Windows 10: Configure hardware BitLocker with startup PIN?

Is it possible to use a startup PIN with hardware BitLocker? By hardware BitLocker I am referring to BitLocker managing a drive's built-in encryption key. For example, for a TCG Opal 2.0 SSD. Or is a startup PIN only an option for software BitLocker? Thanks.

:)

 

How to enable/configure BitLocker authentication

In a professional environment, requiring and allowing makes more sense... It is not possible to configure in the bitlocker menu (in step 10 of the tutorial) "Configure TPM startup PIN", "Configure TPM startup key" at the same time, so Microsoft has put "Configure TPM startup key and PIN" . *Biggrin "Do not allow TPM" is not to disable the tpm, but not to use the tpm to unlock the hdd/ssd automatically.

 

How to enable/configure BitLocker authentication

For example in a company, the IT project manager configures "allowing" for 2 options instead of "requiring" to leave the choice of authentication at startup to employees. In the menu shown in step 4 it is only possible to require one option. Still in business if the I.T. wants to require only key and pin together, it needs this third option "Configure TPM startup key and PIN". And also as I said in my previous comment explained otherwise, if the I.T. allowing "Configure TPM startup PIN" and "Configure TPM startup key" in Local Group Policy Editor, employees could not configure both at the same time for startup in step 10 of the tutorial in “BitLocker Drive Encryption” wizard. And, the BitLocker Drive Encryption wizard must not allow this possibility because the employees could configure a thing that the I.T. would not. Yes the setting "Configure TPM startup", on "Require TPM" invalidates the other 3 menus. Menus are confusing because they are designed for businesses. To configure bitloker startup authentication you should go through the BitLocker Drive Encryption wizard and leave the Local Group Policy Editor menus on allow. note: In BitLocker Drive Encryption wizard there is no "key and PIN" option you have to configure it in command line.

 

How to enable/configure BitLocker authentication

I'm not sure I follow what you mean by this. The menu gives the option of either requiring OR allowing. I'm just asking why someone would implement a security measure but then make it optional (i.e. "allowing" instead of "requiring").

I see that the menu in step 10 doesn't allow you to specify both a key and a PIN, but that still doesn't explain why "Configure TPM startup PIN", "Configure TPM startup key" and "Configure TPM startup key and PIN" need to be 3 separate options in the menu shown in step 4. The third option seems redundant. It seems like all of the possible values of the third option are already covered by the possible value combinations of the first two.

But if I set the first menu, "Configure TPM startup", to "Require TPM", shouldn't that invalidate all of the other 3 menus, as I've now specified that the TPM alone will be used to unlock the HDD/SSD? These menus are very confusing.