How to Enable or Disable BitLocker to Unlock OS Drive with PIN or USB at Startup in Windows 11

Enable or Disable BitLocker Settings (Admin Required)

Before you change anything, make sure you have a copy of your BitLocker recovery key stored somewhere other than this PC. Changing startup settings can occasionally trigger a recovery prompt, and without the key you could lose access to your files.

If you’re using Windows 11 Pro or higher, the Group Policy Editor is the easiest route. Home users should skip to the Registry Editor method.

Using Group Policy Editor

The built-in Group Policy Editor lets you change how your operating system drive unlocks, and you can turn the startup authentication policy on or off from the same place. Follow these steps to allow or require a PIN or USB startup key.

1. Press Win+R, type gpedit.msc, and press Enter. The Local Group Policy Editor opens. If you get a “cannot find” error, you are on Windows 11 Home and should use the registry method instead.
2. Navigate to Computer Configuration › Administrative Templates › Windows Components › BitLocker Drive Encryption › Operating System Drives.
3. Double-click Require additional authentication at startup. The policy window opens.
4. Select Enabled. Make sure the box for Allow BitLocker without a compatible TPM is unchecked, unless your PC has no TPM. Leaving it unchecked keeps the TPM requirement in place.

With the policy enabled, the drop-down lists in the same window control which methods are allowed, such as TPM startup PIN or startup key. Set the option you want to Require or Allow. Setting an option to Do not allow blocks that method.

5. Click OK. The policy now shows as Enabled in the list.

This policy only controls what is permitted. To actually apply a PIN or USB key to your drive, you still need to turn on BitLocker or change the startup protector for the drive. To undo the change, open the same policy again and select Not Configured or Disabled, then click OK.

Using Registry Editor (GUI Alternative)

The registry values below are what the policy writes for you. Back up the registry or create a restore point first, since a wrong edit here can cause problems.

1. Press Win + R, type regedit, and press Enter. Click Yes if User Account Control asks for permission.
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE. If a key in that path doesn't exist, right-click its parent key, choose New › Key, and create it with the name that is missing.
3. In the right-hand pane, right-click an empty space and select New › DWORD (32-bit) Value. Name the new value UseAdvancedStartup, then double-click it and set its value to 1.
4. Repeat this for each of the other values below, setting them as follows:

• EnableBDEWithNoTPM set to 0
• UseTPM set to 2
• UseTPMPIN set to 2
• UseTPMKey set to 2
• UseTPMKeyPIN set to 2

Restart the PC so the new values are picked up. To restore the default behavior, delete the values created above and restart again.

Using Command Line (manage-bde)

Advanced users can also use the manage-bde command-line tool. Open Command Prompt as an administrator by searching for it, right-clicking the result and choosing Run as administrator. Then type: manage-bde -protectors -add C: -TPMAndPIN. This command sets up the PIN requirement for your C: drive.

If the command is refused with a message about policy, the startup authentication policy from the earlier methods has not been enabled yet. Set that first and try again.

Troubleshooting 'PIN Not Available'

If your PIN isn't working, check these things first:

• Your BIOS/UEFI must be set to UEFI mode, not legacy or CSM mode.
• Secure Boot must be enabled in the firmware settings.
• The TPM must be turned on in the firmware. It may be listed as fTPM, PTT or Security Device.

If you can't enter a PIN at startup, use your recovery key to boot into Windows. Once you're in, remove and re-add the PIN protector in the BitLocker settings menu. Remember that the PIN is typed on the pre-boot screen, which may use a different keyboard layout than Windows, so check for typing errors there.

Summary

Adding a BitLocker PIN or USB key at startup makes your Windows 11 computer more secure, because a thief who has only the hardware can't get past the pre-boot screen. Keep your recovery key safe, and keep the USB key away from the laptop if you use one.