BitLocker PIN vs. Enhanced PIN vs. Password

Felix Reichmann 121 Reputation points
2020-08-02T19:15:35.313+00:00

Hello,
BitLocker provides three different types of character based key protectors for operational system drives. I have assumed that these differ as follows:

  • PIN: Only numeric characters; no minimum length
    GP Element: "Require additional authentication at startup"
  • Enhanced PIN: Numeric characters, letters, symbols; no minimum length
    GP Element: "Allow enhanced PINs for startup"
  • Password: Numeric characters, letters, symbols; Introduced configurable minimum length of at least 8 character
    GP Element: "Configure use of passwords for operating system drives"

Unfortunately, I have now discovered that the length set for the password is not enforced when PIN+Enhanced PIN+Password is enabled.

Can someone please explain what the difference between the three protectors is and what influence the two Group Policy elements "Configure use of passwords for operating system drives" and "Configure minimum PIN length for startup" have?

Regards
Felix

Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,765 questions
0 comments
Accepted answer
  1. Dale Kudusi 3,211 Reputation points
    2020-08-03T03:38:08.643+00:00

    Hi

    PIN: A user-entered numeric key protector that can only be used in addition to the TPM.
    Enhanced PIN: A user-entered alphanumeric key protector that can only be used in addition to the TPM.
    Recovery password: A 48-digit number used to unlock a volume when it is in recovery mode. Numbers can often be typed on a regular keyboard, if the numbers on the normal keyboard are not responding you can always use the function keys (F1-F10) to input the numbers.
    Recovery key: An encryption key stored on removable media that can be used for recovering data encrypted on a BitLocker volume.
    More detail see BitLocker key protectors and BitLocker authentication methods.

    Configure use of passwords for operating system drives:
    This policy controls how non-TPM based systems utilize the password protector. Used in conjunction with the Password must meet complexity requirements policy, this policy allows administrators to require password length and complexity for using the password protector. By default, passwords must be eight characters in length. Complexity configuration options determine how important domain connectivity is for the client. For the strongest password security, administrators should choose Require password complexity because it requires domain connectivity, and it requires that the BitLocker password meets the same password complexity requirements as domain sign-in passwords.
    More on: Configure use of passwords for operating system drives

    Configure minimum PIN length for startup:
    This policy setting is used to set a minimum PIN length when you use an unlock method that includes a PIN.
    More on: Configure minimum PIN length for startup

    Also more questions about BitLocker Key Management FAQ and BitLocker Group Policy settings.

    I hope this information above can help you.

    1 person found this answer helpful.
    0 comments

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Felix Reichmann 121 Reputation points
    2020-08-03T21:17:50.877+00:00

    @Dale Kudusi Thank you for fast answering

    0 comments
  2. Anonymous
    2020-08-07T08:02:39.687+00:00

    @MariaA :
    You write "Unfortunately, I have now discovered that the length set for the password is not enforced when PIN+Enhanced PIN+Password is enabled."
    We cannot enable PIN+Enhanced PIN+Password. That is not possible since you will only have the choice PIN OR password.
    PINs/enhanced PINs will not allowed to be longer than 20 characters, by the way.

    0 comments