T520 - Win7 Ent - UEFI - GPO Enabled to allow Bitlocker enhanced pin, but windows refuses it

Question

Before I start -- I'm not sure if this is a windows issue or a lenovo issue, but had to start somewhere.
I have installed our standard image of Windows 7 enterprise using Microsoft Deployment Toolkit on a new T520.  The drive is configured for and OS installed in UEFI mode.  Bitlocker is enabled automatically as part of my standard deployment task sequence, but with a numeric PIN.  We have a GPO in place that enables Bitlocker Enhanced PIN's, which can include alpha or symbol characters. Normally, after a deployment is complete, I go into control panel and change the bitlocker pin to a new pin which includes alpha, numeric, and symbol characters.  When I try to change the pin on this T520, it refuses, stating that it can only accept digits (numeric) 0-9.  
I've run into that error before if a laptop had not been placed in the correct OU, or the GPO's hadn't been applied to it for some other reason, but as best as I can tell that is not the case here.  I've run a group policy results report from the DC, and one from a command prompt on the affected pc using gpresult, and both say the Bitlocker Enhanced Pin GPO is enabled and applied.  
I have also just experienced this same issue on a Lenovo X220 Tablet.  We've only recently started seeing/using the UEFI mode on newer laptops, so up until now we've always installed windows in legacy BIOS mode.  As such, I decided to re-image the X220 forcing it to run in legacy bios mode.  After the re-install of windows, it accepted the enhanced bitlocker pin without issue.  I suspect if I reimage the T520 in legacy BIOS mode it will work as well, but have not yet tested this.  I was hoping to find a solution rather than simply working around the issue by not using UEFI.
I found the sections below in an article on technet regarding bitlocker with UEFI and enhanced pins, and what I understand from this is that it is fully supported by windows, but if the laptop doesn't support the full keyboard in the pre-boot environment, windows will refuse the enhanced pin and force a numeric only pin. 
Is this a problem with the laptop/UEFI version? Or with Windows? Or am I maybe just doing something wrong?  
Any help would be appreciated.  
http://technet.microsoft.com/en-us/library/ee449438(WS.10).aspx
PIN and enhanced PIN
For a higher level of security with the TPM, you can configure BitLocker with a personal identification number (PIN). The PIN is a user-created value that must be entered each time the computer starts or resumes from hibernation. The PIN can consist of 4 to 20 digits as specified by the Configure minimum PIN length for startup Group Policy setting and is stored internally as a 256-bit hash of the entered Unicode characters. This value is never displayed to the user. The PIN is used to provide another factor of authentication in conjunction with TPM authentication.
For an even higher level of security with the TPM, you can configure BitLocker to use enhanced PINs. Enhanced PINs are PINs that use the full keyboard character set in addition to the numeric set to allow for more possible PIN combinations and are between 4 and 20 characters in length. To use enhanced PINs, you must enable the Allow enhanced PINs for startup Group Policy setting before adding the PIN to the drive. By enabling this policy, all PINs created can utilize full keyboard characters.
NoteTo use enhanced PINs, your computer's BIOS must support using the full keyboard in the pre-boot environment. Users can run the optional system check during the BitLocker setup process to ensure the PIN can be entered correctly in the pre-boot environment. You should verify that the computers in your organization are compatible before making the use of enhanced PINs an organizational requirement. 
When setting a BitLocker PIN by using the BitLocker setup wizard, the Manage-bde command-line tool, or through Windows Management Instrumentation (WMI) remote administration, you can use the wide character set. However, system firmware, either BIOS or Unified Extensible Firmware Interface (UEFI), may only support a standard EN-US keyboard and keymap during system startup. Additionally, BIOS-based systems are limited to 7-bit ASCII input during PIN entry. Thus, the use of either non-English characters or keys that differ in position from the EN-US keymap, such as QWERTZ and AZERTY keyboards, may cause boot-time PIN entry to fail. If your computer is affected by this limitation, it should be identified during the system check run by the BitLocker setup wizard. If it is not identified during the system check and the PIN is not able to be entered, you will need to supply the recovery key to unlock the drive.
We recommend that users set their keyboard layout to EN-US during enhanced PIN entry to avoid PIN entry failure in the pre-boot environment. If you are unable to enter an enhanced PIN from your keyboard even after setting the keyboard layout to EN-US, you must use a numeric-only PIN.
The following list identifies characters that are not currently supported by system firmware:
Roman characters on keyboards with a non-EN-US keymap. For example, "Z" and "Y" on German keyboards and "Q" and "A" on French keyboards.
Characters that are not available in 7-bit ASCII. For example, characters with umlauts, grave accents, and tildes.
Symbols that are not available in 7-bit ASCII. For example, squared superscript, fractions, copyright, trademark, and international currency symbols.
<snip>
Yes. Starting with Windows Vista with SP1, BitLocker can be used with computers that use Unified Extensible Firmware Interface (UEFI)-based system firmware.
Will BitLocker work on computers that use UEFI-based system firmware?
Solved!
Go to Solution.

Answer 1

Very interesting!  I'm not sure if anyone has tried BitLocker with enhanced PIN on UEFI installation of Win7 64-bit.  Please give me a couple days to repro this and investigate.  Thanks for your patience.