To help organizations with the transition, now in Windows 11/10, the BitLocker PIN length is 6 characters by default, but it can be reduced to 4 characters. If the minimum PIN length is set below 6 digits, Windows will attempt to update the TPM 2.0 lockout period to be greater than the default when a PIN is changed. If successful, Windows will only reset the TPM lockout period back to default if the TPM is reset. Increasing the BitLocker Startup PIN length requires a greater number of guesses for an attacker. In that case, the lockout duration between each guess can be shortened to allow legitimate users to retry a failed attempt sooner while maintaining a similar level of protection.
Specify Minimum Length for BitLocker Startup PIN
Open the Local Group Policy Editor. and on the left pane of Local Group Policy Editor, navigate to the location-
On the right pane of Operating System Drives double-click Configure minimum PIN length for startup policy to edit it.
If you enable this policy setting, you can require a minimum number of digits to be used when setting the startup PIN. If you disable or do not configure this policy setting, users can configure a startup PIN of any length between 6 and 20 digits. If minimum PIN length is set below 6 digits, Windows will attempt to update the TPM 2.0 lockout period to be greater than the default when a PIN is changed. If successful, Windows will only reset the TPM lockout period back to default if the TPM is reset. Now do the following; To Use Default Minimum Length for BitLocker Startup PIN To Specify Minimum Length for BitLocker Startup PIN You can now exit Group Policy Editor and restart your system. This is how you can configure the Minimum Length for BitLocker Startup PIN in Windows 11/10.
