Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=BitLocker-TPM-only

TPM-only

The TPM-only mode uses the computer's TPM security hardware without any PIN authentication. This means that the user can start the computer without being prompted for a PIN in the Windows pre-boot environment.

TPM-only requires a prepared TPM and the Device Encryption policy setting Require startup authentication must be disabled. Furthermore, the GPO settings of the system must allow TPM-only protection.

If all conditions are met, the TPM-only protection installation dialog will be displayed. The user can click Restart and Encrypt to immediately restart the computer and start encryption.