Managing hardware security in a corporate or shared environment has always presented a frustrating administrative hurdle when dealing with standard, non-administrator user accounts. Previously, if an employee lacked local admin privileges, configuring a TPM+PIN BitLocker preboot protector required IT intervention, often leaving corporate laptops vulnerable or compliance scripts failing.
Microsoft is finally bridging that gap. Rolling out to the Beta (26H1) channel, Windows 11 Insider Preview Build 28020.3532 brings a long-awaited enhancement that allows standard users to natively configure a BitLocker preboot PIN on managed devices.
For ongoing coverage of platform developments and insider changes, explore our dedicated Windows 11 hub.
Standard Users Can Now Set BitLocker Preboot PINs
With Build 28020.3532, standard users on managed workstations can now independently add a BitLocker preboot PIN when configured by system administrators.
When specific device management policies are deployed via Microsoft Intune or a compatible MDM solution, users who do not yet have a startup PIN receive a direct system notification. Tapping that notification opens a secure setup window where the preboot PIN can be created and confirmed immediately.
To successfully enable this workflow for your standard user test groups, administrators must configure the following device policies:
Important Deployment Note: Microsoft advises targeting these startup authentication and encryption policies strictly to your designated standard user test groups enrolled in the Windows Insider Program. Standard users who do not have this build feature enabled will be blocked from adding the TPM+PIN protector, causing device encryption configurations to fail or report as non-compliant.
Remote Desktop Certificate Fixes and General Improvements
Beyond the security updates for BitLocker disk protection, this flight addresses a frustrating connectivity roadblock for remote professionals:
Remote Desktop Protocol (RDP) Fix: This build resolves an underlying issue that caused RDP client connections to fail due to unexpected certificate mismatches following recent Insider flights.
As always, Insiders running Beta channel builds will notice the standard desktop watermark in the bottom-right corner of the screen. Because these builds preview features in active development for future platform cycles, behavior and rollout schedules may vary as feedback is collected.
