Windows 10: What’s the difference between an enhanced PIN and a password for BitLocker? Can passwords...

I was originally planning on using an enhanced PIN + TPM when booting, but since enhanced PINs can't be more than 20 characters I'm thinking of using a password instead. What's confusing me though is whether or not a password can also be used in conjunction with TPM, or if only a PIN can be used in conjunction with TPM. Is this the main difference between the two?

How should I go about setting this up? I only recently upgraded to Windows 10 Education and these are the group policy settings I've changed:

Under Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives

Allow Secure Boot for integrity validation: enabled

Allow enhanced PINs for startup: enabled

Require additional authentication at startup: enabled

• Allow Bitlocker without a compatible TPM: unchecked
• Configure TPM startup: No not allow TPM
• Configure TPM startup PIN: Require startup PIN with TPM
• Configure TPM startup key: Do not allow startup key with TPM
• Configure TPM startup key and PIN: Do not allow startup key and PIN with TPM

With these settings, I can set up an enhanced PIN just fine. As soon as I enable "Configure use of passwords for operating system drives" though, I get the error message "the group policy settings for BitLocker startup options are in conflict and cannot be applied" when selecting "Change how drive is unlocked at startup" in the Control Panel. If I change 'Configure TPM startup PIN' to do not allow instead of require, I still get an error message.

submitted by /u/win_linx
[link] [comments]

:)

 

Bitlocker Questions

PIN and password are two different ways to unlock BitLocker at startup. You would want to use a PIN for BitLocker since that's what you want. Enabling enhanced PIN for BitLocker is not required. It basically just allows you to use a more complicated PIN. Without using enhanced PIN, you would just enter a simple 4-6 digit PIN at step 10.

Your account password is unrelated. If you want to require a password to sign in to your account in Windows, then you would want to add a password to your account. It doesn't matter if you do it before or after turning on BitLocker for your Windows OS drive.

 

Bitlocker...TPM + PIN vs Password?


I have seen this question asked elsewhere several times, but with different answers...so I just want to make sure my understanding of BitLocker is correct.

In the past, I had used BitLocker on several computers that did Not have a TPM...therefore I had to use a strong 30/40/50+ character password, which was not a problem. I am now working with a new computer that came with a TPM installed...so now instead of a long password, I am restricted to a maximum of 20 characters (even with enhanced PIN's enabled, it still only lets you use 20 characters, which I'm not sure why 20 is the limit?)

From my understanding, even though it is a much shorter PIN, it is more secure than a long password because the TPM only allows up to 32 attempts before locking out...and then lets 1 more attempt every 2 hours...thereby allowing only just over 4,000 attempts per year (according to both basic math as well as a Microsoft article). Thereby making brute forcing the PIN pretty much impossible even if you use just a 6 digit number.

In addition, if you put the hard drive in another computer, the PIN won't work...you would now need to use the recovery key/recovery password...which is also impractical to brute force.

Is my understating pretty much correct? Or am I missing anything? At first it would seem a 50 character password is more secure than a 6 digit PIN number, but after reviewing everything, it seems that the TPM makes the PIN 'stronger' than the password? Is there any benefit to turning off the TPM in BIOS and just using a long secure password? Or is it best to stick with the TPM + PIN even though the PIN is far shorter?

 

Allow enhanced PINs for startup with Bitlocker

However, still only 0-9 characters are allowed. Why is it so?

The setting you changed only applies to new BitLocker startup pins.

...

Source BitLocker Group Policy Settings

What else can be done?

You can decrypt the drive and then encrypt it again, which will require you to set up another password.

Source What is the difference between disabling BitLocker Drive Encryption and decrypting the volume?

BitLocker Group Policy Settings

...

Source BitLocker Group Policy Settings