Policy
Configure TPM platform validation profile for native UEFI firmware configurations
Microsoft Windows
Policy overview
Key metadata and intent for this policy.
Supported OS tags: Windows10, Windows10RT, Windows11, Windows8, Windows81, WindowsRT, WindowsRT81, WindowsServer2012, WindowsServer2012R2, WindowsServer2016
This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection. Important: This group policy only applies to computers with a native UEFI firmware configuration. Computers with BIOS or UEFI firmware with a Compatibility Service Module (CSM) enabled store different values into the Platform Configuration Registers (PCRs). Use the "Configure TPM platform validation profile for BIOS-based firmware configurations" group policy setting to configure the TPM PCR profile for computers with BIOS configurations or computers with UEFI firmware with a CSM enabled. If you enable this policy setting before turning on BitLocker, you can configure the boot components that the TPM will validate before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM will not release the encryption key to unlock the drive and the computer will instead display the BitLocker Recovery console and require that either the recovery password or recovery key be provided to unlock the drive. If you disable or do not configure this policy setting, BitLocker uses the default platform validation profile for the available hardware or the platform validation profile specified by the setup script. A platform validation profile consists of a set of Platform Configuration Register (PCR) indices ranging from 0 to 23. On PCs that lack Secure Boot State (PCR 7) support, the default platform validation profile secures the encryption key against changes to the core system firmware executable code (PCR 0), extended or pluggable executable code (PCR 2), boot manager (PCR 4), and the BitLocker access control (PCR 11). When Secure Boot State (PCR7) support is available, the default platform validation profile secures the encryption key using Secure Boot State (PCR 7) and the BitLocker access control (PCR 11). Warning: Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending upon inclusion or exclusion (respectively) of the PCRs. Specifically, setting this policy with PCR 7 omitted, will override the "Allow Secure Boot for integrity validation" group policy, preventing BitLocker from using Secure Boot for platform or Boot Configuration Data (BCD) integrity validation. Setting this policy may result in BitLocker recovery when firmware is updated. If you set this policy to include PCR 0, suspend BitLocker prior to applying firmware updates. It is recommended to not configure this policy, to allow Windows to select the PCR profile for the best combination of security and usability based on the available hardware on each PC.
Registry values
How enabled and disabled states update the registry.
| Scope | Registry location | Type | Enabled value | Disabled value | Copy |
|---|---|---|---|---|---|
| Computer | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name Enabled | REG_DWORD | HKLM 1 | HKLM 0 |
Policy elements
Inputs and configuration options exposed by this policy.
| Scope | Element | Type | Registry mapping | Constraints & behavior | Copy |
|---|---|---|---|---|---|
| Computer | PCR 0: Core System Firmware executable code ID PlatformValidation_UEFI_Setting0 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 0 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 1: Core System Firmware data ID PlatformValidation_UEFI_Setting1 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 1 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 2: Extended or pluggable executable code ID PlatformValidation_UEFI_Setting2 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 2 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 3: Extended or pluggable firmware data ID PlatformValidation_UEFI_Setting3 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 3 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 4: Boot Manager ID PlatformValidation_UEFI_Setting4 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 4 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 5: GPT / Partition Table ID PlatformValidation_UEFI_Setting5 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 5 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 6: Resume from S4 and S5 Power State Events ID PlatformValidation_UEFI_Setting6 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 6 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 7: Secure Boot State ID PlatformValidation_UEFI_Setting7 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 7 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 8: Initialized to 0 with no Extends (reserved for future use) ID PlatformValidation_UEFI_Setting8 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 8 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 9: Initialized to 0 with no Extends (reserved for future use) ID PlatformValidation_UEFI_Setting9 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 9 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 10: Initialized to 0 with no Extends (reserved for future use) ID PlatformValidation_UEFI_Setting10 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 10 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 11: BitLocker Access Control ID PlatformValidation_UEFI_Setting11 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 11 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 12: Data events and highly volatile events ID PlatformValidation_UEFI_Setting12 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 12 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 13: Boot Module Details ID PlatformValidation_UEFI_Setting13 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 13 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 14: Boot Authorities ID PlatformValidation_UEFI_Setting14 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 14 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 15: Reserved for Future Use ID PlatformValidation_UEFI_Setting15 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 15 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 16: Reserved for Future Use ID PlatformValidation_UEFI_Setting16 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 16 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 17: Reserved for Future Use ID PlatformValidation_UEFI_Setting17 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 17 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 18: Reserved for Future Use ID PlatformValidation_UEFI_Setting18 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 18 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 19: Reserved for Future Use ID PlatformValidation_UEFI_Setting19 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 19 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 20: Reserved for Future Use ID PlatformValidation_UEFI_Setting20 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 20 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 21: Reserved for Future Use ID PlatformValidation_UEFI_Setting21 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 21 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 22: Reserved for Future Use ID PlatformValidation_UEFI_Setting22 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 22 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 | |
| Computer | PCR 23: Reserved for Future Use ID PlatformValidation_UEFI_Setting23 | boolean | Path SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI Value name 23 Type REG_DWORD | Options: true (1), false (0) True: Set value = 1 · False: Set value = 0 |