How to Enable BitLocker with PIN and USB Key in Windows 11
BitLocker device encryption locks your Windows 11 hard drive so nobody can read your files if your PC gets lost or stolen. You can make this security even stronger by setting up a startup PIN and a USB key, which forces you to plug in a specific flash drive and type a secret code every time you turn on your computer.
This two-step startup check gives you much better protection than a standard Windows password or a basic hardware chip alone. Windows 11 Pro, Enterprise, and Education editions support this setup, while Windows 11 Home users need to upgrade first.
Enable BitLocker with a PIN and USB key by navigating to Control Panel System and Security BitLocker Drive Encryption. Click ‘Change how drive is unlocked at startup’, select ‘Enter a PIN (recommended)’, and then ‘Insert a USB flash drive’. Ensure your TPM is enabled or configure Group Policy if needed.
Prerequisites and TPM Requirements
Before proceeding, verify that the motherboard has a TPM 2.0 chip enabled in the UEFI firmware (the foundational system firmware). Devices lacking a TPM require a specific Group Policy tweak to permit BitLocker operation without one.
Common Errors: The device cannot use a Trusted Platform Module
Encountering the “device cannot use a Trusted Platform Module” error indicates a missing or disabled TPM in the BIOS. Bypassing this roadblock involves enabling the “Require additional authentication at startup” policy inside the Group Policy Editor.
Configuring Group Policy for BitLocker
Configuring security policies is the first hurdle in this setup process. Opening the Local Group Policy Editor allows access to the necessary startup controls.
1. Press Win+R, type gpedit.msc, and press Enter.
2. Navigate to: Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives.
3. Double-click Require additional authentication at startup.
4. Select Enabled and ensure ‘Allow BitLocker without a compatible TPM’ is checked if needed.
5. Click Apply and OK.
Enable a PIN to Unlock BitLocker
Open the Control Panel and go to Control Panel\System and Security\BitLocker Drive Encryption. Click 'Change how drive is unlocked at startup'.
Select 'Enter a PIN (recommended)'.
Input a numeric sequence between 6 and 20 digits long. Confirm the entry and click 'Set PIN'.
Unlock with a USB Drive at Startup
Return to the BitLocker menu and select 'Insert a USB flash drive'.
Choose the target USB drive from the dropdown list and click 'Save'.
Keep the flash drive connected during the subsequent reboot to validate the configuration.
Command Line Configuration
Power users can manage these parameters through PowerShell or Command Prompt. Launching these command-line tools as an Administrator grants full control over drive encryption features.
manage-bde -protectors -add C: -TPMAndPIN
Summary
With the PIN and USB key configured, your Windows 11 machine now demands physical and numerical authentication before booting.
Can I use a BitLocker PIN without a TPM chip?
Yes, modifying Group Policy settings is mandatory first. Enabling the 'Allow BitLocker without a compatible TPM' policy inside gpedit.msc forces Windows to accept a USB startup key instead of requiring hardware TPM support.
Does BitLocker PIN affect Windows Hello login?
No, the BitLocker PIN operates independently from Windows Hello. BitLocker demands verification before the operating system boots, whereas Windows Hello authenticates the user account after the desktop environment loads.
Was this guide helpful?
About the Author
Richard
Tech Writer, IT Professional
Richard, a writer for Geek Rewind, is a tech enthusiast who loves breaking down complex IT topics into simple, easy-to-understand ideas. With years of hands-on experience in system administration and enterprise IT operations, he’s developed a knack for offering practical tips and solutions. Richard aims to make technology more accessible and actionable. He's deeply committed to the Geek Rewind community, always ready to answer questions and engage in discussions.
[…] you have set up BitLocker to require users to insert a USB drive that contains a startup key and a PIN at sta… before the computer starts, the steps below show you how to revert to the default […]
[…] users can add additional security by requiring a USB flash drive and a PIN to unlock BitLocker at […]