Boot Configuration Data settings and BitLocker

This article describes the Boot Configuration Data (BCD) settings that are used by BitLocker.

During the boot process, BitLocker verifies that the security sensitive BCD settings haven't changed since BitLocker was last enabled, resumed, or recovered.

If it's believed that there's a risk in excluding a particular BCD setting from the validation profile, you can include that BCD setting in the BCD validation coverage to suit the preferences for validation.
If the default BCD setting persistently triggers a recovery for benign changes, you can exclude that BCD setting from the validation coverage.

One of the benefits of using secure boot is that it can correct BCD settings during boot without triggering recovery events. Secure boot enforces the same BCD settings as BitLocker. Secure boot BCD enforcement isn't configurable from within the operating system.

Customize BCD validation settings

To modify the BCD settings that are validated by BitLocker, the administrator will add or exclude BCD settings from the platform validation profile by enabling and configuring the Use enhanced Boot Configuration Data validation profile policy setting.

For the purposes of BitLocker validation, BCD settings are associated with a specific set of Microsoft boot applications. These BCD settings can also be applied to the other Microsoft boot applications that aren't part of the set to which the BCD settings are already applicable for. This setting can be done by attaching any of the following prefixes to the BCD settings that are being entered in the group policy settings dialog:

• winload
• winresume
• memtest
• all of the above

All BCD settings are specified by combining the prefix value with either a hexadecimal (hex) value or a friendly name.

The BCD setting hex value is reported when BitLocker enters recovery mode and is stored in the event log (event ID 523). The hex value uniquely identifies the BCD setting that caused the recovery event.

You can quickly obtain the friendly name for the BCD settings on a computer by using the command bcdedit.exe /enum all.

Not all BCD settings have friendly names. For those settings without a friendly name, the hex value is the only way to configure an exclusion policy.

When specifying BCD values in the Use enhanced Boot Configuration Data validation profile policy setting, use the following syntax:

• Prefix the setting with the boot application prefix
• Append a colon :
• Append either the hex value or the friendly name
• If entering more than one BCD setting, each BCD setting will need to be entered on a new line

For example, either "winload:hypervisordebugport" or "winload:0x250000f4" yields the same value.

A setting that applies to all boot applications may be applied only to an individual application. However, the reverse isn't true. For example, one can specify either "all:locale" or "winresume:locale", but as the BCD setting "win-pe" doesn't apply to all boot applications, "winload:winpe" is valid, but "all:winpe" isn't valid. The setting that controls boot debugging ("bootdebug" or 0x16000010) will always be validated and will have no effect if it's included in the provided fields.

Default BCD validation profile

The following table contains the default BCD validation profile used by BitLocker:

Full list of friendly names for ignored BCD settings

The following list is a full list of BCD settings with friendly names, which are ignored by default. These settings aren't part of the default BitLocker validation profile, but can be added if you see a need to validate any of these settings before allowing a BitLocker-protected operating system drive to be unlocked.