How to Add a BitLocker Startup PIN (TPM + PIN) in Windows 11 and Fix the Group Policy Errors

You ran manage-bde -protectors -add C: -TPMAndPIN to add a BitLocker startup PIN on Windows 11, and it refused, returned error 0x80310060, or Windows reported a startup-option policy conflict. In most cases the cause is the Group Policy setting Require additional authentication at startup, which has to be enabled with no more than one startup option set to Required.

Quick Reference

Scenario	What to do
PIN protector won’t add at all	Enable Require additional authentication at startup (Step 4), then run `gpupdate /force`
Windows reports a policy conflict	Set only the TPM startup PIN option to Required (Fix #2)
Error code 0x80310060	Recheck that the policy applied and isn’t conflicting (Fix #3)
PIN rejected as too short or invalid	Check the minimum length and enhanced PIN policies (Fix #4)
Letters in the PIN don’t work at boot	Switch back to a numeric PIN (Fix #5)
Want to change the PIN later	Run `manage-bde -changepin C:` (Step 9)

What Is a BitLocker Startup PIN (TPM + PIN)?

BitLocker encrypts your Windows drive. On a PC with a TPM chip, the default setup is TPM-only. The TPM checks that the boot files haven’t been tampered with, then releases the encryption key automatically. You land at the normal Windows sign-in screen without typing anything extra.

That’s convenient, but anyone holding the laptop gets that same automatic start. TPM + PIN adds a second check. Windows won’t start loading until someone types the PIN, on top of the TPM’s hardware check. A stolen laptop stays encrypted until the thief guesses the PIN.

The startup PIN is separate from your Windows Hello PIN and from the 48-digit BitLocker recovery key. BitLocker asks for the recovery key when it can’t confirm the normal startup path, for example after a forgotten PIN or certain firmware, boot configuration or TPM changes, even if you didn’t knowingly cause a problem.

On a work PC managed with Intune or domain Group Policy, IT controls these settings and may overwrite local changes. Don’t change local policy or remove protectors on a managed PC; ask your IT admin to set up TPM + PIN for the device instead. If you’re not sure whether the PC is managed, check Settings > Accounts > Access work or school for a connected work account.

Before You Begin

Windows 11 Pro, Enterprise, or Education. Check under Settings > System > About > Windows specifications. Windows 11 Home uses Device Encryption, and the Group Policy steps in this guide aren’t available there, so this walkthrough assumes Pro or higher.
A working TPM. If you’re not sure, see our guide How to Check Your TPM Status in Windows 11. If it shows errors, Windows 11 TPM Errors Explained and How to Clear the TPM Chip in Windows 11 cover the repairs.
An administrator account on the PC.
BitLocker already turned on for drive C:. Step 2 shows how to confirm this.
Your BitLocker recovery key backed up. Step 1 covers this. Don’t skip it.

Windows 11 Settings > System > About page with the Windows specifications section expanded, Edition line showing Windows 11 Pro highlighted

How to Add a BitLocker Startup PIN in Windows 11

Step 1: Back Up Your Recovery Key

If you mistype or forget the new PIN at boot, the BitLocker recovery key is your way back into the drive. Save the recovery key before you touch any protector.

Follow our guide How to Find and Back Up Your BitLocker Recovery Key.
Store a copy somewhere off this PC, such as your Microsoft account, a printout, or a USB flash drive kept in a drawer.

If you also keep the recovery key in a password manager, protect that account with a strong password and two-factor authentication. Don’t store your new startup PIN alongside the recovery key; keep the PIN in your head or somewhere separate.

Step 2: Confirm BitLocker Is On for Drive C:

Open Control Panel > System and Security > BitLocker Drive Encryption.
Look at the entry for C: under Operating system drive.

You should see the drive listed with BitLocker on. If BitLocker is off, turn it on and let encryption finish before continuing.

Control Panel > System and Security > BitLocker Drive Encryption page showing the C: operating system drive with BitLocker on and its management options listed

Step 3: Open the BitLocker Policy Folder in Group Policy

Press Win + R.
Type gpedit.msc and press Enter.
In the left pane, go to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.

The right pane now lists the operating system drive policies. Look for Require additional authentication at startup, Configure minimum PIN length for startup, and Allow enhanced PINs for startup.

Local Group Policy Editor with the Operating System Drives folder selected under BitLocker Drive Encryption, right pane listing policies with Require additional authentication at startup highlighted

Step 4: Enable Require Additional Authentication at Startup

This is the step that most often stops the PIN from being added: on a PC without domain or MDM management, Windows won’t add a PIN protector until this policy allows a startup PIN. If the add still fails after this step, the fixes below cover other causes, such as a policy that hasn’t applied yet or the existing protector setup.

Double-click Require additional authentication at startup.
Select Enabled.
Leave Allow BitLocker without a compatible TPM unchecked if your PC has a TPM.
Set Configure TPM startup PIN to Require startup PIN with TPM (or Allow startup PIN with TPM if you want it optional).
Set Configure TPM startup to Allow TPM for now. That keeps your current TPM-only protector valid while you add and test the PIN, so the PC keeps starting normally while you test.
Set Configure TPM startup key and Configure TPM startup key and PIN to an Allow or Do not allow option. Neither should say Require.
Click Apply, then OK.

Require additional authentication at startup dialog with Enabled selected and the Configure TPM startup PIN dropdown set to Require startup PIN with TPM, other TPM dropdowns set to Allow or Do not allow

Allow TPM still permits a TPM-only protector, so this setting alone doesn’t enforce the PIN. Microsoft’s BitLocker CSP reference says this policy is applied when you turn on BitLocker, so changing it on an already-encrypted drive doesn’t remove or rewrite the protectors already there. On your PC, the protector list decides how C: unlocks.

The required finish is in Steps 7 and 8: remove the plain TPM protector, then confirm manage-bde -protectors -get C: lists only TPM And PIN and Numerical Password. As an extra guard, you can then set Configure TPM startup to Do not allow TPM (the CSP lists Disallowed as a value for this drop-down) and run gpupdate /force. Recheck the protector list after any later BitLocker change.

Item 6 matters more than it looks. Microsoft’s Group Policy settings reference says only one additional authentication option can be required at startup. Set two to Require and you get a policy error.

Step 5: Set the Optional PIN Policies

Both of these are optional. If you want letters or symbols in your PIN, enable enhanced PINs before you create it.

Double-click Configure minimum PIN length for startup, select Enabled, set a length, and click OK.
Double-click Allow enhanced PINs for startup, select Enabled, and click OK. Skip this if you’ll use a digits-only PIN.

The Configuration section below explains both.

Step 6: Apply the Policy

Close the Local Group Policy Editor.
Right-click Start and choose Terminal (Admin). Accept the UAC prompt.
Run this command:

gpupdate /force

You should see a message that the computer policy update completed. The exact wording can vary by Windows build and language.

Step 7: Add the TPM + PIN Protector

In the same admin Terminal, run:

manage-bde -protectors -add C: -TPMAndPIN

Type your PIN when prompted, then type it again to confirm. The characters won’t appear as you type.

The command should confirm that a key protector was added. The exact wording varies by build and language, so Step 8 is the real check.

BitLocker treats protectors as alternative unlock methods, not cumulative requirements. As long as a plain TPM protector stays active on the volume, the drive can still unlock automatically through the TPM alone, without anyone entering the PIN, which defeats the purpose of adding TPM + PIN.

Before removing anything, run manage-bde -protectors -get C: and note the ID of the existing plain TPM protector. Confirm a Numerical Password (recovery) protector is also listed and that you’ve backed up its key per Step 1. Run manage-bde -status C: too, and don’t continue while the drive is still encrypting or decrypting. Restart the PC and confirm the TPM + PIN prompt actually appears at boot before you delete the old protector.

Once you’ve confirmed TPM + PIN works, remove the plain TPM protector with manage-bde -protectors -delete C: -id {ID}, using the ID you noted. Never delete the Numerical Password protector, and never remove the last protector that can actually unlock the drive at startup; always keep a working recovery protector in reserve.

Step 8: Verify the Protector

Run:

manage-bde -protectors -get C:

Look through the list of key protectors.

You should see an entry labeled TPM And PIN, plus your Numerical Password (the recovery key).

If a plain TPM entry is still listed, the PIN isn’t enforced yet. Finish the removal in Step 7 after the restart below confirms the PIN prompt works.

If you don’t see a TPM And PIN entry at all, the add didn’t stick. Go to Fix #1.

Elevated Windows Terminal window showing output of manage-bde -protectors -get C: with the TPM And PIN protector entry and Numerical Password entry highlighted

Restart the PC.

Before Windows loads, a BitLocker screen asks for your PIN. Type it and press Enter, and Windows starts as usual. Rerun manage-bde -protectors -get C: afterward if you want to confirm the protector list.

Step 9: Change the PIN Later

You can swap the PIN anytime without removing BitLocker protection.

Open Terminal (Admin).
Run:

manage-bde -changepin C:

Type the new PIN and confirm it.

If TPM + PIN is the drive’s startup protector, the next restart asks for the new PIN. If the command reports an error, recheck the policy in Step 4. The manage-bde reference lists the full switch set. Run manage-bde -changepin -? to see the options on your build.

Configuration: PIN Length, Enhanced PINs, and Protector Types

Minimum PIN Length

Configure minimum PIN length for startup sets the shortest PIN Windows will accept. Microsoft’s Configure BitLocker documentation says that with this policy enabled you can set a minimum as low as 4 digits (the maximum is 20). If the policy is disabled or not configured, the startup PIN must be 6 to 20 digits. I’d pick at least 6 digits for a laptop that leaves the house.

Enhanced PINs

A standard startup PIN is digits only. Allow enhanced PINs for startup lets new PINs include uppercase and lowercase letters, symbols, numbers, and spaces. If you already have a numeric PIN, run manage-bde -changepin C: after enabling the policy to set a new one.

There’s a catch. Microsoft’s documentation warns that not all computers support enhanced PIN characters in the pre-boot environment and recommends checking this during setup, so on some PCs an enhanced PIN can be accepted in Windows and then fail at boot. Do you need one? For a family PC or small-office laptop, a long numeric PIN is the safer pick. Microsoft’s BitLocker FAQ explains how TPM protections against PIN guessing work and how they vary between devices.

Comparing Startup Options

Option	What happens at boot	Main trade-off	How to set it up
TPM-only	Starts automatically, no input	Anyone who powers it on reaches sign-in	Default BitLocker setup
TPM + PIN	You type a PIN before Windows loads	Must remember the PIN	Policy + `-TPMAndPIN`
TPM + startup key	You plug in a USB drive before Windows loads	Lose the USB drive and you need the recovery key	Policy + startup key protector
TPM + PIN + startup key	You need both the PIN and the USB drive	Highest friction	`manage-bde -protectors -add C: -TPMAndPINAndStartupKey`

To add a PIN and a startup key together as one protector, use manage-bde, as shown in the table above. See the manage-bde protectors reference.

Fix #1: Force the Group Policy to Apply

If manage-bde still refuses the PIN after Step 4, Windows may not have picked up the new policy yet.

Open Terminal (Admin). A regular, non-elevated window can’t change protectors.
Run gpupdate /force.
Restart the PC.
Open Terminal (Admin) again and rerun manage-bde -protectors -add C: -TPMAndPIN.

The command should now report the protector was added.

Fix #2: Set Only One Startup Option to Required

A policy-conflict message usually means two or more startup options in Require additional authentication at startup are set to Require.

Open gpedit.msc and go back to Operating System Drives.
Double-click Require additional authentication at startup.
Set Configure TPM startup PIN to Require startup PIN with TPM.
Change every other dropdown that says Require to an Allow or Do not allow option. Configure TPM startup can read Allow TPM while you set up the PIN; switch it to Do not allow TPM once the plain TPM protector is gone (see Step 4).
Click Apply, then OK.
Run gpupdate /force in Terminal (Admin).
Retry Step 7.

Require additional authentication at startup dialog with only Configure TPM startup PIN set to Require startup PIN with TPM and Configure TPM startup set to Allow TPM

The conflict message should be gone and the protector should add cleanly.

Fix #3: Work Through Error 0x80310060

Error codes starting with 0x8031 come from BitLocker itself. Microsoft’s public documentation doesn’t give a dedicated explanation for 0x80310060, so don’t treat it as proof of a specific cause. When it shows up during this process, work through it as a general policy or protector problem first.

Confirm Require additional authentication at startup is Enabled with a startup PIN option allowed or required.
Confirm only one option is set to Require (Fix #2).
Run gpupdate /force and restart.
Run manage-bde -protectors -get C: to confirm what protectors exist now.
Check TPM health using our TPM status guide.
Retry manage-bde -protectors -add C: -TPMAndPIN.

If the code persists, copy the full error line manage-bde printed and search Microsoft Learn for that exact text.

Fix #4: Meet the PIN Length and Character Rules

A rejected PIN usually breaks one of the two PIN policies.

Open Configure minimum PIN length for startup and note the length set there.
If your PIN has letters or symbols, confirm Allow enhanced PINs for startup is Enabled.
Run gpupdate /force.
Rerun Step 7 with a PIN that meets both rules.

Fix #5: Switch Back to a Numeric PIN

If an enhanced PIN worked in Windows but fails at the boot screen, pre-boot and Windows don’t always support the same characters, so switching to a numeric PIN is the simplest fix.

Before you start, confirm a Numerical Password (recovery) protector exists on the drive and that you have its 48-digit key backed up. Without it, this fix has no fallback if the PIN screen rejects every entry.

At the BitLocker screen, look for a recovery or “skip this drive” option; the exact wording and layout vary by PC and Windows build. If a recovery option is offered, select it and enter your 48-digit recovery key.
If the screen offers no recovery option and the PIN still won’t go through, stop and treat this as a separate problem rather than retrying blindly; consult your IT admin if the PC is managed, or Microsoft support otherwise (our guide on how to get help in Windows lists the options).
Once Windows has started, open gpedit.msc and set Allow enhanced PINs for startup to Disabled.
Run gpupdate /force in Terminal (Admin).
Run manage-bde -changepin C: and set a digits-only PIN. If the command fails or reports a policy conflict instead, work through Fix #2 and Fix #3 before trying again.
Restart and enter the new PIN.

Windows should start normally after the PIN.

Change the policy and the PIN only after you’re back in Windows, not from the pre-boot screen.

Fix #6: Check Protectors Before Deleting Anything

If manage-bde says there’s no TPM protector to remove or replace, the drive is already using something else.

Run manage-bde -protectors -get C:.
Read which protector types are listed.
If TPM And PIN is already there, use manage-bde -changepin C: to change it.
If a plain TPM protector is also listed, follow the confirm-then-remove sequence in Step 7.
Only remove a protector type that actually appears, and never delete the Numerical Password protector.

Fix #7: Confirm Your Edition If gpedit.msc Won’t Open

Go to Settings > System > About.
Read the Edition line under Windows specifications.

If it says Windows 11 Home, this workflow doesn’t apply, because Home doesn’t include the Local Group Policy Editor these steps rely on. Upgrading to Pro is the usual way to get this setup.

Wrapping Up

Step 4, enabling Require additional authentication at startup with no more than one Required option, is the usual fix when the PIN won’t add. The commands afterward are routine. If the PIN suddenly stops working at boot, or BitLocker asks for the recovery key after every restart, something in the boot chain may have changed, such as a firmware update, a boot setting, or the TPM itself. Stop changing protectors and run the TPM checks before anything else.

Step	Action	Applies To
1	Back up the recovery key	All editions with BitLocker
4	Enable the startup authentication policy	Pro, Enterprise, Education
7	`manage-bde -protectors -add C: -TPMAndPIN`	Pro, Enterprise, Education
8	`manage-bde -protectors -get C:`	Pro, Enterprise, Education
9	`manage-bde -changepin C:`	Pro, Enterprise, Education

Resources

Microsoft Learn pages, retrieved November 6, 2026: