Run Add-BitLockerTPMPin.ps1 (admin)
       │
       ▼
  [Version Check] ──→ exits gracefully on Windows 10 (not affected)
       │
       ▼
  [BitLocker Status Check] ──→ confirms encryption is active on C:
       │
       ▼
  [Group Policy Fix] ──→ sets UseAdvancedStartup + UseTPMPIN + UseEnhancedPin
       │                   (required — manage-bde rejects TPM+PIN without these)
       ▼
  [gpupdate /force] ──→ applies policy immediately without reboot
       │
       ▼
  [manage-bde -protectors -add C: -TPMAndPIN] ──→ prompts for PIN interactively
       │
       ▼
  [List Protectors] ──→ shows all current protectors for verification
       │
       ▼
  [Remove TPM-only Protector] ──→ optional, prompted with confirmation

# Run these as two separate commands in an elevated PowerShell prompt:
Set-ExecutionPolicy Bypass -Scope Process -Force

# All BitLocker-protected drives (auto-detected):
.\Add-BitLockerTPMPin.ps1

# Or target a specific drive:
.\Add-BitLockerTPMPin.ps1 -Drive C
.\Add-BitLockerTPMPin.ps1 -Drive D

BitLocker-protected drives found:
  C:\  FullyEncrypted  Protection: On
  D:\  FullyEncrypted  Protection: On

Group Policy keys set. Refreshing policy...

==============================
Drive: C:\
==============================
Adding TPM+PIN protector. You will be prompted for a PIN.
PIN must be 6+ characters. Alphanumeric is supported.

Type the PIN to use to protect the volume:
Confirm the PIN by typing it again:
Key Protectors Added:
  TPM And PIN:
    ID: {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}

Current protectors on C:\:
  ...

TPM-only protector found: {YYYYYYYY-YYYY-YYYY-YYYY-YYYYYYYYYYYY}
Remove TPM-only protector on C:\? This leaves only TPM+PIN. (y/N): y
TPM-only protector removed.

==============================
Drive: D:\
==============================
D:\ has no TPM protector — TPM+PIN applies to the OS drive only. Skipping.

Done. Verify with: manage-bde -status <drive>

manage-bde -status C:
# Should show: Key Protectors: TPM And PIN
# Protection Status: Protection On

# Print recovery key to console (store it somewhere safe)
manage-bde -protectors -get C: -Type RecoveryPassword

# 1. Set Group Policy registry keys
$p = "HKLM:\SOFTWARE\Policies\Microsoft\FVE"
if (-not (Test-Path $p)) { New-Item -Path $p -Force }
Set-ItemProperty -Path $p -Name "UseAdvancedStartup" -Value 1 -Type DWord -Force
Set-ItemProperty -Path $p -Name "UseTPMPIN"          -Value 2 -Type DWord -Force
Set-ItemProperty -Path $p -Name "UseTPM"             -Value 2 -Type DWord -Force
Set-ItemProperty -Path $p -Name "UseEnhancedPin"     -Value 1 -Type DWord -Force
gpupdate /force

# 2. Add TPM+PIN protector
manage-bde -protectors -add C: -TPMAndPIN

# 3. Find the TPM-only protector ID
manage-bde -protectors -get C:

# 4. Remove it (replace GUID with the ID from step 3)
manage-bde -protectors -delete C: -id {YOUR-TPM-ONLY-GUID}

# 5. Verify
manage-bde -status C:

yellowkey-mitigation/
├── Add-BitLockerTPMPin.ps1   # Main mitigation script
└── README.md