BitLocker Drive Encryption Policy Registry Key

BitLocker Drive Encryption policy settings in Windows are stored in specific locations within the Windows Registry. This article details the exact registry keys in the Registry Editor (Regedit) responsible for BitLocker configuration policies, explains the significance of the “FVE” naming convention, and highlights the standard subkeys used to manage encryption requirements across different drive types.

The Primary BitLocker Policy Registry Key

The primary registry key that holds the Group Policy configurations for BitLocker Drive Encryption is:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE

In Windows, FVE stands for Full Volume Encryption, which is the internal engineering name for BitLocker. When an administrator configures BitLocker settings through Local Group Policy Editor (gpedit.msc) or Microsoft Intune/Active Directory Group Policy Objects (GPOs), the applied rules are written to this path.

How to Access the Key in Regedit

1. Press Windows Key + R, type regedit, and press Enter.

2. Navigate to the following path:

   Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE

Note: If BitLocker policies have never been configured via Group Policy or MDM on the device, the FVE key may not exist by default until a policy is explicitly defined.

Key Policy Settings Stored Under FVE

Within the FVE key, various DWORD (32-bit) and String values determine how BitLocker behaves on the system:

• Encryption Method and Cipher Strength: Values like EncryptionMethodWithXtsOs, EncryptionMethodWithXtsFdv, and EncryptionMethodWithXtsRdv dictate encryption algorithms (e.g., AES-CBC 128/256 or XTS-AES 128/256) for Operating System drives, Fixed Data drives, and Removable Data drives.
• Operating System Drive Authentication: Values such as UseAdvancedStartup, UseTPM, UseTPMKey, UseTPMPIN, and UseTPMKeyPIN control startup authentication requirements (e.g., requiring a TPM PIN or startup USB key).
• Recovery Options: Values such as OSRecovery, OSRecoveryPassword, and OSManageDRA manage whether BitLocker recovery keys and passwords are generated and backed up to Active Directory or Microsoft Entra ID.

Non-Policy Configuration Keys

While HKLM\SOFTWARE\Policies\Microsoft\FVE holds administrative and enforced policy rules, general BitLocker status and low-level driver configurations are managed under:

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BitLocker
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FVE

These keys contain hardware-level states and operational configurations rather than administrative policy enforcements.