Configure use of passwords for fixed data drives
Verified with Windows 11 25H2 — updated on July 12, 2026
Supported on: At least Windows Server 2008 R2 or Windows 7
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives Description
This policy setting specifies whether a password is required to unlock BitLocker-protected fixed data drives. If you choose to permit the use of a password, you can require that a password be used, enforce complexity requirements on the password, and configure a minimum length for the password. For the complexity requirement setting to be effective the Group Policy setting "Password must meet complexity requirements" located in Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\ must be also enabled. Note: These settings are enforced when turning on BitLocker, not when unlocking a volume. BitLocker will allow unlocking a drive with any of the protectors available on the drive. If you enable this policy setting, users can configure a password that meets the requirements you define. To require the use of a password, select "Require password for fixed data drive". To enforce complexity requirements on the password, select "Require complexity". When set to "Require complexity" a connection to a domain controller is necessary when BitLocker is enabled to validate the complexity the password. When set to "Allow complexity" a connection to a domain controller will be attempted to validate the complexity adheres to the rules set by the policy, but if no domain controllers are found the password will still be accepted regardless of actual password complexity and the drive will be encrypted using that password as a protector. When set to "Do not allow complexity", no password complexity validation will be done. Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the "Minimum password length" box. If you disable this policy setting, the user is not allowed to use a password. If you do not configure this policy setting, passwords will be supported with the default settings, which do not include password complexity requirements and require only 8 characters. Note: Passwords cannot be used if FIPS-compliance is enabled. The "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" policy setting in Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options specifies whether FIPS-compliance is enabled.
Registry
Software\Policies\Microsoft\FVE Value name: FDVPassphrase
Enabled: FDVPassphrase = 1
Disabled: FDVPassphrase = 0
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Configure use of passwords for fixed data drives
; State: Enabled
; Supported on: At least Windows Server 2008 R2 or Windows 7
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE]
"FDVPassphrase"=dword:00000001
"FDVEnforcePassphrase"=dword:00000000
"FDVPassphraseComplexity"=dword:00000002
"FDVPassphraseLength"=dword:00000008More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Configure use of passwords for fixed data drives
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
$path = 'HKLM:\Software\Policies\Microsoft\FVE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'FDVPassphrase' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'FDVEnforcePassphrase' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'FDVPassphraseComplexity' -Value 2 -Type DWord
Set-ItemProperty -Path $path -Name 'FDVPassphraseLength' -Value 8 -Type DWordIntune XML
No direct Policy CSP / OMA-URI mapping for this policy. Use the Intune Remediation tab, or ingest the ADMX in Intune.Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Configure use of passwords for fixed data drives
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\FVE' -Name 'FDVPassphrase' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\FVE' -Name 'FDVEnforcePassphrase' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\FVE' -Name 'FDVPassphraseComplexity' -Expected 2 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\FVE' -Name 'FDVPassphraseLength' -Expected 8 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure use of passwords for fixed data drives
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
$path = 'HKLM:\Software\Policies\Microsoft\FVE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'FDVPassphrase' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'FDVEnforcePassphrase' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'FDVPassphraseComplexity' -Value 2 -Type DWord
Set-ItemProperty -Path $path -Name 'FDVPassphraseLength' -Value 8 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Configure use of passwords for fixed data drives
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Configure use of passwords for fixed data drives
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\FVE' -Name 'FDVPassphrase' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\FVE' -Name 'FDVEnforcePassphrase' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\FVE' -Name 'FDVPassphraseComplexity' -Expected 2 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\FVE' -Name 'FDVPassphraseLength' -Expected 8 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure use of passwords for fixed data drives
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
$path = 'HKLM:\Software\Policies\Microsoft\FVE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'FDVPassphrase' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'FDVEnforcePassphrase' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'FDVPassphraseComplexity' -Value 2 -Type DWord
Set-ItemProperty -Path $path -Name 'FDVPassphraseLength' -Value 8 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.