Specify Minimum Length for BitLocker Startup PIN in Windows 11/10

Originally, BitLocker allowed from 4 to 20 characters for a PIN. Now, the minimum length for the BitLocker PIN was increased to 6 characters to better align with other Windows features that leverage TPM 2.0.

To help organizations with the transition, now in Windows 11/10, the BitLocker PIN length is 6 characters by default, but it can be reduced to 4 characters. If the minimum PIN length is set below 6 digits, Windows will attempt to update the TPM 2.0 lockout period to be greater than the default when a PIN is changed. If successful, Windows will only reset the TPM lockout period back to default if the TPM is reset.

Increasing the BitLocker Startup PIN length requires a greater number of guesses for an attacker. In that case, the lockout duration between each guess can be shortened to allow legitimate users to retry a failed attempt sooner while maintaining a similar level of protection.

Specify Minimum Length for BitLocker Startup PIN

Open the Local Group Policy Editor. and on the left pane of Local Group Policy Editor, navigate to the location-

Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.

On the right pane of Operating System Drives double-click Configure minimum PIN length for startup policy to edit it.

This policy setting allows you to configure a minimum length for a Trusted Platform Module (TPM) startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits and can have a maximum length of 20 digits.

If you enable this policy setting, you can require a minimum number of digits to be used when setting the startup PIN.

If you disable or do not configure this policy setting, users can configure a startup PIN of any length between 6 and 20 digits.

If minimum PIN length is set below 6 digits, Windows will attempt to update the TPM 2.0 lockout period to be greater than the default when a PIN is changed. If successful, Windows will only reset the TPM lockout period back to default if the TPM is reset.

Now do the following;

To Use Default Minimum Length for BitLocker Startup PIN

Select the radio button for Not Configured or Disabled, click OK.

To Specify Minimum Length for BitLocker Startup PIN

Select the radio button for Enabled, enter a number between 4 to 20 in Minimum characters field for what you want, click OK.

You can now exit Group Policy Editor and restart your system.

This is how you can configure the Minimum Length for BitLocker Startup PIN in Windows 11/10.