Encrypted backups and removable drives: four cases, each with an unlock and a restore test

Case 1: Windows computers' own drives (BitLocker)

These settings go in one Intune disk encryption profile (Endpoint security > Disk encryption > Create Policy, Platform: Windows, Profile: BitLocker), so they reach a computer together; assign it to a pilot group first. This path is TPM only, with no startup PIN, because Microsoft's silent encryption needs that. Encryption starts once Require device encryption arrives, and only after the recovery password is stored.

1. Windows version, and its certificates

   Each CUI computer: Settings > System > About (the Windows version and OS build), compared with Microsoft's FIPS 140 page and NIST's certificate pages

   ValueA Windows 11 version Microsoft still services, kept patched, with its module certificates looked up and the result recorded. On 2026-11-12 no serviced Windows 11 version had modules listed on Microsoft's FIPS 140 page: the listed versions, 21H2 and 22H2, are out of servicing. Record the gap for SC.L2-3.13.11 rather than hold computers on 22H2. The compliant-devices recipe's Minimum OS version should therefore be a serviced build, which will be one without a listed certificate.

   WhyThe certificate covers a module at a version, not BitLocker in general. Staying on an unpatched build to keep a listed certificate trades a documented gap for unpatched computers.

   “Windows 11 releases Windows 11, version 22H2 Windows 11, version 21H2”

2. Startup authentication

   The same profile > Operating System Drives: Require additional authentication at startup

   ValueRequire additional authentication at startup: Enabled. Configure TPM startup: Require TPM. Configure TPM startup PIN: Do not allow startup PIN with TPM. Configure TPM startup key: Do not allow startup key with TPM. Configure TPM startup key and PIN: Do not allow startup key and PIN with TPM.

   WhyMicrosoft: for silent encryption, the computer must not require a startup PIN or key. A security baseline can turn the PIN on and stop encryption, so check your baselines for conflicts.

   “For silent BitLocker to work, devices must not require TPM startup PIN or startup key, as these require user interaction. … Endpoint security policy - In the BitLocker profile under Operating System Drives, first set Require additional authentication at startup to Enabled. Once enabled, the following TPM settings become available: Configure TPM startup PIN = Do not allow startup PIN with TPM Configure TPM startup key = Do not allow startup key with TPM Configure TPM startup key and PIN = Do not allow startup key and PIN with TPM Configure TPM startup = Allow TPM or Require TPM … Watch for policies that enable use of a TPM startup PIN or key. For example, the Security baseline for Microsoft Defender can enable TPM startup PIN and key by default, which blocks silent enablement.”

3. Encryption method

   The same profile: Choose drive encryption method and cipher strength

   ValueEnabled, with each of the three drive types set: operating system drives, fixed data drives and removable data drives (the policy sets them separately). XTS-AES for each: 256-bit on computers fast enough, otherwise 128-bit, as Microsoft advises. Write the choice in your baseline. The removable-drive choice is what BitLocker To Go uses in Case 2.

   WhyMicrosoft recommends XTS-AES for all drives; left unset, BitLocker uses XTS-AES 128-bit. Setting it makes the choice deliberate and visible in the policy export. Microsoft notes the policy does not apply to drives that encrypt themselves (hardware-encrypted drives, Case 4).

   “Recommended settings: XTS-AES algorithm for all drives.”

   “With this policy, you can configure an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually. Recommended settings: XTS-AES algorithm for all drives. The choice of key size, 128 bit or 256 bit depends on the performance of the device. … If you disable or don't configure this policy setting, BitLocker uses the default encryption method of XTS-AES 128-bit. Note This policy doesn't apply to encrypted drives. Encrypted drives utilize their own algorithm, which is set by the drive during partitioning.”

4. Recovery password stored before encryption

   The same profile > Operating System Drives: Choose how BitLocker-protected operating system drives can be recovered (and the same for fixed drives)

   ValueEnabled, for operating system drives and, separately, for fixed data drives (Choose how BitLocker-protected fixed drives can be recovered), with the same options in each. Configure user storage of BitLocker recovery information: require the 48-digit recovery password, and allow or do not allow the 256-bit recovery key (not require it: Microsoft's list of settings for silent encryption gives only Allow or Do not allow 256-bit recovery key). Save BitLocker recovery information to AD DS: the recovery password. Do not enable BitLocker until recovery information is stored: on (for fixed data drives too). For a domain-joined computer this stores the password in Active Directory; for an Entra-joined computer Microsoft says it is backed up to Entra ID. Where your profile shows them, Intune's own names for the Entra side are Save BitLocker recovery information to Microsoft Entra ID: Enabled and Store recovery information in Microsoft Entra ID before enabling BitLocker: Required. Also set Client-driven recovery password rotation: Enable rotation on Microsoft Entra joined devices, which the recovery test below uses.

   WhyMicrosoft's recovery overview says this option keeps BitLocker off unless the backup to Entra ID or AD DS succeeds, and Intune's page says silent encryption backs the key up before it starts encrypting. The policy's own description names AD DS only, so for Entra-joined computers confirm the key is in Entra ID before relying on the computer (Rolling it out). Fixed data drives need their own setting: with the warning for other disk encryption turned off (below), Microsoft says a fixed data drive's key goes to the first of the user's Active Directory account, Entra ID account or personal OneDrive that succeeds. Whether the fixed-drive setting keeps the key out of OneDrive is not stated, so check each fixed drive's key in Intune (the device > Monitor > Recovery keys, which lists each key's Drive Type) in the first passing test.

   “Use the option Do not enable BitLocker until recovery information is stored in AD DS to prevent users from enabling BitLocker unless the backup of BitLocker recovery information for the drive to Microsoft Entra ID or AD DS succeeds.”

   “Configure user storage of BitLocker recovery information: select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key … Do not enable BitLocker until recovery information is stored in AD DS for operating system drives: prevents users from enabling BitLocker unless the device is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. When using this option, a recovery password is automatically generated. … For Microsoft Entra hybrid joined devices, the BitLocker recovery password is backed up to both Active Directory and Entra ID. For Microsoft Entra joined devices, the BitLocker recovery password is backed up to Entra ID.”

   “Microsoft Entra ID supports a maximum of 200 BitLocker recovery keys per device. If you reach this limit, silent encryption fails due to the failing backup of recovery keys before starting encryption on the device. … Client-driven recovery password rotation = Enable rotation on Microsoft Entra joined devices or Enable rotation on Microsoft Entra ID and hybrid joined devices Save BitLocker recovery information to Microsoft Entra ID = Enabled Store recovery information in Microsoft Entra ID before enabling BitLocker = Required”

   “User creation of recovery key = Allow or Do not allow 256-bit recovery key User creation of recovery password = Allow or Require 48-digit recovery password … Select a device from the list, and then under Monitor, select Recovery keys. Select Show Recovery Key. This generates an audit log entry under 'KeyManagement' activity. When keys are available in Microsoft Entra ID, the following information is displayed: BitLocker Key ID BitLocker Recovery Key Drive Type”

   “When you disable the warning prompt, the OS drive's recovery key will back up to the user's Microsoft Entra ID account. When you allow the warning prompt, the user who receives the prompt can select where to back up the OS drive's recovery key. The endpoint for a fixed data drive's backup is chosen in the following order: The user's Windows Server Active Directory Domain Services account The user's Microsoft Entra ID account The user's personal OneDrive (MDM/MAM only) Encryption will wait until one of these three locations backs up successfully.”

5. Restrict non-admin users from recovering the BitLocker key(s) for their owned devices

   Microsoft Entra admin center: device settings (Microsoft's page Manage device identities > Configure device settings); a Privileged Role Administrator or higher can change it

   ValueYes. Then the people who can read a Windows computer's recovery key are those holding a role with the BitLocker read permission (Microsoft lists Cloud Device Administrator, Helpdesk Administrator, Intune Administrator, Security Administrator and Security Reader); keep their membership to the people your procedure names, and review it. Each Show Recovery Key is recorded in the audit log (KeyManagement).

   WhyMicrosoft's default is No: a device's owner can read its BitLocker key themselves, from Company Portal, the My Account portal or Entra ID. Macs differ: Microsoft says users can view and retrieve their own FileVault personal recovery key, and this recipe has no setting that stops it; the rotation in the Mac recovery test is what limits a key's life once it has been seen.

   “Restrict non-admin users from recovering the BitLocker key(s) for their owned devices: Admins can block self-service BitLocker key access to the registered owner of the device. Default users without the BitLocker read permission are unable to view or copy their BitLocker key(s) for their owned devices. You must be at least a Privileged Role Administrator to update this setting. … To view or copy BitLocker keys, you need to be the owner of the device or have one of these roles: Cloud Device Administrator Helpdesk Administrator Intune Administrator Security Administrator Security Reader”

   “Company Portal app: Users can access BitLocker recovery keys through the Company Portal app My Account portal: Available at account.microsoft.com for Microsoft Entra joined devices Microsoft Entra ID: Direct access for Microsoft Entra joined devices Administrative controls for self-service access: Tenant-wide toggle: Determines if non-admin users can use self-service to recover BitLocker keys: Default: No (allows all users to recover their keys) Yes: Restricts non-admin users from seeing BitLocker keys for their own devices”

   “Admins can view the personal recovery key for only managed macOS devices that are marked as Corporate. They can't view the recovery key for Personal devices. Users can view and retrieve their personal recovery key from supported locations.”

6. Require device encryption

   The same profile: Require device encryption (a CSP setting: Microsoft lists no Group Policy setting for it)

   ValueRequire device encryption: Enabled. Allow warning for other disk encryption: Disabled, and Allow standard user encryption: Enabled, so encryption starts without a prompt on Entra-joined laptops whose users are not administrators. First check that no other disk encryption product is installed.

   WhyThe drives of the company Windows computers the profile is assigned to are encrypted without depending on the user; the encryption report (evidence below) shows each computer's state. Microsoft warns that BitLocker on a computer with another vendor's encryption may make it unusable.

   “This policy setting determines whether BitLocker is required: If enabled, encryption is triggered on all drives silently or non-silently based on Allow warning for other disk encryption policy … With this policy you can enforce the Require device encryption policy for scenarios where the policy is applied while the current logged-on user doesn't have administrative rights. … The Allow warning for other disk encryption policy must be disabled to allow standard user encryption. … When you enable BitLocker on a device with non-Microsoft encryption, it may render the device unusable and will require reinstallation of Windows.”

   “For Endpoint security Disk encryption policy, configure these settings in the BitLocker profile: Require Device Encryption = Enabled Allow Warning For Other Disk Encryption = Disabled … Allow Standard User Encryption = Enabled This setting is required if devices are used by standard (non-administrator) users.”

7. Used space only encryption, and the free space it leaves

   Each computer that held CUI before it was encrypted: manage-bde -status C: (and each fixed drive), in a command prompt run as administrator; for computers not yet encrypted, a Windows settings catalog policy: Windows Components > BitLocker Drive Encryption > Operating System Drives > Enforce drive encryption type on operating system drives

   ValueCheck Conversion Status. On a computer that held CUI before it was encrypted and shows Used Space Only Encrypted, wipe the free space: manage-bde -w C: (the same for each fixed drive). For computers not yet encrypted, you can set Enforce drive encryption type on operating system drives: Enabled, Full encryption; Microsoft's same page also says the encryption type cannot be customized for silent encryption, so check Conversion Status on the pilot computer either way. A computer that never held CUI before encryption needs neither.

   WhyMicrosoft: silent encryption on a modern standby laptop encrypts used space only. Data deleted before encryption can remain in the free space, which is not encrypted; Microsoft says wiping the free space of a Used Space Only volume gives the same protection as full encryption, and that changing the encryption type has no effect on a drive already encrypted.

   “When BitLocker is enabled silently, the system automatically uses full disk encryption on non-modern standby devices and used space only encryption on modern standby devices. The encryption type depends on hardware capabilities and can't be customized for silent encryption scenarios. … To check the current encryption type, run from an elevated command prompt: manage-bde -status c: The 'Conversion Status' field shows either Used Space Only Encrypted or Fully Encrypted. … To change the disk encryption type between full disk encryption and used space only encryption, use the Enforce drive encryption type on operating system drives setting in Settings Catalog: Create a Settings Catalog policy Navigate to Windows Components > BitLocker Drive Encryption > Operating System Drives Select and set Enforce drive encryption type on operating system drives to Enabled”

   “Wipes the free space on the volume, removing any data fragments that may have existed in the space. Running this command on a volume encrypted using the Used Space Only encryption method provides the same level of protection as the Full Volume Encryption encryption method. … To wipe the free space on drive C, type either: manage-bde -w C: manage-bde -wipefreespace C:”

   “Note Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress.”

8. Legacy FIPS policy: only before a PIN or password protector

   Group Policy or Intune: the legacy FIPS policy (System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing)

   ValueLeave it as it is on these TPM-only computers. If you later give some laptops a startup PIN (not covered here: Microsoft says a PIN needs user interaction, so it is not silent encryption), the policy must reach those laptops before the PIN protector is created. Microsoft ties the policy to creating the PIN or password protector, not to the start of encryption.

   WhyMicrosoft: only BitLocker's PIN and password protectors read the legacy FIPS policy; without them no further setting is needed for a FIPS 140 approved mode. With the policy on, a PIN is derived with PBKDF2; without it, in a way Microsoft says is not FIPS-approved. The same policy makes password-protected removable drives read-only (Case 2).

   • Needs firstStartup authentication. Leaving the legacy FIPS policy as it is holds only while the startup settings allow no PIN; a recipe that adds a startup PIN must set the FIPS policy before the PIN protector is created.

   “If neither protector is used in your BitLocker setup, no additional configuration is required to operate Windows in a FIPS 140 approved mode”

Case 2: USB sticks and external drives (BitLocker To Go)

For an office with Active Directory: the unlock method below uses domain credentials. Do the steps in order on the issuing computer, with the new drive as E:. An office with Entra ID and no Active Directory uses hardware-encrypted drives for backups (Case 4).

1. Deny write access to removable drives not protected by BitLocker

   Intune (disk encryption or settings catalog policy) or Group Policy: BitLocker Drive Encryption > Removable Data Drives

   ValueEnabled, assigned to a pilot group first (Rolling it out), then to every company Windows computer.

   WhyA company Windows computer the policy reaches can copy files to a USB drive once the drive is encrypted with BitLocker, and a drive BitLocker does not protect becomes read-only there, hardware-encrypted drives included: Case 4 gives the exclusion that keeps the approved backup model writable on the backup computers.

   ThenAssigned to every company Windows computer, once the pilot's tests pass (Rolling it out).

   • Conflicts withthe case Hardware-encrypted USB drive (keypad or software unlock). A hardware-encrypted drive is not BitLocker-protected, so with this policy on it is mounted read-only and the backup drive Case 4 recommends cannot be written. Resolved by Removable Drives Excluded From Encryption.

   “This policy setting configures whether BitLocker protection is required for a device to be able to write data to a removable data drive. If you enable this policy setting: all removable data drives that are not BitLocker-protected are mounted as read-only if the drive is protected by BitLocker, it's mounted with read and write access”

2. Encrypt the drive and add its recovery password

   On the issuing computer, in a command prompt run as administrator: manage-bde -on E: -recoverypassword

   ValueRun the command on the new, empty drive, on an issuing computer that already has the encryption method policy (Case 1, removable data drives). Note the recovery password it shows only long enough to finish the next steps, and wait until manage-bde -status E: reports the drive fully encrypted, with the Encryption Method you chose, before copying anything to it.

   WhyThis turns BitLocker on for the drive and gives it a recovery password, the protector the key backup below stores. Microsoft's example is for drive C; the command takes any drive letter. The cipher comes from the encryption method policy's removable-drive setting, so check it in manage-bde -status before the drive is used.

   • Needs firstEncryption method. The drive is encrypted with the cipher the policy sets for removable data drives; without the policy BitLocker uses its default.

   “Encrypts the drive and turns on BitLocker. … -recoverypassword Adds a numerical password protector. … To turn on BitLocker for drive C, and to add a recovery password to the drive, type: manage-bde -on C: -recoverypassword”

3. Unlock method (protector) for a backup drive

   On the issuing computer, right after encryption: manage-bde -protectors -add E: -sid <DOMAIN\group>

   ValueA SID protector for a domain group: the people (or computers) who may open the drive. Not a password protector. Microsoft also allows a smart card protector; this recipe gives no steps for one, so follow Microsoft's documentation and the module's security policy if you choose it. The drive unlocks by itself for anyone in the group (Microsoft: it unlocks automatically if the user or computer has the proper credentials), so the tests that expect it locked are run by a user on a computer outside the group. Off the network: Microsoft's pages read for this recipe do not say whether a SID-protected drive unlocks when the computer cannot reach a domain controller. Until your own test (When the service is unreachable) shows that it does, do not make a SID-protected drive the only way to restore a backup.

   WhyMicrosoft states that a password-protected removable drive mounts read-only on a computer with the legacy FIPS policy on, which stops backups, and that password protectors always use iterative SHA2-256 stretching. An office with Entra ID and no Active Directory has no domain credentials for a SID protector.

   “Password-protected removable drives are mounted read-only when the legacy FIPS policy is enabled.”

   “-ADaccountorgroup Adds a SID-based identity protector for the volume. The volume will automatically unlock if the user or computer has the proper credentials.”

   “To add an adaccountorgroup key protector, identified by domain and user name, to drive E, type: manage-bde -protectors -add E: -sid DOMAIN\user”

4. Store the drive's recovery password

   On the issuing computer, right after the protector: manage-bde -protectors -get E: (note the ID of the Numerical Password protector), then manage-bde -protectors -aadbackup E: -id {ID} (Entra ID) or -adbackup E: -id {ID} (Active Directory)

   ValueStored in Entra ID or Active Directory, and its key ID written against the drive's serial number in the media inventory. Never on the drive and never in a personal Microsoft account. Confirm it is there: in Intune, the issuing computer > Monitor > Recovery keys (it lists each key's ID and drive type); in Active Directory, the issuing computer's object. Before you retire or delete the issuing computer, back each drive's key up again from its replacement (drive plugged in and unlocked, the same two commands) and confirm it.

   WhyWindows does not store a removable drive's recovery key in the directory by itself. Where the key then sits: Active Directory keeps BitLocker recovery information as a child of the computer object, and Microsoft Graph records an Entra ID key against the device it was backed up from. Microsoft says deleting a device in Entra ID deletes the BitLocker keys stored on it, with no way to recover them. Its pages do not single out removable-drive keys, so assume they go with the issuing computer. Deleting the issuing computer's Intune object, if it is Entra joined, also removes the key protectors of its own operating system volume and leaves BitLocker suspended there. Microsoft limits Entra ID to 200 BitLocker recovery keys per device, and when that is reached silent encryption fails; whether removable-drive keys backed up from the issuing computer count toward it is not established, so on an issuing computer that backs up many drives, watch the count of keys under its Recovery keys.

   “There's no automatic way to store the recovery key for removable storage devices in Microsoft Entra ID or AD DS. However, you can use PowerShell or the manage.bde.exe command to do so.”

   “-aadbackup Backs up all recovery information for the drive specified to Microsoft Entra ID. Append the -id parameter and specify the ID of a specific recovery key to back up. The -id parameter is required.”

   “deviceId String Identifier of the device the BitLocker key is originally backed up from. … volumeType volumeType Indicates the type of volume the BitLocker key is associated with. The possible values are: 1 (for operatingSystemVolume), 2 (for fixedDataVolume), 3 (for removableDataVolume), and 4 (for unknownFutureValue).”

   “When configured, BitLocker keys for Windows 10 or newer devices are stored on the device object in Microsoft Entra ID. If you delete a stale device, you also delete the BitLocker keys that are stored on the device. … There's no way to recover BitLocker recovery keys after deleting the associated device.”

   “The BitLocker recovery information for a device joined to an Active Directory domain can be stored in AD DS. The information is stored in a child object of the computer object itself.”

   “Important If you delete the Intune object for a Microsoft Entra joined device protected by BitLocker, the deletion triggers an Intune device sync and removes the key protectors for the operating system volume. This leaves BitLocker in a suspended state on that volume. … Note Microsoft Entra ID supports a maximum of 200 BitLocker recovery keys per device. If you reach this limit, silent encryption fails due to the failing backup of recovery keys before starting encryption on the device.”

Case 3: Macs (FileVault)

1. FileVault

   Intune admin center > Devices > By platform > macOS > Manage devices > Configuration > Create > New policy > Settings catalog > + Add settings > Full Disk Encryption

   ValueEnable: On; Defer: Enabled; recovery key escrow Location: a sentence telling users how to get their key; Recovery Key Rotation In Months: the period you choose.

   WhyThe internal drive of each company Mac the policy reaches is encrypted, and the personal recovery key goes to Intune before encryption starts. With Defer, encryption waits for the user: Apple says deferred enablement needs the user to log out or log in, so a Mac is not encrypted until then (Rolling it out).

   “a personal recovery key (PRK) should be used.”

   “Select Devices > By platform > macOS > Manage devices > Configuration > Create > New policy. Select Settings catalog for the Profile type. On the Configuration settings page, select + Add settings and navigate to Full Disk Encryption. … FileVault: Enable = On Defer = Enabled (required for successful FileVault application) … After the key is escrowed, the disk encryption can start. … Admins can view the personal recovery key for only managed macOS devices that are marked as Corporate.”

   “When FileVault isn’t turned on during Setup Assistant, you can use a device management service to turn it on after enrollment, a process is referred to as deferred enablement. Deferred enablement requires a logout or login event from the user.”

2. iCloud Keychain

   Intune admin center > Devices > macOS > Configuration > Create > New policy > Settings catalog: Apple's iCloud Keychain restriction (Restrictions). Apple notes that not every device management service offers every restriction, so confirm Intune lists it.

   ValueRestricted on company Macs (Apple: "iCloud Keychain can't be used"), assigned before or with the FileVault policy. On a pilot Mac, check that iCloud Keychain is not in use.

   WhyApple states that with iCloud Keychain the FileVault recovery key syncs with the user's other passwords, which can include personal devices. With the restriction, the condition Apple describes does not arise. Whether a key synced before the restriction is removed from iCloud is not established, so set the restriction first.

   “When using iCloud Keychain, the recovery key is securely synchronized along with other user passwords.”

   “Note: Not all restrictions are available in all device management services and they have the ability to change the default state for any restriction. … iCloud Keychain macOS 10.12 No iCloud Keychain can’t be used.”

Case 4: hardware-encrypted USB and backup drives

With Deny write access on (Case 2), every removable drive that BitLocker does not protect is read-only on company Windows computers, and a hardware-encrypted drive is one of them. Microsoft's exclusion by hardware ID, assigned only to the backup computers, keeps the approved model writable there and nowhere else. The approved-media list says which models; the media inventory says which drives, by serial number, and who holds each.

1. Model and firmware

   NIST's CMVP search (csrc.nist.gov), before buying and when each drive arrives

   ValueA model whose cryptographic module is on the Active list with a FIPS 140-3 certificate, at a firmware version that certificate lists. Record the certificate number in the approved-media list and in the media inventory.

   WhyThe certificate belongs to a model and its firmware, not to the brand; a FIPS 140-2 certificate is now on the Historical list, for existing systems only.

   “Upon validation, modules will be placed on the Active list for 5 years (or 2 years for Interim Validations) and may be used for new and existing systems.”

2. Removable Drives Excluded From Encryption

   Intune admin center: a Windows policy that sets the BitLocker CSP's RemovableDrivesExcludedFromEncryption (Windows 11 21H2 and later; Microsoft lists it as Removable Drives Excluded From Encryption, with no Group Policy setting; look for that name in the settings catalog), assigned only to the backup computers

   ValueOne entry per approved model and firmware revision, in the form of Microsoft's example: USBSTOR\ followed by the drive's vendor, product and revision (Microsoft's example is USBSTOR\SEAGATE_ST39102LW_______0004). Read the drive's identifiers on a backup computer with the drive plugged in and unlocked: Device Manager > Disk drives > the drive > Properties > Details > Hardware Ids. Never a shorter form that names only the vendor or the drive type.

   WhyMicrosoft: an excluded drive cannot be encrypted with BitLocker, and with Deny write access on it is mounted read/write. What the entry matches: Microsoft's USB storage page builds these identifiers from the drive's vendor, product and revision, with no serial number, so an entry names a model at a revision, not one drive. Every drive of that model and revision becomes writable on these computers, including one bought privately; that is why the exclusion goes only on the backup computers, and why the media inventory, not the exclusion, says which drives are company drives. Microsoft calls the value a hardware ID, but its example has the form its USB storage page gives for the device ID (no device-type code), while the hardware IDs Windows generates begin with the type code. Which form the setting matches is not established: use the example's form, run the three Case 4 tests, and if the approved drive stays read-only, add the full first hardware ID and test again.

   “When enabled, allows you to exclude removable drives and devices connected over USB interface from BitLocker Device Encryption. Excluded devices can't be encrypted, even manually. Additionally, if "Deny write access to removable drives not protected by BitLocker" is configured, user won't be prompted for encryption and drive will be mounted in read/write mode. Provide a comma separated list of excluded removable drives\devices, using the Hardware ID of the disk device. Example USBSTOR\SEAGATE_ST39102LW_______0004.”

   “The device ID format is as follows: USBSTOR\v(8)p(16)r(4) Where: v(8) is an 8-character vendor identifier. p(16) is a 16-character product identifier. r(4) is a 4-character revision level value. An example of a device ID for a disk drive would be as follows: USBSTOR\SEAGATE_ST39102LW_______0004 The hardware IDs that the USB storage port driver generates are as follows: USBSTOR\t*v(8)p(16)r(4) USBSTOR\t*v(8)p(16) USBSTOR\t*v(8) USBSTOR\v(8)p(16)r(1) v(8)p(16)r(1) USBSTOR\GenericTypeString GenericTypeString”

   “Removable drives excluded from encryption Path CSP ./Device/Vendor/MSFT/BitLocker/RemovableDrivesExcludedFromEncryption GPO Not available”