If entering more than one BCD setting, each BCD setting will need to be entered on a new lineįor example, either ' winload:hypervisordebugport' or ' winload:0x250000f4' yields the same value.Ī setting that applies to all boot applications may be applied only to an individual application.Append either the hex value or the friendly name.Prefix the setting with the boot application prefix.When specifying BCD values in the Use enhanced Boot Configuration Data validation profile policy setting, use the following syntax: For those settings without a friendly name, the hex value is the only way to configure an exclusion policy. Not all BCD settings have friendly names. You can quickly obtain the friendly name for the BCD settings on a computer by using the command bcdedit.exe /enum all. The hex value uniquely identifies the BCD setting that caused the recovery event. The BCD setting hex value is reported when BitLocker enters recovery mode and is stored in the event log (event ID 523). This setting can be done by attaching any of the following prefixes to the BCD settings that are being entered in the group policy settings dialog:Īll BCD settings are specified by combining the prefix value with either a hexadecimal (hex) value or a friendly name. These BCD settings can also be applied to the other Microsoft boot applications that aren't part of the set to which the BCD settings are already applicable for. To modify the BCD settings that are validated by BitLocker, the administrator will add or exclude BCD settings from the platform validation profile by enabling and configuring the Use enhanced Boot Configuration Data validation profile policy setting.įor the purposes of BitLocker validation, BCD settings are associated with a specific set of Microsoft boot applications. Secure boot BCD enforcement isn't configurable from within the operating system. Secure boot enforces the same BCD settings as BitLocker. One of the benefits of using secure boot is that it can correct BCD settings during boot without triggering recovery events. When BitLocker is able to use secure boot for platform and BCD integrity validation, as defined by the Allow Secure Boot for integrity validation policy setting, the Use enhanced Boot Configuration Data validation profile policy is ignored. Devices with UEFI firmware can use secure boot to provide enhanced boot security.

Bitlocker encryption