Windows 10: Specify Minimum PIN Length for BitLocker Startup in Windows 10

How to: Specify Minimum PIN Length for BitLocker Startup in Windows 10

How to Specify Minimum PIN Length for BitLocker Startup in Windows 10


Information When you TPM, you can choose to unlock the OS drive at startup with a PIN.

Originally, BitLocker allowed from 4 to 20 characters for a PIN. Starting with Windows 10 PIN is changed. If successful, Windows will only reset the TPM lockout period back to default if the TPM is reset.

The turn on BitLocker for the OS drive. The startup PIN must have a minimum length of 4 digits, and it can have a maximum length of 20 digits. By default, the minimum PIN length is 6.

This tutorial will show you how to specify a minimum length for a TPM startup PIN used with BitLocker in Windows 10.

You must be signed in as an administrator to specify a minimum PIN length for BitLocker startup.


Note editions.

CONTENTS:

• Option One: Specify Minimum PIN Length for BitLocker Startup in Local Group Policy Editor
• Option Two: Specify Minimum PIN Length for BitLocker Startup in Registry Editor

OPTION ONE [/i] Specify Minimum PIN Length for BitLocker Startup in Local Group Policy Editor


Note Local Group Policy Editor is only available in the Windows 10 Pro, Enterprise, and Education editions.

1. Open the Local Group Policy Editor.

2. In the left pane of Local Group Policy Editor, navigate to the location below. (see screenshot below)
*Arrow Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives




3. In the right pane of Operating System Drives in Local Group Policy Editor, double click/tap on the Configure minimum PIN length for startup policy to edit it. (see screenshot above)

4. Do step 5 (specify) or step 6 (default) below for what you would like to do.


5. To Specify Minimum PIN Length for BitLocker Startup
A) Select (dot) Enabled, enter a number between 4 to 20 in Minimum characters for what you want, click/tap on OK, and go to step 7 below. (see screenshot below)


Note If minimum PIN length is set below 6 digits, Windows will attempt to update the TPM 2.0 lockout period to be greater than the default when a PIN is changed. If successful, Windows will only reset the TPM lockout period back to default if the TPM is reset.




6. To Use Default Minimum PIN Length for BitLocker Startup
A) Select (dot) Not Configured or Disabled, click/tap on OK, and go to step 7 below. (see screenshot below)

NOTE: Not Configured is the default setting.




7. When finished, you can close the Local Group Policy Editor if you like.





OPTION TWO [/i] Specify Minimum PIN Length for BitLocker Startup in Registry Editor
1. Press the Win+R keys to open Run, type regedit into Run, and click/tap on OK to open Registry Editor.

2. Navigate to the key below in the left pane of Registry Editor. (see screenshot below)


Note If you do not have a FVE key, then right click on the Microsoft key, click/tap on New, click/tap on Key, type FVE for the name, and press Enter.

*Arrow HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE




3. Do step 4 (specify) or step 5 (default) below for what you would like to do.


4. To Specify Minimum PIN Length for BitLocker Startup
A) In the right pane of the FVE key, right click or press and hold on the MinimumPIN DWORD to modify it. (see screenshot below step 2)

B) Select (dot) Decimal, enter a number between 4 to 20 for what you want, click/tap on OK, and go to step 6 below. (see screenshot below)


Note If minimum PIN length is set below 6 digits, Windows will attempt to update the TPM 2.0 lockout period to be greater than the default when a PIN is changed. If successful, Windows will only reset the TPM lockout period back to default if the TPM is reset.




5. To Use Default Minimum PIN Length for BitLocker Startup
A) In the right pane of the FVE key, right click or press and hold on the MinimumPIN DWORD, and click/tap on Delete. (see screenshot below step 2)

B) Click/tap on Yes to confirm, and go to step 6 below. (see screenshot below)




6. You can now close Registry Editor if you like.
That's it,
Shawn


Related Tutorials

• How to Turn On or Off BitLocker for Operating System Drive in Windows 10
• How to Enable or Disable Standard Users from Changing BitLocker PIN or Password in Windows 10
• How to Enable or Disable Enhanced PINs for BitLocker Startup in Windows 10
• How to Change BitLocker Startup PIN in Windows 10
• How to Add or Remove Change BitLocker PIN Context Menu in Windows 10
• How to Unlock an OS Drive Encrypted by BitLocker in Windows 10

:)

 

Specify Maximum and Minimum PIN Length in Windows 10


If you change the minimum or maximum PIN length you need to remove and re-add the PIN. Otherwise the rules before the change still apply.





For example, if I have a 4 long PIN and change minimum length from 4 to 6 I can still change to another 4 long PIN. Only if the PIN is deleted and a new one added does the 6 minimum take effect.

I don't know if this is intended or not but is confusing.

Also on 17134 it is required to check the "Include letters and symbols" box to see the PIN requirements. This looks like a definite bug to me but may be useful to know.

 

Windows 10 asking for minimum 6 digit pin

Hello zpmarcos, and welcome to Ten Forums. *Smile

You might see if the tutorials below may help to set to require digits and min/max length for a PIN in Windows 10.

Enable or Disable Require Digits for PIN in Windows 10 | Windows 10 Tutorials

Specify Maximum and Minimum PIN Length in Windows 10 | Windows 10 Tutorials

 

Windows 10 asking for minimum 6 digit pin

Hi,

Thanks for the help but it still aint working.

 

Windows 10 asking for minimum 6 digit pin

A PIN must be at least 4 digits by default in Windows 10, so I'm not sure what isn't working for you. Could you please provide more details?

What does it show for you like below?

 

Windows 10 asking for minimum 6 digit pin

Sorry I dont have that "pin requirements" button as you can see in the images above