Configure use of hardware-based encryption for removable data drives
Verified with Windows 11 25H2 — updated on July 10, 2026
Supported on: At least Windows Server 2012 or Windows 8
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives Description
This policy setting allows you to manage BitLocker’s use of hardware-based encryption on removable data drives and specify which encryption algorithms it can use with hardware-based encryption. Using hardware-based encryption can improve performance of drive operations that involve frequent reading or writing of data to the drive. If you enable this policy setting, you can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption and whether you want to restrict the encryption algorithms and cipher suites used with hardware-based encryption. If you disable this policy setting, BitLocker cannot use hardware-based encryption with operating system drives and BitLocker software-based encryption will be used by default when the drive is encrypted. If you do not configure this policy setting, BitLocker will use software-based encryption irrespective of hardware-based encryption availability. Note: The “Choose drive encryption method and cipher strength” policy setting does not apply to hardware-based encryption. The encryption algorithm used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm configured on the drive to encrypt the drive. The “Restrict encryption algorithms and cipher suites allowed for hardware-based encryption” option enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm set for the drive is not available, BitLocker will disable the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID). For example: - AES 128 in CBC mode OID: 2.16.840.1.101.3.4.1.2 - AES 256 in CBC mode OID: 2.16.840.1.101.3.4.1.42
Registry
SOFTWARE\Policies\Microsoft\FVE Value name: RDVHardwareEncryption
Enabled: RDVHardwareEncryption = 1
Disabled: RDVHardwareEncryption = 0
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Configure use of hardware-based encryption for removable data drives
; State: Enabled
; Supported on: At least Windows Server 2012 or Windows 8
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE]
"RDVHardwareEncryption"=dword:00000001
"RDVAllowSoftwareEncryptionFailover"=dword:00000001
"RDVRestrictHardwareEncryptionAlgorithms"=dword:00000000
"RDVAllowedHardwareEncryptionAlgorithms"=""More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Configure use of hardware-based encryption for removable data drives
# State: Enabled
# Supported on: At least Windows Server 2012 or Windows 8
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\FVE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'RDVHardwareEncryption' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'RDVAllowSoftwareEncryptionFailover' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'RDVRestrictHardwareEncryptionAlgorithms' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'RDVAllowedHardwareEncryptionAlgorithms' -Value '' -Type StringIntune XML
No direct Policy CSP / OMA-URI mapping for this policy. Use the Intune Remediation tab, or ingest the ADMX in Intune.Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Configure use of hardware-based encryption for removable data drives
# State: Enabled
# Supported on: At least Windows Server 2012 or Windows 8
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE' -Name 'RDVHardwareEncryption' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE' -Name 'RDVAllowSoftwareEncryptionFailover' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE' -Name 'RDVRestrictHardwareEncryptionAlgorithms' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE' -Name 'RDVAllowedHardwareEncryptionAlgorithms' -Expected '' -Kind String)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure use of hardware-based encryption for removable data drives
# State: Enabled
# Supported on: At least Windows Server 2012 or Windows 8
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\FVE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'RDVHardwareEncryption' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'RDVAllowSoftwareEncryptionFailover' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'RDVRestrictHardwareEncryptionAlgorithms' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'RDVAllowedHardwareEncryptionAlgorithms' -Value '' -Type StringSCCM scripts
# Exported from gporais.com
# Policy: Configure use of hardware-based encryption for removable data drives
# State: Enabled
# Supported on: At least Windows Server 2012 or Windows 8
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Configure use of hardware-based encryption for removable data drives
# State: Enabled
# Supported on: At least Windows Server 2012 or Windows 8
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE' -Name 'RDVHardwareEncryption' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE' -Name 'RDVAllowSoftwareEncryptionFailover' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE' -Name 'RDVRestrictHardwareEncryptionAlgorithms' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE' -Name 'RDVAllowedHardwareEncryptionAlgorithms' -Expected '' -Kind String)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure use of hardware-based encryption for removable data drives
# State: Enabled
# Supported on: At least Windows Server 2012 or Windows 8
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\FVE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'RDVHardwareEncryption' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'RDVAllowSoftwareEncryptionFailover' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'RDVRestrictHardwareEncryptionAlgorithms' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'RDVAllowedHardwareEncryptionAlgorithms' -Value '' -Type StringBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.