Policy

Configure use of smart cards on removable data drives

This policy setting allows you to specify whether smart cards can be used to authenticate user access to BitLocker-protected removable data drives on a computer. If you enable this policy setting smart cards can be used to authenticate user access to the drive. You can require a smart card authentication by selecting the "Require use of smart cards on removable data drives" check box. Note: These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker will allow unlocking a drive with any of the protectors available on the drive. If you disable this policy setting, users are not allowed to use smart cards to authenticate their access to BitLocker-protected removable data drives. If you do not configure this policy setting, smart cards are available to authenticate user access to a BitLocker-protected removable data drive.

Policy
Pack Microsoft Windows
Category Windows Components / BitLocker Drive Encryption / Removable Data Drives
Policy ID f8f20c809db8
Internal name RDVConfigureSmartCard

Registry

Copy registry mappings

HKLM\Software\Policies\Microsoft\FVE\RDVAllowUserCert (enabled) = 1
HKLM\Software\Policies\Microsoft\FVE\RDVAllowUserCert (disabled) = 0
HKLM\Software\Policies\Microsoft\FVE\RDVEnforceUserCert

Policy notes

This policy setting allows you to specify whether smart cards can be used to authenticate user access to BitLocker-protected removable data drives on a computer. If you enable this policy setting smart cards can be used to authenticate user access to the drive. You can require a smart card authentication by selecting the "Require use of smart cards on removable data drives" check box. Note: These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker will allow unlocking a drive with any of the protectors available on the drive. If you disable this policy setting, users are not allowed to use smart cards to authenticate their access to BitLocker-protected removable data drives. If you do not configure this policy setting, smart cards are available to authenticate user access to a BitLocker-protected removable data drive.

Related policies

Allow access to BitLocker-protected removable data drives from earlier versions of WindowsChoose how BitLocker-protected removable drives can be recoveredConfigure use of hardware-based encryption for removable data drivesConfigure use of passwords for removable data drivesControl use of BitLocker on removable drivesDeny write access to removable drives not protected by BitLockerEnforce drive encryption type on removable data drives