Choose drive encryption method and cipher strength (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2): registry value EncryptionMethodComputerHKLM\Software\Policies\Microsoft\FVE
- Policy ID
- EncryptionMethod_Name
- Scope
- Computer Configuration
- Supported on
- Windows Server 2008, Windows 7, and Windows Vista
- Source
- Administrative Templates (.admx) for Windows 11 2026 Update (26H2) (version 1.0)
- Category
- Windows Components › BitLocker Drive Encryption
Registry
EncryptionMethod
REG_DWORDComputerHKLM\SOFTWARE\Policies\Microsoft\FVE Current key
- Enabled value
- Depends on the option value
- Element
- Select the encryption method:
| Item | Stored value |
|---|---|
| AES 128-bit with Diffuser | 1 |
| AES 256-bit with Diffuser | 2 |
| AES 128-bit (default) | 3 |
| AES 256-bit | 4 |
Apply with .reg · CMD · PowerShell
.reg
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE] ; Options (use only one) ; AES 128-bit with Diffuser "EncryptionMethod"=dword:00000001 ; AES 256-bit with Diffuser "EncryptionMethod"=dword:00000002 ; AES 128-bit (default) "EncryptionMethod"=dword:00000003 ; AES 256-bit "EncryptionMethod"=dword:00000004
CMD
:: Options (use only one) :: AES 128-bit with Diffuser reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v "EncryptionMethod" /t REG_DWORD /d 1 /f :: AES 256-bit with Diffuser reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v "EncryptionMethod" /t REG_DWORD /d 2 /f :: AES 128-bit (default) reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v "EncryptionMethod" /t REG_DWORD /d 3 /f :: AES 256-bit reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v "EncryptionMethod" /t REG_DWORD /d 4 /f
PowerShell
# Common: create the key New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE' -Force | Out-Null # Options (use only one) # AES 128-bit with Diffuser New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE' -Name 'EncryptionMethod' -PropertyType DWord -Value 1 -Force | Out-Null # AES 256-bit with Diffuser New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE' -Name 'EncryptionMethod' -PropertyType DWord -Value 2 -Force | Out-Null # AES 128-bit (default) New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE' -Name 'EncryptionMethod' -PropertyType DWord -Value 3 -Force | Out-Null # AES 256-bit New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE' -Name 'EncryptionMethod' -PropertyType DWord -Value 4 -Force | Out-Null