How to Configure BitLocker Drive Encryption via Group Policy without a TPM

Introduction

BitLocker is a full-volume encryption feature included with Microsoft Windows designed to protect data by providing encryption for entire volumes. By default, BitLocker requires a Trusted Platform Module (TPM) chip on the motherboard to store encryption keys securely. However, many older machines or virtual machines do not have a TPM. This guide explains how to configure Group Policy to allow BitLocker encryption using a startup PIN or a USB flash drive instead of a TPM.

Step 1: Open the Group Policy Editor

To deploy this setting across a domain, open the Group Policy Management Console (GPMC) on a Domain Controller. Create a new Group Policy Object (GPO) named “BitLocker No TPM” and link it to the Organizational Unit (OU) containing your computers. To test this locally on a single machine, press Win + R, type gpedit.msc, and hit Enter.

Step 2: Navigate to the BitLocker Policies

In the Group Policy Editor, navigate through the following path:

Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives

Step 3: Enable Additional Authentication at Startup

In the right-hand pane, locate the policy named Require additional authentication at startup. Double-click it to open the configuration window.

1. Select the Enabled radio button at the top left.
2. Under the Options section, check the box that says Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive).
3. For the remaining dropdown menus (Configure TPM startup, Configure TPM startup PIN, etc.), you can leave them at their default “Allow” settings, or change them to “Do not allow” if you want to strictly enforce the use of a password/USB over a TPM.
4. Click Apply and then OK.

Step 4: Update Group Policy and Enable BitLocker

If you configured this via local policy, the change takes effect immediately. If you deployed it via a domain GPO, force an update on the client machine by opening an elevated Command Prompt and running:

gpupdate /force

You can now open the Control Panel, navigate to BitLocker Drive Encryption, and click Turn on BitLocker. Instead of throwing an error about a missing TPM, Windows will prompt you to choose between entering a password every time you boot or inserting a USB flash drive containing the startup key.