Bitlocker problem

Set UseTPM=0, keep UseTPMPIN=1, and change EnableBDEWithNoTPM=0; this requires TPM + PIN while disallowing the conflicting TPM-only and non-TPM startup methods.

UseTPM=0 does not disable the TPM hardware. It disallows TPM-only startup. UseTPMPIN=1 selects TPM plus PIN, so the TPM remains part of the OS-drive protector. Only one startup-authentication option can be required; conflicting options cause a policy error.^1^

Correct startup-authentication configuration

Deploy these values through one Intune BitLocker policy rather than maintaining overlapping registry, Endpoint Security, security baseline, and Administrative Template settings:

UseAdvancedStartup       = 1   # Require additional authentication
EnableBDEWithNoTPM       = 0   # Do not permit non-TPM BitLocker
UseTPM                   = 0   # Do not allow TPM-only startup
UseTPMPIN                = 1   # Require TPM + PIN
UseTPMKey                = 0   # Do not allow TPM + startup key
UseTPMKeyPIN             = 0   # Do not allow TPM + key + PIN
MinimumPIN               = 6

In Intune, configure the equivalent settings under Endpoint security → Disk encryption → Create Policy → Windows 10/11 → BitLocker:

• Additional authentication at startup: Require
• BitLocker with non-compatible TPM chip: Block
• Compatible TPM startup: Do not allow TPM
• Compatible TPM startup PIN: Require startup PIN with TPM
• Compatible TPM startup key: Do not allow startup key with TPM
• Compatible TPM startup key and PIN: Do not allow

Intune documents TPM-only and TPM-plus-PIN as separate choices; requiring a PIN involves user interaction and therefore is incompatible with silent encryption.^2^

Configure removable USB drives separately

TPM startup settings apply to the operating-system volume, not USB drives and generally not fixed data volumes. Fixed data drives are encrypted separately and can use another protector or automatic unlock after the OS volume is unlocked.^3^

For USB drives, configure:

• Control use of BitLocker on removable drives: Enabled
  • Allow users to apply BitLocker protection: Enabled
• Deny write access to removable drives not protected by BitLocker: Enabled
• Configure use of passwords for removable data drives: Enabled
  • Require a password and set the required minimum length
• Do not require or permit a removable-drive recovery key file when write access to unencrypted removable drives is denied. Microsoft specifically requires recovery keys to be disallowed with that write-denial policy.^4^

Also verify that these policies are disabled in both Computer and User Configuration:

Administrative Templates → System → Removable Storage Access

• All removable storage classes: Deny all access
• Removable Disks: Deny write access
• Removable Disks: Deny read access

Those generic removable-storage policies override or interfere with BitLocker removable-drive handling.^5^

RDVDenyWriteAccess=1 is otherwise appropriate: an unencrypted USB drive mounts read-only, while a BitLocker-protected USB drive receives read/write access.^1^

Correct the encryption-method interpretation

These values currently specify AES-CBC 256, not XTS-AES:

EncryptionMethodWithXtsOs  = 4
EncryptionMethodWithXtsFdv = 4
EncryptionMethodWithXtsRdv = 4

The mappings are:

• 3 = AES-CBC 128
• 4 = AES-CBC 256
• 6 = XTS-AES 128
• 7 = XTS-AES 256

Use 7 if the intended requirement is XTS-AES 256.^6^

Policy changes apply when encryption starts; they do not change the algorithm of an already-encrypted volume.^1^

Existing OS drives with a TPM-only protector

Changing policy does not automatically replace existing protectors. Safely migrate them:

1. Confirm that the recovery password is escrowed and usable before changing protectors.
2. From an elevated Command Prompt, list existing protectors:

manage-bde -protectors -get C:

3. Add TPM plus PIN and enter the PIN when prompted:

manage-bde -protectors -add C: -TPMAndPIN

4. Restart and verify that preboot requests the PIN.
5. Run manage-bde -protectors -get C: again and record the ID of the old TPM-only protector.
6. Delete only that old TPM-only protector:

manage-bde -protectors -delete C: -id {TPM-only-protector-ID}

Do not remove the recovery-password or new TPM-and-PIN protector. Leaving the TPM-only protector present can retain a PIN-less startup path.

If the USB wizard still reports a conflict

After the revised policy is assigned:

1. Run Settings → Accounts → Access work or school → account → Info → Sync.
2. Open Event Viewer → Applications and Services Logs → Microsoft → Windows → BitLocker-API and inspect the Management log.
3. Also inspect DeviceManagement-Enterprise-Diagnostics-Provider → Admin for a rejected CSP setting or another profile applying different values.

Microsoft identifies the BitLocker-API log as the primary location for policy conflicts and missing prerequisites.^6^

References

1. BitLocker CSP
2. Windows settings you can manage through an Intune Endpoint Protection profile
3. BitLocker planning guide
4. Configure BitLocker
5. BitLocker settings reference
6. Troubleshooting BitLocker policies from the client side