How to Enable BitLocker Startup PIN on Windows 11

Setting a pre-boot PIN for BitLocker adds an essential layer of security to Windows 11 by requiring authentication before the operating system boots and unlocks the drive encryption keys. By default, BitLocker relies solely on the Trusted Platform Module (TPM), which unlocks automatically when the system powers on. This guide walks you through enabling the startup PIN policy in the Local Group Policy Editor and configuring your personal PIN using the Command Prompt.

Prerequisites

• Windows 11 Pro, Enterprise, or Education edition (BitLocker is not available on Windows 11 Home).
• A functional TPM 2.0 chip.
• BitLocker enabled on the operating system drive (typically the C: drive).
• Administrator privileges.

Step 1: Allow Startup PIN in Group Policy

Windows 11 must be configured to allow a PIN alongside TPM authentication.

1. Press Win + R, type gpedit.msc, and press Enter to open the Local Group Policy Editor.
2. Navigate to the following path: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives
3. In the right pane, double-click Require additional authentication at startup.
4. Select Enabled.
5. Under the Options section:
   • Ensure Allow BitLocker without a compatible TPM is unchecked (unless using non-TPM hardware).
   • Set Configure TPM startup PIN: to Require startup PIN with TPM (or Allow startup PIN with TPM).
6. Click Apply, then click OK.

Step 2: Set the Pre-Boot BitLocker PIN

Once the policy is applied, you must assign the actual PIN to your encrypted drive.

1. Press the Windows Key, type cmd, right-click Command Prompt, and select Run as administrator.

2. Run the following command (replace C: with your operating system drive letter if different):

   manage-bde -protectors -add C: -TPMAndPIN

3. When prompted, enter your desired PIN (between 6 and 20 digits by default).

4. Re-type the PIN to confirm.

Step 3: Verify and Test the Configuration

1. In the elevated Command Prompt, verify that the protector was added successfully by typing:

   manage-bde -status C:

2. Look under the Key Protectors section for TPM And PIN.

3. Restart your computer. Upon booting, your PC will prompt you to enter the BitLocker PIN before loading Windows 11.

How to Change or Remove the PIN Later

• To change the PIN: Run manage-bde -changepin C: in an elevated Command Prompt.
• To remove the PIN (revert to TPM-only): Run manage-bde -protectors -delete C: -type TPMAndPIN followed by manage-bde -protectors -add C: -tpm.