If you have a spare USB laying around, you can easily repurpose it and create a USB startup key on Windows 11 instead. Here's what to do.

1. Turn on BitLocker on the USB drive you want to use 2. Open Local Group Policy Editor and follow this path: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives 3. Enable "Require additional authentication at startup" 4. Select Require startup key with TPM form the drop-down menu 5. Run the following command in Command Prompt as an administrator to create a USB startup key: manage-bde -protectors -add {System Drive} -TPMAndStartupKey {USB Drive}

Did you know you can use just about any USB drive as a "startup key" on Windows 11? When you enable BitLocker on newer PCs, Windows automatically unlocks your system drive every time you start up your computer using Trusted Platform Module (TPM).

The ability to add an extra level of security with the convenience with using a USB startup key on a BitLocker enabled PC is indispensable. It effectively adds two-factor authentication to BitLocker encryption. Now, your PC won't even start without the USB startup key inserted for your drive to be decrypted and Windows to start.

It is important to point out the difference between a USB startup key and a USB security key. A USB security key, like the Yubikey 5 Series from Yubico, offer FIDO2 (Fast Online Identification) authentication, which is also offered by Microsoft's Windows Hello.

A USB startup key prevents a PC from booting into Windows on a BitLocker-enabled drive unless the startup key is present. It's not quite the same level of protection, but still more secure than just a password, for example.

In this guide, we will show you how to create one from scratch on Windows 11.

Bitlocker is a built-in full disk encryption tool available on Windows 11, that was first introduced in Windows 7. You can create a USB startup key using BitLocker on Windows 11.

However, it's important to note that this BitLocker method will only work for Windows 11 Professional and Windows 11 Enterprise versions. Windows Home does not come with BitLocker, it uses a different security feature called Device Encryption.

Here's how to use BitLocker on Windows 11 Pro to create a USB startup key from scratch.

1. Open File Explorer, right click your PC's system drive (where Windows is installed) and click Turn on BitLocker. In my case, it's the C: drive.

2. Once the BitLocker process completes, open Local Group Policy Editor. Go to the following path: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives

3. Find and open Require additional authentication at startup and double-click to configure it.

4. A new window will open, allowing you to configure the settings, change the toggle to Enabled and choose Require startup key with TPM from the dropdown menu under Configure TPM startup key. Click Apply to apply your changes and click OK to close the window when finished. Close Local Group Editor.

5. The final step is to open and run Command Prompt as an administrator. Copy and paste the following command and press Enter to run it:

Manage-bde -protectors manages the protection methods used for the BitLocker encryption key and the command will add E: (my USB drive designation) as a TPMandStartupKeyto unlock C:(my system drive destination). Be sure that you indicate the correct drive letters for your system and USB drives.

That's it, you are finished! Now your PC will not start up unless you have the USB inserted. Try it out for yourself! If someone attempts to start up your PC without the USB startup key inserted, they will see this screen.

If creating your own USB startup key seems too complicated, there are several third-party applications that can act as a way to lock your PC with just about any USB drive on Windows 11. Here's a look at just a few.

USB Raptor is a free program, that once you download and install, can turn any USB flash drive into a startup key to lock and unlock your PC at will. As long as USB Raptor is running on your PC, no one will be able to use your PC without your USB startup key.

When your PC is locked with USB Raptor, a brown screensaver appears with the time and valid ways to unlock your PC, by using a typed password, USB startup key, or network unlock. One downside to this free app is that USB Raptor has to be running and enabled on your PC to function correctly.

Predator protects your computer by creating and is another popular and low-cost option to use a USB drive to lock and unlock your PC when you aren't using it. As soon as you use Predator to create your own USB startup key, no one can use your PC and if they do, they'll be met with an "Access Denied" error message and be unable to access your device.

Rohos Logon Key is a USB key maker that uses two-factor authentication to unlock both Windows 11 and macOS. Although Rohos Logon Key is technically considered "freeware," you will need to pay up to $59.00 for a license, if you want to use the "free" version past its 15-day trial period.

Do you use a USB startup key to lock your PC at boot? Tell us why or why not in the comments!

Mathieu Robitaille: Which are in no way related to what this article describes outside the Long-Term part of the support.

Commented on: Should you install Windows 10 Enterprise LTSC on your PC? Here's what to consider before you install

wow: Mail/calendar for win10/11 is pretty garbage

Commented on: Vivaldi Mail 1.0 Arrives With Cool Features

Sirjaz: It looks nice but they should separate it from the browser. That is the worst part. Not everything should be built in to the browser

Commented on: Vivaldi Mail 1.0 Arrives With Cool Features

Sargon: Nothing exciting, these requirements are arbitrary.

Commented on: Windows 11 Version 22H2 Shows Up on Unsupported PCs

Sargon: Oh what a tragedy. It’s almost like these requirements are completely arbitrary.Oh wait... They are.

Commented on: Windows 11 Version 22H2 Shows Up on Unsupported PCs