Find Bluetooth Encryption Settings in Registry

This article outlines the exact Windows Registry locations used to configure and enforce system-wide Bluetooth peripheral encryption modes. It details the primary registry paths within the HKEY_LOCAL_MACHINE hive, highlighting the specific keys that govern Bluetooth driver security parameters, link keys, and group policy-level encryption enforcement.

Primary Bluetooth Configuration Path

The core driver parameters and system-wide security settings for the Windows Bluetooth stack are located in the following path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters

This node manages standard hardware communication and security rules for Bluetooth ports. Within this key, administrators can configure system-wide security requirements, such as enforcing specific encryption levels or minimum key sizes across all connected peripherals.

Stored Link and Encryption Keys

To inspect device-specific link keys and pairing-generated encryption credentials, navigate to the Keys subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys

• Subkeys: Each local Bluetooth host controller is listed by its MAC address (e.g., 001a7dda7113).
• Values: Inside each host adapter subkey, paired peripheral devices are represented as REG_BINARY values matching the peripheral’s MAC address, containing the negotiated 128-bit encryption/link keys.
• Permissions: Accessing this key requires elevated permissions (SYSTEM or NT AUTHORITY\SYSTEM), as standard administrator tokens are restricted by default.

Group Policy Enforcement Path

For environments enforcing encryption via Windows Policy or Mobile Device Management (MDM), configuration keys are maintained under the policy hive:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Bluetooth

Key values configured under this path include:

• EncryptionMode (DWORD): Defines the minimum required encryption mode for peripheral connections (e.g., standard encryption vs. Secure Connections Only).
• StrictEncryption (DWORD): Restricts connections to peripherals that support FIPS-compliant encryption or advanced Secure Simple Pairing (SSP) modes.

Modifications made to these registry keys require a system restart or a restart of the Bluetooth Support Service (bthserv) to take effect.