How to Enable BitLocker with PIN and USB Key in Windows 11
BitLocker with a PIN and USB key in Windows 11 adds an extra layer of security to protect your computer’s files before Windows even starts. This feature requires you to insert a special USB drive and enter a numeric PIN every time you turn on your PC.
Using both a physical USB key and a PIN is more secure than just using a PIN or a Trusted Platform Module (TPM) chip alone. A TPM is a small hardware chip that helps with security, but a combination of the USB key and PIN makes it much harder for unauthorized people to access your data.
When you set this up, your computer will ask for the USB drive and your PIN each time you boot up, giving you strong protection for your important information.
Enable BitLocker with a PIN and USB key by navigating to Control Panel System and Security BitLocker Drive Encryption. Click ‘Change how drive is unlocked at startup’, select ‘Enter a PIN (recommended)’, and then ‘Insert a USB flash drive’. Ensure your TPM is enabled or configure Group Policy if needed.
Prerequisites and TPM Requirements
Before you begin, make sure your computer has a TPM 2.0 chip enabled in your UEFI firmware (your computer’s foundational system firmware). If your device lacks a TPM, you’ll need to configure a specific Group Policy (a Windows feature for managing settings) to permit BitLocker without one.
Common Errors: The device cannot use a Trusted Platform Module
The “device cannot use a Trusted Platform Module” error means your computer lacks a TPM or the TPM is turned off in the BIOS. You can bypass this error by turning on the “Require additional authentication at startup” policy in the Group Policy Editor.
Configuring Group Policy for BitLocker
To set up BitLocker with a PIN and USB key in Windows 11, you first need to adjust your computer’s security settings using Group Policy. This involves opening the Local Group Policy Editor and finding the specific setting that lets you require extra steps when your computer starts up.
1. Press Win + R, type gpedit.msc, and press Enter.
2. Navigate to: Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives.
3. Double-click Require additional authentication at startup.
4. Select Enabled and ensure 'Allow BitLocker without a compatible TPM' is checked if needed.
5. Click Apply and OK.
Enable a PIN to Unlock BitLocker
Open the Control Panel and go to Control Panel\System and Security\BitLocker Drive Encryption. Click 'Change how drive is unlocked at startup'.
Select 'Enter a PIN (recommended)'.
Enter a PIN that's 6 to 20 numbers long. Confirm it and click 'Set PIN'.
Unlock with a USB Drive at Startup
In the same BitLocker menu, select 'Insert a USB flash drive'.
Choose your USB drive from the list and click 'Save'.
Ensure the drive is connected during the next reboot to verify the configuration.
Command Line Configuration
For advanced users, you can manage BitLocker settings via PowerShell or Command Prompt. Run these command-line tools as an Administrator to control encryption features and enhance security.
manage-bde -protectors -add C: -TPMAndPIN
Summary
You've now set up BitLocker with both a PIN and a USB key on your Windows 11 computer, making it much safer from people trying to access it without permission.
Can I use a BitLocker PIN without a TPM chip?
Yes, but you must modify the Group Policy settings first. By enabling the 'Allow BitLocker without a compatible TPM' policy in gpedit.msc, you can force Windows to use a USB startup key as the primary authentication method instead of relying on the hardware TPM chip.
Does BitLocker PIN affect Windows Hello login?
No, the BitLocker PIN is entirely separate from your Windows Hello login. The BitLocker PIN is requested before Windows even starts, while your Windows Hello PIN or fingerprint is used to sign into your user account after the operating system has successfully loaded.
Was this guide helpful?
About the Author
Richard
Tech Writer, IT Professional
Richard, a writer for Geek Rewind, is a tech enthusiast who loves breaking down complex IT topics into simple, easy-to-understand ideas. With years of hands-on experience in system administration and enterprise IT operations, he’s developed a knack for offering practical tips and solutions. Richard aims to make technology more accessible and actionable. He's deeply committed to the Geek Rewind community, always ready to answer questions and engage in discussions.
[…] you have set up BitLocker to require users to insert a USB drive that contains a startup key and a PIN at sta… before the computer starts, the steps below show you how to revert to the default […]
[…] users can add additional security by requiring a USB flash drive and a PIN to unlock BitLocker at […]