You need to accomplish this goal by using one Group Policy object (GPO). What should you do?

Last Updated on November 20, 2021 by Admin 3

Your network contains an Active Directory domain. The domain contains computers that run Windows 10.

You must ensure that Windows BitLocker Drive Encryption is enabled on all client computers, even though a Trusted Platform Module (TPM) chip is installed in only some of them.

You need to accomplish this goal by using one Group Policy object (GPO).

What should you do?

  • Enable the Allow enhanced PINs for startup policy setting, and select the Allow BitLocker without a compatible TPM check box.
  • Enable the Enable use of BitLocker authentication requiring preboot keyboard input on slates policy setting, and select the Allow BitLocker without a compatible TPM check box.
  • Enable the Require additional authentication at startup policy setting, and select the Allow BitLocker without a compatible TPM check box.
  • Enable the Control use of BitLocker on removable drives policy setting, and select the Allow BitLocker without a compatible TPM check box.
Explanation:

We need to allow Windows BitLocker Drive Encryption on all client computers (including client computers that do not have Trusted Platform Module (TPM) chip).
We can do this by enabling the option to allow BitLocker without a compatible TPM in the group policy. The “Allow BitLocker without a compatible TPM” option is a checkbox in the “Require additional authentication at startup” group policy setting. To access the “Allow BitLocker without a compatible TPM” checkbox, you need to first select Enabled on the “Require additional authentication at startup” policy setting.

0 0 votes
Article Rating
Subscribe
Notify of
guest
0 Comments
Inline Feedbacks
View all comments