Policy
Choose drive encryption method and cipher strength (Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10 [Version 1507])
Windows 11 25H2
Policy overview
Key metadata and intent for this policy.
Supported OS tags: Windows10, Windows10RT, Windows11, Windows8, Windows81, WindowsRT, WindowsRT81, WindowsServer2012, WindowsServer2012R2, WindowsServer2016
This policy setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption method has no effect if the drive is already encrypted or if encryption is in progress. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about the encryption methods available. This policy is only applicable to computers running Windows 8 and later. If you enable this policy setting you will be able to choose an encryption algorithm and key cipher strength for BitLocker to use to encrypt drives. If you disable or do not configure this policy setting, BitLocker will use AES with the same bit strength (128-bit or 256-bit) as the "Choose drive encryption method and cipher strength (Windows Vista, Windows Server 2008, Windows 7)" policy setting, if it is set. If neither policy is set, BitLocker will use the default encryption method of AES 128-bit or the encryption method specified by the setup script.
Registry values
How enabled and disabled states update the registry.
No explicit registry values are set for enabled or disabled states.
Policy elements
Inputs and configuration options exposed by this policy.
| Element | Type | Registry mapping | Constraints & behavior |
|---|---|---|---|
Select the encryption method: ID EncryptionMethodNoDiffDropDown_Name | enum | HKLM\SOFTWARE\Policies\Microsoft\FVE\EncryptionMethodNoDiffuser Type REG_DWORD | Options: AES 128-bit (default) (3), AES 256-bit (4) |
Other policies in this category
Explore related policies at the same level.
- ComputerChoose default folder for recovery passwordAt least Windows Vista
- ComputerChoose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)At least Windows Server 2016, Windows 10
- ComputerChoose drive encryption method and cipher strength (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2)Windows Server 2008, Windows 7, and Windows Vista
- ComputerChoose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista)Windows Server 2008 and Windows Vista
- ComputerDisable new DMA devices when this computer is lockedAt least Windows Server 2016, Windows 10 Version 1703
- ComputerPrevent memory overwrite on restartWindows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows 8, Windows Server 2008, Windows 7, and Windows Vista
- ComputerProvide the unique identifiers for your organizationAt least Windows Server 2008 R2 or Windows 7
- ComputerStore BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)Windows Server 2008 and Windows Vista
- ComputerValidate smart card certificate usage rule complianceAt least Windows Server 2008 R2 or Windows 7