Windows 11 26H1 Build 28120.3542: BitLocker PIN Pilot Risks and Opt-In Run Dialog

The BitLocker change could save help desks a lot of tickets. It also comes with a warning that administrators need to read before changing any policy.

Where this build fits​

This is a weekly update in the 26H1 Experimental track. Microsoft's previous round, announced November 6, shipped Beta (26H1): Build 28020.3445, Experimental (26H1): Build 28120.3454. Build 28120.3542 replaces that Experimental build.

26H1 is a separate branch from the 25H2/26H2 releases most Windows 11 users run. It exists to support specific silicon. Thurrott has reported that if you have a Snapdragon X2-based PC running Windows 11 on Arm, you're running 26H1 and Microsoft previously revealed that you will not be updated to 26H2. Microsoft's Flight Hub says the Experimental 26H1 builds use an enablement package that raises the base build 28000 to the 28120 series. That's why the build number reads 28120.3542.

Section summary: This is an Insider preview on the silicon-specific 26H1 branch. It isn't a general Windows 11 release, and nothing in it is promised for production PCs on a set date.

BitLocker: standard users can finally add a TPM+PIN​

What changed​

Microsoft says users without administrator rights previously couldn't add the TPM+PIN protector. In this build, standard users on managed devices can add the PIN themselves.

When the required policies apply to a device that has no PIN yet, the user gets a notification asking them to add one. Selecting the notification opens a window where they set the BitLocker preboot PIN. Microsoft says every user targeted by these policies gets the prompt if their device doesn't already have a PIN.

Microsoft's BitLocker CSP documentation shows why this matters. It says devices that pass Hardware Security Testability Specification (HSTI) validation and Modern Standby devices can't have a startup PIN configured through the CSP, so users must set the PIN manually. Until now, that manual step needed admin rights, and many organizations don't give admin rights to standard users. This build gives standard users a supported way to add the PIN without elevation.

The CSP docs already had a related setting, SystemDrivesDisallowStandardUsersCanChangePIN. It controls whether standard users can change an existing PIN, provided they know the current one. The new feature covers adding the first PIN, which is the part that used to need an administrator.

Policies Microsoft lists​

In Intune or another device-management tool, Microsoft says to set these existing BitLocker policies to require TPM+PIN for non-administrators:

Microsoft's BitLocker CSP documentation explains how these settings work together:

• AllowStandardUserEncryption depends on silent encryption. It only takes effect when AllowWarningForOtherDiskEncryption is set to 0. If that warning policy is unset or set to 1, RequireDeviceEncryption won't try to encrypt drives while a standard user is signed in.
• Silent mode depends on how the device is joined. The CSP says that, starting with Windows 10 version 1803, the value 0 can only be set on Microsoft Entra ID–joined devices. When the warning prompt is disabled, the OS drive's recovery key is backed up to the user's Entra account.
• PIN length. With a compatible TPM, the startup PIN can be 6 to 20 digits. PINs as short as 4 digits are possible only if SystemDrivesMinimumPINLength allows them.
• Licensing. Except for turning BitLocker on or off with RequireDeviceEncryption, managing BitLocker through the CSP requires a Windows Enterprise E3 or E5 license (included in Microsoft 365 F3, E3 and E5), whatever management platform you use.
• Tablets. The CSP notes that the Windows touch keyboard doesn't work in the preboot environment. Tablet-style devices that will need a PIN at startup also need some other input method, such as an attached USB keyboard. The SystemDrivesEnablePrebootInputProtectorsOnSlates setting covers this.

The warning Microsoft puts up front​

Microsoft says to target the startup-authentication and device-encryption policies only at a standard-user test group that has this feature enabled through the Windows Insider Program. The reason is specific:

• Standard users without the feature can't add the required TPM+PIN protector, so device encryption fails under this configuration.
• Standard users without the feature whose devices are already encrypted with TPM only will report as noncompliant.

The CSP documentation explains the noncompliance. One of its status codes means the policy requires TPM+PIN protection for the OS volume but no TPM+PIN protector is in use. A TPM-only device under a TPM+PIN policy will be flagged until a PIN is added, and a standard user without this feature has no way to add one.

The release notes don't include a rollback or remediation procedure for these failures, so plan your test groups before you deploy.

How to test it safely​

1. Build a small pilot group. Use only standard-user devices enrolled in the Experimental (26H1) channel and running build 28120.3542 or later.
2. Check the join state. Silent encryption with AllowWarningForOtherDiskEncryption = 0 requires Entra ID–joined devices, per the CSP docs.
3. Assign the four policies to that group only. Don't add them to an existing broad BitLocker profile that covers production devices.
4. Confirm it worked. A successful test looks like this: the user gets the notification, sets a preboot PIN, and the device enters the PIN at the next boot. Compliance should then stop showing a missing TPM+PIN protector.
5. Watch everything outside the pilot. Encryption failures or new TPM-only noncompliance on devices outside the group mean your policy scope is wrong.

One caution: Microsoft rolls many Experimental (26H1) features out gradually. A device on the right build may not have the feature turned on yet, so confirm it on each pilot device before you rely on it.

Section summary: This closes a long-standing gap for organizations that want TPM+PIN on locked-down devices. For now, though, it's a preview to test in a contained group, not a fleet-wide policy.

Run dialog: refreshed and opt-in​

The other named change is a refreshed Run dialog, the Win+R box many of us use dozens of times a day. Microsoft says it has a more modern look, a cleaner interface, and new controls for managing it from Settings. It's opt-in for Experimental-channel Insiders.

To enable it:

1. Open Settings > System > Advanced.
2. Turn on the new Run dialog option.
3. Press Win+R to check that the new dialog opens.

If you don't see the option, the gradual rollout probably hasn't reached your PC yet. Microsoft points to a Dev blog post for more on the design, but the release notes describe nothing beyond the visuals and the Settings controls.

This dialog has been in the 26H1 Experimental track for a while. In an earlier build, Thurrott noted that Experimental (26H1) is also getting first launch reliability of the new WinUI-based Run dialog. Making it an opt-in Settings switch suggests Microsoft wants wider testing without forcing everyone to switch. That makes sense for a tool power users rely on heavily.

Section summary: This is a visual refresh you can switch on or off, and probably the least risky thing to try in this build.

Standard Experimental-channel caveats​

• Microsoft warns these builds can be unstable and may ship with limited documentation.
• Features roll out gradually: Microsoft starts with a subset of Insiders and expands as it reviews feedback.
• The desktop watermark in the lower-right corner is normal for pre-release builds.
• Some features may not be fully translated yet. Report translation problems through Feedback Hub.

Bottom line​

Build 28120.3542 is small. For IT teams running Snapdragon X2 pilots on 26H1, the BitLocker change is worth testing. It removes the need for admin rights to add a preboot PIN, which has long been an obstacle to TPM+PIN deployments. Keep the policy scope narrow, though: if the policies reach devices without the feature, encryption can fail or TPM-only devices can be flagged noncompliant. For everyone else on the channel, the new Run dialog is a simple setting to try.