Allow access to BitLocker-protected fixed data drives from earlier versions of Windows
Verified with Windows 11 25H2 — updated on July 12, 2026
Supported on: At least Windows Server 2008 R2 or Windows 7 through Windows Server 2022 or Windows 11 Version 22H2
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives Description
This policy setting configures whether or not fixed data drives formatted with the FAT file system can be unlocked and viewed on computers running Windows Server 2008, Windows Vista, Windows XP with Service Pack 3 (SP3), or Windows XP with Service Pack 2 (SP2) operating systems. If this policy setting is enabled or not configured, fixed data drives formatted with the FAT file system can be unlocked on computers running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have read-only access to BitLocker-protected drives. When this policy setting is enabled, select the "Do not install BitLocker To Go Reader on FAT formatted fixed drives" check box to help prevent users from running BitLocker To Go Reader from their fixed drives. If BitLocker To Go Reader (bitlockertogo.exe) is present on a drive that does not have an identification field specified, or if the drive has the same identification field as specified in the "Provide unique identifiers for your organization" policy setting, the user will be prompted to update BitLocker and BitLocker To Go Reader will be deleted from the drive. In this situation, for the fixed drive to be unlocked on computers running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2, BitLocker To Go Reader must be installed on the computer. If this check box is not selected, BitLocker To Go Reader will be installed on the fixed drive to enable users to unlock the drive on computers running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2 that do not have BitLocker To Go Reader installed. If this policy setting is disabled, fixed data drives formatted with the FAT file system that are BitLocker-protected cannot be unlocked on computers running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. Bitlockertogo.exe will not be installed. Note: This policy setting does not apply to drives that are formatted with the NTFS file system.
Registry
Software\Policies\Microsoft\FVE Value name: FDVDiscoveryVolumeType
Enabled: FDVDiscoveryVolumeType = FAT32
Disabled: FDVDiscoveryVolumeType = <none>
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows
; State: Enabled
; Supported on: At least Windows Server 2008 R2 or Windows 7 through Windows Server 2022 or Windows 11 Version 22H2
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE]
"FDVDiscoveryVolumeType"="FAT32"
"FDVNoBitLockerToGoReader"=dword:00000000More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7 through Windows Server 2022 or Windows 11 Version 22H2
$path = 'HKLM:\Software\Policies\Microsoft\FVE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'FDVDiscoveryVolumeType' -Value 'FAT32' -Type String
Set-ItemProperty -Path $path -Name 'FDVNoBitLockerToGoReader' -Value 0 -Type DWordIntune XML
No direct Policy CSP / OMA-URI mapping for this policy. Use the Intune Remediation tab, or ingest the ADMX in Intune.Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7 through Windows Server 2022 or Windows 11 Version 22H2
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\FVE' -Name 'FDVDiscoveryVolumeType' -Expected 'FAT32' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\FVE' -Name 'FDVNoBitLockerToGoReader' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7 through Windows Server 2022 or Windows 11 Version 22H2
$path = 'HKLM:\Software\Policies\Microsoft\FVE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'FDVDiscoveryVolumeType' -Value 'FAT32' -Type String
Set-ItemProperty -Path $path -Name 'FDVNoBitLockerToGoReader' -Value 0 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7 through Windows Server 2022 or Windows 11 Version 22H2
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7 through Windows Server 2022 or Windows 11 Version 22H2
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\FVE' -Name 'FDVDiscoveryVolumeType' -Expected 'FAT32' -Kind String)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\FVE' -Name 'FDVNoBitLockerToGoReader' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Allow access to BitLocker-protected fixed data drives from earlier versions of Windows
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7 through Windows Server 2022 or Windows 11 Version 22H2
$path = 'HKLM:\Software\Policies\Microsoft\FVE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'FDVDiscoveryVolumeType' -Value 'FAT32' -Type String
Set-ItemProperty -Path $path -Name 'FDVNoBitLockerToGoReader' -Value 0 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.