Group Policy SearchGroup Policy Search
English

Configure TPM platform validation profile (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2)

Policy ID
PlatformValidation_Deprecated_Name
Scope
Computer Configuration
Supported on
Windows Server 2008, Windows 7, and Windows Vista
Source
Administrative Templates (.admx) for Windows 11 2026 Update (26H2) (version 1.0)
Category
Windows Components › BitLocker Drive Encryption › Operating System Drives

Description

This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection.

If you enable this policy setting before turning on BitLocker, you can configure the boot components that the TPM will validate before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM will not release the encryption key to unlock the drive and the computer will instead display the BitLocker Recovery console and require that either the recovery password or recovery key be provided to unlock the drive.

If you disable or do not configure this policy setting, the TPM uses the default platform validation profile or the platform validation profile specified by the setup script. A platform validation profile consists of a set of Platform Configuration Register (PCR) indices ranging from 0 to 23, The default platform validation profile secures the encryption key against changes to the Core Root of Trust of Measurement (CRTM), BIOS, and Platform Extensions (PCR 0), the Option ROM Code (PCR 2), the Master Boot Record (MBR) Code (PCR 4), the NTFS Boot Sector (PCR 8), the NTFS Boot Block (PCR 9), the Boot Manager (PCR 10), and the BitLocker Access Control (PCR 11). The descriptions of PCR settings for computers that use an Extensible Firmware Interface (EFI) are different than the PCR settings described for computers that use a standard BIOS.

Warning: Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending upon inclusion or exclusion (respectively) of the PCRs.

Options

The empty box and the checked box tell the checkbox items of the Group Policy editor apart (a checked box is an item that is selected by default).

  • A platform validation profile consists of a set of Platform Configuration Register (PCR) indices. Each PCR index is associated with components that run when Windows starts.
  • Use the check boxes below to choose the PCR indices to include in the profile.
  • Exercise caution when changing this setting.
  • We recommend the default of PCRs 0, 2, 4, 8, 9, 10, and 11.
  • For BitLocker protection to take effect, you must include PCR 11.
  • Consult online documentation for more information about the benefits and risks of changing the default TPM platform validation profile.
  • PCR 0: Core Root of Trust of Measurement (CRTM), BIOS, and Platform Extensions
  • PCR 1: Platform and Motherboard Configuration and Data
  • PCR 2: Option ROM Code
  • PCR 3: Option ROM Configuration and Data
  • PCR 4: Master Boot Record (MBR) Code
  • PCR 5: Master Boot Record (MBR) Partition Table
  • PCR 6: State Transition and Wake Events
  • PCR 7: Computer Manufacturer-Specific
  • PCR 8: NTFS Boot Sector
  • PCR 9: NTFS Boot Block
  • PCR 10: Boot Manager
  • PCR 11: BitLocker Access Control
  • PCR 12: Reserved for Future Use
  • PCR 13: Reserved for Future Use
  • PCR 14: Reserved for Future Use
  • PCR 15: Reserved for Future Use
  • PCR 16: Reserved for Future Use
  • PCR 17: Reserved for Future Use
  • PCR 18: Reserved for Future Use
  • PCR 19: Reserved for Future Use
  • PCR 20: Reserved for Future Use
  • PCR 21: Reserved for Future Use
  • PCR 22: Reserved for Future Use
  • PCR 23: Reserved for Future Use

Registry

ComputerHKEY_LOCAL_MACHINE
HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidationView registry values
  • EnabledREG_DWORD
  • 0REG_DWORD
  • 1REG_DWORD
  • 2REG_DWORD
  • 3REG_DWORD
  • 4REG_DWORD
  • 5REG_DWORD
  • 6REG_DWORD
  • 7REG_DWORD
  • 8REG_DWORD
  • 9REG_DWORD
  • 10REG_DWORD
  • 11REG_DWORD
  • 12REG_DWORD
  • 13REG_DWORD
  • 14REG_DWORD
  • 15REG_DWORD
  • 16REG_DWORD
  • 17REG_DWORD
  • 18REG_DWORD
  • 19REG_DWORD
  • 20REG_DWORD
  • 21REG_DWORD
  • 22REG_DWORD
  • 23REG_DWORD

Other policies in the same category

View all policies in this category (20)