Bitlocker Question?

[Michael Price]

I have Bitlocker enabled on my TPM laptop. It works great. My question is :
Can I now enable a PIN in addition to the TPM? I have found how to turn it
on via gpedit.msc

If I turn the advanced features on will it go into recovery mode? Or will it
just add the PIN?

Thanks

 

[Guest]

Yes you can add a PIN now, but you have to do it from the command line. The
tool is called manage-bde.wsf. Here is the syntax you need:
C:\Windows\system32>cscript manage-bde.wsf -protectors -add /?
Microsoft (R) Windows Script Host Version 5.7
Copyright (C) Microsoft Corporation. All rights reserved.

manage-bde -protectors -add Volume
[{-RecoveryPassword|-rp} [NumericalPassword]]
[{-RecoveryKey|-rk} PathToExternalKeyDirectory]
[{-StartupKey|-sk} PathToExternalKeyDirectory]
[-TPM]
[{-TPMAndPIN|-tp} PIN]
[{-TPMAndStartupKey|-tsk} PathToExternalKeyDirectory]
[{-ComputerName|-cn} ComputerName]
[{-?|/?}] [{-Help|-h}]

Description:
Adds key protection methods.

Parameter List:
Volume A drive letter followed by a colon. Example: "C:"
-RecoveryPassword or -rp
Adds a Numerical Password protector.
-RecoveryKey or -rk
Adds an External Key protector for recovery.
-StartupKey or -sk
Adds an External Key protector for startup.
-TPMAndPIN or -tp
Adds a TPM And PIN protector for the OS volume.
-TPMAndStartupKey or -tsk
Adds a TPM And Startup Key protector for the OS volume.
-tpm Adds a TPM protector for the OS volume.
-ComputerName or -cn
Runs on another computer. Examples: "ComputerX", "127.0.0.1"
-? or /? Displays brief help. Example: "-ParameterSet -?"
-Help or -h Displays complete help. Example: "-ParameterSet -h"

Examples:
manage-bde -protectors -add e: -RecoveryPassword
manage-bde -protectors -add e: -rp -rk h:\
manage-bde -protectors -add e: -TPMAndPIN ...