Further reading Bitlocker PIN on Surface Pro 3 and Other Tablets

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.