---
title: "Change TPM pin or Password for SystemDrive on Window 10 and above devices."
slug: "change-tpm-pin-or-password-for-systemdrive-on-window-10-and-above-devices"
updated: 2024-07-23T09:49:05Z
published: 2024-07-23T09:49:05Z
canonical: "help.scalefusion.com/change-tpm-pin-or-password-for-systemdrive-on-window-10-and-above-devices"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.scalefusion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Change TPM pin or Password for SystemDrive on Window 10 and above devices.

This PowerShell script helps IT Admins to change the TPM pin or Password for SystemDrive on Window 10 and above devices.

1. Create a file on your desktop, for example, **ChangeTPMPinOrPasswordOnSystemDrive_v2.ps1** and open it in an editor like notepad++
2. Copy the contents below to the file or [**click here**](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/ChangeTPMPinOrPasswordOnSystemDrive_v2.ps1) to download the file.
  1. In the following script, change the drive letter and the password that you want to update.
  2. Note that if you want to update the pin of D: drive then please first Unlock the D: drive (if its Locked) and then publish the script.
  3. Please test the script on one or two devices first and then deploy it on rest of the devices.

```powershell
#==================================================================
# User input parameters for bitlocker encryption
#==================================================================

$BitlockerSecureStr = "enter the new password"
$SystemDrive = "enter the drive name"

#==================================================================

try
{
	Function GetPinPasswordMinLength()
	{
        $MinLength = 8

        try
		{
            $key = 'HKLM:\SOFTWARE\Policies\Microsoft\FVE'
		    $MinLength = (Get-ItemProperty -LiteralPath $key -Name 'MinimumPIN' -ErrorAction Ignore) | Where-Object -FilterScript {$_ -ne $null} | Select-Object -ExpandProperty $('MinimumPIN')

		    if ($MinLength -eq $null)
		    {
			    $MinLength = 8
		    }
        }
        catch {
            $MinLength = 8
            $Error.Clear()
        }

		return $MinLength
	}
	
	$MinPinAndPasswordLength = GetPinPasswordMinLength
	
    if ($BitlockerSecureStr.Length -ge $MinPinAndPasswordLength)
    {
		$BitLockerVolume = Get-BitLockerVolume -MountPoint $SystemDrive | Where-Object -FilterScript {$_ -ne $null -and $_.VolumeStatus -eq 'FullyEncrypted' }

		if ($BitLockerVolume -eq $null)
		{
			Write-Error "ERROR: No key protectors found on '$SystemDrive' drive."
			return
		}
		
        $LockStatus = $BitLockerVolume | Select -ExpandProperty LockStatus

        if ($LockStatus -eq 'Locked')
        {
            Write-Error "ERROR: Bitlocker can not be perform any operation on the locked drive, please unlock the '$SystemDrive' drive first and then try again."
            return;
        }

        $NewSecureStr = ConvertTo-SecureString $BitlockerSecureStr -AsPlainText -Force
        $BitLockerVolume | Select-Object -ExpandProperty $('KeyProtector') | ForEach-Object {

            $KeyProtectorType = $_.KeyProtectorType

            switch -Exact ($KeyProtectorType)
            {
                "TpmPin" {
                            if ($BitlockerSecureStr -match '^\d+$')
                            {
                                manage-bde -protectors $SystemDrive -delete -type TPMAndPIN 
                                Add-BitLockerKeyProtector $SystemDrive -pin $NewSecureStr -TpmAndPinProtector
								Write-Output "Bitlocker new pin '$BitlockerSecureStr' has been changed on '$SystemDrive' drive successfully."
                            }
                            else
                            {
                                Write-Error "ERROR: Bitlocker pin must be a number, please correct the pin and try again."
                            }
                            break;
                }
                "Password" { 
                    
                            manage-bde -protectors $SystemDrive -delete -type Password
                            Add-BitLockerKeyProtector $SystemDrive -Password $NewSecureStr -PasswordProtector                  
                            Write-Output "Bitlocker new password '$BitlockerSecureStr' has been changed on '$SystemDrive' drive successfully."
                            break;
                }
                default {
                    return;
                }
            }

        }
    }
    else
    {
        Write-Error "ERROR: Pin/Password does not meet minimum length requirement of $MinPinAndPasswordLength characters."
    }
}
Catch
{
    $err = $($_ | Out-String)
	Write-Error "ERROR: Exception raised: $err"	
}
```
3. Follow [our guide](/docs/deploy-powershell-scripts-using-scalefusion) to upload & publish the PowerShell script using Scalefusion Dashboard.
4. Once the script is successfully executed, you will be able to see the status of the same in the View Status report on the Scalefusion dashboard.

> [!CAUTION]
> Please note that to use the PowerShell scripts, the Scalefusion MDM Agent Application must be installed on the device(s). Please follow our guide to publish and install the Scalefusion MDM Agent Application.

> [!CAUTION]
> Note:
> 
> 1. The scripts and their contents are sourced from various albeit authenticated Microsoft sources and forums.
> 2. Please validate the scripts on a test machine before deploying them on all your managed devices.
> 3. Scalefusion has tested these scripts, however, Scalefusion will not be responsible for any loss of data or system malfunction that may arise due to the incorrect usage of these scripts.