This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(176, 78%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EO%3C/text%3E%3C/svg%3E)
Hi,
Have installed Windows 11 22H2 on two machines as a custom Windows Image (.wim), so both machines has same OS configuration, policies, customizations etc.
PC1: Local User Account (Admin Group)
PC2: Microsoft Account Login during OOBE
PC1 with offline account working fine and asking for Bitlocker password at reboot.
PC2 with MS account is NOT asking for password at reboot (however Bitlocker is enabled).
I have enabled Bitlocker on both devices myself. PC1 is asking for the PIN at reboot while PC2 not. Only difference I can see is offline account (PC1) and Microsoft Account (PC2).
as said both machines were same and has same GPO settings as:
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(108.80000000000001, 77%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM%3C/text%3E%3C/svg%3E)
Probably, PC2 has device encryption enabled (which uses Bitlocker technology, but IS NOT the same). That would mean: no PIN can be set, no preboot authentication is possible.
Select the Start button, then select Settings > Update & Security > Device encryption. If Device encryption doesn't appear, it isn't available.
I have enabled Bitlocker on both devices myself. PC1 is asking for pin at reboot while PC2 not. Only difference I can see is offline account (PC1) and Microsoft Account (PC2).
To setup a PIN, follow https://www.howtogeek.com/262720/how-to-enable-a-pre-boot-bitlocker-pin-on-windows/
I have made GPO changes (see original post) and has enabled the password with PowerShell as:
Add-BitLockerKeyProtector -MountPoint C: -Password ('SecretCode' | ConvertTo-SecureString -AsPlainText -Force) -PasswordProtector
As said before, it's two machines (identical in terms of hardware, software and configuration) one is asking for password (offline account) at reboot while other not (with MSA account).
You shouldn't use a password. A PIN is more secure as it works in connection with the TPM. Passwords can be brute-forced, PINs can't, because the TPM blocks that.
Ok, but question here is why one device is asking for Password while other not?
Why it's different behavior on an offline account vs a MS account ... this is actually a question I asked.
The computer with the MS account has no PIN set, it starts without a PIN and the encryption is using only the TPM as protector - this can be called transparent. This transparent encryption lets the user boot to the logon mask without entering anything, yes! Only useful in combination with a userpassword that cannot be guessed.
If the attacker however tries to manipulate windows from a bootdisk (he boots from a USB stick in order to clear all passwords, for example), he will not succeed, since the TPM protector does not allow manipulation of the drive from offline media.
Thanks for the above information.
Now what will be possible solution for me for the devices with MS Account?
Preferably, I would like to have ONE procedure for ALL machines, regardless if an offline user account is created or MS account.
As said: on your 2nd device
do setup a PIN, follow https://www.howtogeek.com/262720/how-to-enable-a-pre-boot-bitlocker-pin-on-windows/
Ok, will check it out if PowerShell allow me to do the same.
You said, you have set up a password. The password protector needs to be deleted, first, then, a new PIN can be set up.
manage-bde -protectors -delete c: -type password
manage-bde -protectors -add c: -tp
Yes, I did re-install and OS and set the PIN using following:
$PIN = ConvertTo-SecureString "555555" -AsPlainText -Force
Enable-BitLocker -MountPoint "C:" -UsedSpaceOnly -EncryptionMethod Aes256 -Pin $PIN -TPMandPinProtector
But I get following error message (but when I reboot the PC, it ask for the PIN, even above PS shows following error):
