Policy
Disable BitLocker trust of Windows Recovery Environment (WinRE)
Microsoft Windows
Policy overview
Key metadata and intent for this policy.
Supported OS tags: Windows10, Windows10RT, Windows11, Windows81, WindowsRT81, WindowsServer2012R2, WindowsServer2016
This policy setting controls whether BitLocker trusts Windows Recovery Environment (WinRE). When BitLocker trusts WinRE, WinRE can access the BitLocker-protected operating system volume without requiring the BitLocker recovery key. This supports recovery operations that need access to the operating system volume. Important: Enabling this policy changes recovery behavior. If you enable this policy setting, BitLocker doesn't trust WinRE. The BitLocker recovery key is required for any WinRE operation that needs to access the BitLocker-protected operating system volume. Recovery operations that rely on WinRE access to the operating system volume might require user or administrator intervention and might not complete automatically, including Startup Repair, Quick Machine Recovery, Push-button Recovery, and MDM-initiated remote reset or wipe using the RemoteWipe CSP. If you disable or don't configure this policy setting, BitLocker trusts a validated WinRE image so that WinRE can access the BitLocker-protected operating system volume without the recovery key. This policy setting is enforced only when BitLocker or device encryption is enabled.
Registry values
How enabled and disabled states update the registry.
| Scope | Registry location | Type | Enabled value | Disabled value | Copy |
|---|---|---|---|---|---|
| Computer | Path Software\Policies\Microsoft\FVE Value name DisableWinRETrust | REG_DWORD | HKLM 1 | HKLM 0 |
Policy elements
Inputs and configuration options exposed by this policy.
This policy has no additional user input fields.