BitLocker Script not working only on Windows 11. Works flawlessly on Windows10

@Brink Since you made the tutorial about the Enable BitLocker reg files (which I filed but they didn't work, tried on multiple machines with multiple settings), I ask you and/or anybody knowledgeable for help. I have been working on this issue for a week to no avail

First I run this registry file which is integrated into my Windows images anyway



According to Microsoft's official BitLocker

> BitLocker Group Policy settings - Windows Security
> If one authentication method is required, the other methods can't be allowed. Use of BitLocker with a TPM startup key or with a TPM startup key and a PIN must be disallowed if the Deny write access to removable drives not protected by BitLocker policy setting is enabled.

So basically only 1 value may be set to "1" and then all the rest must be set to "0" as above otherwise GPOs will conflict.

Now when I run this script that first detects that BitLocker has been enabled or not, and if not, then it will enable BitLocker on the C Drive, FVE, and sets the default pin, and then proceeds to inject 3 UNCs into the RunOnce registry location so that those 3 apps I made will be launched upon the next (re)boot, the script throws the EM:

> "Enable-BitLockerInternal: The value is outside the expected range.
At C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psm1:3738 character:48 ... eInternal = Enable-BitLockerInternal -MountPoint $BitLockerVolumeInte ...

Screenshot:

Tried it both on a Hyper-V VM and then on a physical laptop, neither worked.
Why does my script run perfectly on Windows 10 yet not on Windows 11? I don't get it. Please help

Hello mate,

It looks like what's changed in the registry for this GPO has been changed a bit. It's now this:

Brink said:

Hello mate,

It looks like what's changed in the registry for this GPO has been changed a bit. It's now this:

Enable or Disable BitLocker to Unlock OS drive at Startup with PIN and USB in Windows 11 Tutorial

This tutorial will show you how to enable or disable BitLocker to unlock the operating system drive at startup with a PIN or USB flash drive in Windows 10 and Windows 11. BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats...

www.elevenforum.com

Code:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE]
"UseAdvancedStartup"=dword:00000001
"EnableBDEWithNoTPM"=dword:00000000
"UseTPM"=dword:00000002
"UseTPMPIN"=dword:00000002
"UseTPMKey"=dword:00000002
"UseTPMKeyPIN"=dword:00000002

Click to expand...

Hello Brink

No you misunderstood me. I tried your version of the reg file first and then when it didn't work, I modified it as in the OP. And that also didn't work. And the documentation (unless it's out of date) clearly states only 1 value may be set to "1" and all others must be set to "0" ie blocked

What I just posted is what is now changed in the registry. The tutorial has been updated for this since what you last used in your first post.

I tested these new values on my system, and they are working for me.

Brink said:

What I just posted is what is now changed in the registry. The tutorial has been updated for this since what you last used in your first post.

I tested these new values on my system, and they are working for me.

Click to expand...

Ah I just re-read your first post and realized basically you had removed those 3 keys: XTSOS, RDV and FDV. So I must not specify those at all otherwise it won't work right?

Now I also just tested the new one and it isn't working for me either. The error message remains the same, as in the OP... doesn't fall within range

Just to verify, did you clear the FVE key before applying the new values? If not, anything left over from the old values may still be causing an issue.

As a test, if you turn on BitLocker for the OS drive from File Explorer instead like below, does the above work to include a PIN and USB option?

Brink said:

Just to verify, did you clear the FVE key before applying the new values? If not, anything left over from the old values may still be causing an issue.

As a test, if you turn on BitLocker for the OS drive from File Explorer instead like below, does the above work to include a PIN and USB option?

Turn On BitLocker for Operating System Drive in Windows 11 Tutorial

This tutorial will show you how to turn on BitLocker Drive Encryption for an operating system drive in Windows 11. BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or...

www.elevenforum.com

Click to expand...

I know for GPOs you must either restart or run gpupdate/force via cmd prompt, but what if you do it via the reg key files? Do they automatically get changed and take effect?

CSharpDev said:

I know for GPOs you must either restart or run gpupdate/force via cmd prompt, but what if you do it via the reg key files? Do they automatically get changed and take effect?

Click to expand...

It did for me. Once enabled via REG, I had the PIN and USB option available when turning on BitLocker for the OS drive from File Explorer.

If that above works for you, then there may be an issue with your script/command.