Windows 11 bitlocker problems

Hello, I have windows 11 pro x64, 21H2, I have a problem with bitlocker, I have a main hard drive with the operating system, 480gb in GPT , when I go to encrypt the hard drive with bitlocker it asks me to either put an unlock Pin to the start the system, or insert a usb memory, but it does not let me combine the two options (if there is a usb memory inserted, it unlocks automatically, if there is no usb memory inserted, it sends you to memer the pin or insert the flash drive. In windows 10 It allowed me to combine the 2, but in windows 11 it doesn't let me combine the 2 options (either one or the other), I hope you can help me, thanks

Bitlocker does not support a Pin & Starup Key alone. You can add the TPMandPinandStartUp key protector though which does support that combo but only with the TPM included.

From the policy description in gpedit.msc:

"On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 6-digit to 20-digit personal identification number (PIN), or both.

Note: If you want to require the use of a startup PIN and a USB flash drive, you must configure BitLocker settings using the command-line tool manage-bde instead of the BitLocker Drive Encryption setup wizard."

sevenup777 said:

Hello, I have windows 11 pro x64, 21H2, I have a problem with bitlocker, I have a main hard drive with the operating system, 480gb in GPT , when I go to encrypt the hard drive with bitlocker it asks me to either put an unlock Pin to the start the system, or insert a usb memory, but it does not let me combine the two options (if there is a usb memory inserted, it unlocks automatically, if there is no usb memory inserted, it sends you to memer the pin or insert the flash drive. In windows 10 It allowed me to combine the 2, but in windows 11 it doesn't let me combine the 2 options (either one or the other), I hope you can help me, thanks

Click to expand...

Does your system have either a hardware TPM or a Firmware TPM? If so, enabling it would be the best course of action.

If you tell me what kind of system (or the MB / CPU if it is a self-built system), I'll lookup what capabilities you should have.

The syntax would be:

manage-bde -protectors -add C: -TPMandPINandStartupKey -tp 12345678 -tsk E:

["12345678" being the PIN and e:\ being the usb key's drive letter]

Hello, I finally have free time and I can use the computer, thanks for the answers, I have been trying what you have told me, first of all my computer is an asus gl753v if it has tmp and it is activated (in uefi it says security boot: enable .)
I have done tests in gpedit and it only works for me like the attached photo, and if this happens to me, when I start the system bitlocker appears and it asks me for the pin, if I turn off the computer and turn it on again and now it asks me to insert a usb memory where The recovery key was saved, every time I start and shut down the computer it asks me once for a pin and the next time for a USB flash drive and so on.

sevenup777 said:

if it has tmp and it is activated (in uefi it says security boot: enable .)

Click to expand...

Secure Boot has absolutely nothing to do with the TPM. Having Secure Boot enabled in way indicates that the TPM is enabled nor does it even mean that a TPM is present in the system. Sorry

this is the tmp that i have