3.11.7.2.15 (BL) Ensure 'Require additional authentication at startup: Configure TPM startup:' is set to 'Enabled: Do not allow TPM'

Information

This policy setting allows you to configure whether BitLocker requires additional authentication each time the computer starts. This policy setting is applied when you turn on BitLocker.

Note: Only one of the additional authentication options can be

required

at startup, otherwise a policy error occurs.

On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 4-digit to 20-digit personal identification number (PIN), or both.

The recommended state for this setting is: Enabled: Do not allow TPM

TPM without use of a PIN will only validate early boot components and does not require a user to enter any additional authentication information. If a computer is lost or stolen in this configuration, BitLocker will not provide any additional measure of protection beyond what is provided by native Windows authentication unless the early boot components are tampered with or the encrypted drive is removed from the machine.

Solution

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Enabled: Do not allow TPM

Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives\Require additional authentication at startup: Configure TPM startup:

Impact:

A TPM alone will be insufficient authentication for use with BitLocker.

See Also

https://workbench.cisecurity.org/benchmarks/16852