Windows BitLocker startup PIN not prompting after Hexnode policySolved

Hi @schyler-scott,

This behavior usually occurs when the drive is encrypted with TPM-only protection, while the compliance requirement expects TPM + Startup PIN.

BitLocker encryption and the BitLocker startup PIN are related, but they are not the same setting:

1. BitLocker encryption protects the drive.
2. Startup PIN adds a pre-boot authentication requirement.

If Windows silently initializes BitLocker with TPM-only protection, the device may encrypt successfully and boot straight to the Windows login screen. However, if your policy requires a Startup PIN, the device can still report as non-compliant because the PIN protector is missing.

For policy-based deployment where users create their own PINs, configure the BitLocker policy as follows:

1. Go to Policies > Windows > Security > BitLocker.
2. Under OS drive settings, configure additional startup authentication settings.
3. Set Startup PIN to Required.
4. Associate the policy with the test device or device group.

Test this on one device before rolling it out to production.

Regards,
Sienna Carter
Hexnode UEM

That explains the compliance part. I also noticed encryption didn’t start properly until I ejected the virtual DVD attached to the VM. Should BitLocker be applied only to fixed drives in this kind of setup?

Hi @schyler-scott,

For this scenario, target the OS or fixed drives only. If a virtual DVD, removable drive, or similar mounted media is attached, it can interfere with how the BitLocker policy evaluates the available drives. Removing the mounted media and applying the policy to fixed drives is the correct approach.

Once encryption completes, the BitLocker recovery key should be escrowed and visible from the device details in Hexnode, provided recovery key escrow is configured.

Regards,
Sienna Carter
Hexnode UEM

If I’m deploying this to around 100 Windows devices, is it okay to set one default startup PIN for all devices to save time?

Hi @remy,

Using the same startup PIN across all devices is not recommended. A shared PIN creates a single point of failure: if one PIN is exposed, every device using that PIN becomes vulnerable to offline physical access attempts.

For fleet deployment, there are two practical approaches:

1. User-configured PINs — Recommended for most environments. Configure the BitLocker policy to require a Startup PIN and allow standard users to enable encryption. Users will be prompted to create their own PIN during the encryption flow.
2. Admin-configured PINs — Use the Force BitLocker Encryption action if you want to push encryption more silently and define the PIN from the admin side. This can be done in bulk, but the PIN strategy should still avoid using the same value everywhere.

The more secure option is to let users set unique PINs, or define different PINs per device or group based on your internal security process.

Regards,
Sienna Carter
Hexnode UEM