1.2.4.2.2.20 Set 'Configure TPM startup key:' to 'Do not allow startup key with TPM'

Information

This policy setting allows you to configure whether BitLocker requires additional authentication each time the
computer starts and whether you are using BitLocker with or without a Trusted Platform Module (TPM).

Solution

Make sure 'Configure TPM startup key:' is set to 'Do not allow startup key with TPM'

See Also

https://workbench.cisecurity.org/files/17

Item Details

Category: IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|IA-5c., 800-53|SC-28(1), CSCv6|13.2, CSCv6|16.11

Plugin: Windows

Control ID: 790ff747a2e2f52109dd67e7ee54d96e43d3cc98e00d3a01e52131dc789d471e