Policy

Deny write access to fixed drives not protected by BitLocker

This policy setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer. If you enable this policy setting, all fixed data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access. If you disable or do not configure this policy setting, all fixed data drives on the computer will be mounted with read and write access.

Policy
PackMicrosoft Windows
CategoryWindows Components / BitLocker Drive Encryption / Fixed Data Drives
Policy ID0d8581747ba1
Internal nameFDVDenyWriteAccess_Name

Registry

Copy registry mappings

HKLM\System\CurrentControlSet\Policies\Microsoft\FVE\FDVDenyWriteAccess (enabled) = 1
HKLM\System\CurrentControlSet\Policies\Microsoft\FVE\FDVDenyWriteAccess (disabled) = 0

Policy notes

This policy setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer. If you enable this policy setting, all fixed data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access. If you disable or do not configure this policy setting, all fixed data drives on the computer will be mounted with read and write access.

Related policies

Allow access to BitLocker-protected fixed data drives from earlier versions of WindowsChoose how BitLocker-protected fixed drives can be recoveredConfigure use of hardware-based encryption for fixed data drivesConfigure use of passwords for fixed data drivesConfigure use of smart cards on fixed data drivesEnforce drive encryption type on fixed data drives