Windows: allow keeping key clearing on device insertion enabled until restart

Translations/Language.ar.xml

@@ -1740,6 +1740,8 @@
     <entry lang="ar" key="SYSENC_EFI_WINDOWS_LOADER_MIGRATION_GUIDANCE">‮يشمل هذا الفحص مدير إقلاع ويندوز النشط فقط. قبل الإبطال، تحقق أيضا من توافق خيار الاسترداد بفك التعمية والنسخ الاحتياطية للإنقاذ. قد تؤدي عملية إنشاء قرص إنقاذ ڤيراكربت جديد إلى إعادة استخدام نسخة احتياطية أقدم محفوظة من مدير الإقلاع؛ فمجرد إنشاء القرص لا يثبت توافق تلك النسخة مع الإبطال.</entry>
     <entry lang="ar" key="RESCUE_DISK_EFI_BOOT_MANAGER_PCA2011">‮النسخة الاحتياطية من مدير إقلاع ويندوز Windows Boot Manager المضمنة في قرص الإنقاذ هذا موقّعة من Microsoft Windows Production PCA 2011. يحتوي البرنامج الثابت لديك بالفعل على Windows UEFI CA 2023.\n\nبعد إبطال PCA 2011 (البت 0x80 من AvailableUpdates، بما في ذلك القيمة المجمّعة 0x280)، قد تؤدي استعادة هذه النسخة الاحتياطية إلى تعذر بدء ويندوز مع تفعيل Secure Boot. يعيد إنشاء قرص إنقاذ جديد استخدام هذه النسخة الاحتياطية المحفوظة، ولا يحدّث توقيعها.\n\nقبل تطبيق الإبطال، جهّز وسائط استرداد ويندوز محدّثة ومتوافقة، وتحقق من خيار الاسترداد بفك التعمية. لا تعتمد على قرص الإنقاذ هذا لاستعادة مدير إقلاع ويندوز متوافق. يظل مفيدا لمهام استرداد ڤيراكربت الأخرى.</entry>
     <entry lang="ar" key="RESCUE_DISK_EFI_BOOT_MANAGER_CHECK_FAILED">‮تعذر على ڤيراكربت فحص النسخة الاحتياطية من مدير إقلاع ويندوز Windows Boot Manager الموجودة في قرص الإنقاذ هذا وفق سياسة Secure Boot في البرنامج الثابت.\n\nإنشاء هذا القرص أو التحقق منه لا يثبت توافق مدير إقلاع ويندوز المحفوظ فيه مع إبطال PCA 2011 (البت 0x80 من AvailableUpdates، بما في ذلك القيمة المجمّعة 0x280). قبل تطبيق الإبطال، تحقق من نسخك الاحتياطية للاسترداد، وجهّز وسائط استرداد ويندوز محدّثة ومتوافقة.</entry>
+    <entry lang="en" key="CLEAR_KEYS_ON_DEVICE_INSERTION_LOCK_PROMPT">Do you also want to prevent this option from being disabled until Windows restarts?\n\nIf you answer Yes, the option cannot be turned off in VeraCrypt or in the registry, and the VeraCrypt system service cannot be stopped, until Windows restarts. If you need to connect a new device before then, you will have to restart Windows first.\n\nNote: this does not protect against someone who has administrator privileges on this computer, who can, for example, terminate the VeraCrypt system service.</entry>
+    <entry lang="en" key="CLEAR_KEYS_ON_DEVICE_INSERTION_LOCK_FAILED">VeraCrypt could not prevent the option "Clear encryption keys from memory if a new device is inserted" from being disabled until Windows restarts.\n\nThe option is enabled, but it can still be disabled.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.be.xml

@@ -1740,6 +1740,8 @@
     <entry lang="en" key="SYSENC_EFI_WINDOWS_LOADER_MIGRATION_GUIDANCE">This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation.</entry>
     <entry lang="en" key="RESCUE_DISK_EFI_BOOT_MANAGER_PCA2011">The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks.</entry>
     <entry lang="en" key="RESCUE_DISK_EFI_BOOT_MANAGER_CHECK_FAILED">VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media.</entry>
+    <entry lang="en" key="CLEAR_KEYS_ON_DEVICE_INSERTION_LOCK_PROMPT">Do you also want to prevent this option from being disabled until Windows restarts?\n\nIf you answer Yes, the option cannot be turned off in VeraCrypt or in the registry, and the VeraCrypt system service cannot be stopped, until Windows restarts. If you need to connect a new device before then, you will have to restart Windows first.\n\nNote: this does not protect against someone who has administrator privileges on this computer, who can, for example, terminate the VeraCrypt system service.</entry>
+    <entry lang="en" key="CLEAR_KEYS_ON_DEVICE_INSERTION_LOCK_FAILED">VeraCrypt could not prevent the option "Clear encryption keys from memory if a new device is inserted" from being disabled until Windows restarts.\n\nThe option is enabled, but it can still be disabled.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.bg.xml

@@ -1740,6 +1740,8 @@
     <entry lang="en" key="SYSENC_EFI_WINDOWS_LOADER_MIGRATION_GUIDANCE">This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation.</entry>
     <entry lang="en" key="RESCUE_DISK_EFI_BOOT_MANAGER_PCA2011">The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks.</entry>
     <entry lang="en" key="RESCUE_DISK_EFI_BOOT_MANAGER_CHECK_FAILED">VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media.</entry>
+    <entry lang="en" key="CLEAR_KEYS_ON_DEVICE_INSERTION_LOCK_PROMPT">Do you also want to prevent this option from being disabled until Windows restarts?\n\nIf you answer Yes, the option cannot be turned off in VeraCrypt or in the registry, and the VeraCrypt system service cannot be stopped, until Windows restarts. If you need to connect a new device before then, you will have to restart Windows first.\n\nNote: this does not protect against someone who has administrator privileges on this computer, who can, for example, terminate the VeraCrypt system service.</entry>
+    <entry lang="en" key="CLEAR_KEYS_ON_DEVICE_INSERTION_LOCK_FAILED">VeraCrypt could not prevent the option "Clear encryption keys from memory if a new device is inserted" from being disabled until Windows restarts.\n\nThe option is enabled, but it can still be disabled.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.ca.xml

@@ -1740,6 +1740,8 @@
     <entry lang="en" key="SYSENC_EFI_WINDOWS_LOADER_MIGRATION_GUIDANCE">This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation.</entry>
     <entry lang="en" key="RESCUE_DISK_EFI_BOOT_MANAGER_PCA2011">The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks.</entry>
     <entry lang="en" key="RESCUE_DISK_EFI_BOOT_MANAGER_CHECK_FAILED">VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media.</entry>
+    <entry lang="en" key="CLEAR_KEYS_ON_DEVICE_INSERTION_LOCK_PROMPT">Do you also want to prevent this option from being disabled until Windows restarts?\n\nIf you answer Yes, the option cannot be turned off in VeraCrypt or in the registry, and the VeraCrypt system service cannot be stopped, until Windows restarts. If you need to connect a new device before then, you will have to restart Windows first.\n\nNote: this does not protect against someone who has administrator privileges on this computer, who can, for example, terminate the VeraCrypt system service.</entry>
+    <entry lang="en" key="CLEAR_KEYS_ON_DEVICE_INSERTION_LOCK_FAILED">VeraCrypt could not prevent the option "Clear encryption keys from memory if a new device is inserted" from being disabled until Windows restarts.\n\nThe option is enabled, but it can still be disabled.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.co.xml

@@ -1763,6 +1763,8 @@ Information about Corsican localization:
 	    <entry lang="co" key="SYSENC_EFI_WINDOWS_LOADER_MIGRATION_GUIDANCE">Stu cuntrollu copre solu u ghjestiunariu di piccera Windows attivu. Prima a revucazione, verificà dinù chì a suluzione alternativa di dicifratura è chì e salvaguardie di succorsu sianu cumpatibile. A creazione d’un discu di succorsu VeraCrypt novu pò rimpiegà una salvaguardia anziana arregistrata di u ghjestiunariu di piccera ; a creazione di u discu solu ùn stabilisce micca a cumpatibilità di quella salvaguardia cù a revucazione.</entry>
 	    <entry lang="co" key="RESCUE_DISK_EFI_BOOT_MANAGER_PCA2011">A salvaguardia di u ghjestiunariu di piccera Windows inclusa in stu discu di succorsu hè firmata da Microsoft Windows Production PCA 2011. U vostru microprugramma cuntene dighjà Windows UEFI CA 2023.\n\nDopu a revucazione di PCA 2011 (AvailableUpdates bit 0x80, includendu u valore cumbinatu 0x280), a risturazione di sta salvaguardia pò rende impussibule u lanciu di Windows cù a piccera sicurizata attivata. A creazione d’un discu di succorsu novu rimpiegheghja sta salvaguardia arregistrata ; ùn mudificheghja micca a so segnatura.\n\nPrima d’appiecà a revucazione, appruntà un medià di ricuperazione Windows cumpatibile è messu à livellu è verificà a suluzione alternativa di dicifratura. Ùn vi fidate micca à stu discu di succorsu per risturà un ghjestiunariu di piccera Windows cumpatibile. Ma stà ghjuvevule per d’altre tacche di ricuperazione VeraCrypt.</entry>
 	    <entry lang="co" key="RESCUE_DISK_EFI_BOOT_MANAGER_CHECK_FAILED">VeraCrypt ùn hà pussutu verificà a salvaguardia di u ghjestiunariu di piccera Windows in stu discu di succorsu secondu à a pulitica di a piccera sicurizata di u microprugramma.\n\nA creazione o a verificazione di stu discu ùn vole micca dì chì u so ghjestiunariu di piccera Windows arregistratu hè cumpatibile cù a revucazione PCA 2011 (AvailableUpdates bit 0x80, includendu u valore cumbinatu 0x280). Prima d’appiecà a revucazione, verificà e vostre salvaguardie di ricuperazione è appruntà un medià di ricuperazione Windows cumpatibile è messu à livellu.</entry>
+	    <entry lang="en" key="CLEAR_KEYS_ON_DEVICE_INSERTION_LOCK_PROMPT">Do you also want to prevent this option from being disabled until Windows restarts?\n\nIf you answer Yes, the option cannot be turned off in VeraCrypt or in the registry, and the VeraCrypt system service cannot be stopped, until Windows restarts. If you need to connect a new device before then, you will have to restart Windows first.\n\nNote: this does not protect against someone who has administrator privileges on this computer, who can, for example, terminate the VeraCrypt system service.</entry>
+	    <entry lang="en" key="CLEAR_KEYS_ON_DEVICE_INSERTION_LOCK_FAILED">VeraCrypt could not prevent the option "Clear encryption keys from memory if a new device is inserted" from being disabled until Windows restarts.\n\nThe option is enabled, but it can still be disabled.</entry>
 	</localization>
 	<xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
 		<xs:element name="VeraCrypt">

Translations/Language.cs.xml

@@ -1740,6 +1740,8 @@
     <entry lang="en" key="SYSENC_EFI_WINDOWS_LOADER_MIGRATION_GUIDANCE">This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation.</entry>
     <entry lang="en" key="RESCUE_DISK_EFI_BOOT_MANAGER_PCA2011">The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks.</entry>
     <entry lang="en" key="RESCUE_DISK_EFI_BOOT_MANAGER_CHECK_FAILED">VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media.</entry>
+    <entry lang="en" key="CLEAR_KEYS_ON_DEVICE_INSERTION_LOCK_PROMPT">Do you also want to prevent this option from being disabled until Windows restarts?\n\nIf you answer Yes, the option cannot be turned off in VeraCrypt or in the registry, and the VeraCrypt system service cannot be stopped, until Windows restarts. If you need to connect a new device before then, you will have to restart Windows first.\n\nNote: this does not protect against someone who has administrator privileges on this computer, who can, for example, terminate the VeraCrypt system service.</entry>
+    <entry lang="en" key="CLEAR_KEYS_ON_DEVICE_INSERTION_LOCK_FAILED">VeraCrypt could not prevent the option "Clear encryption keys from memory if a new device is inserted" from being disabled until Windows restarts.\n\nThe option is enabled, but it can still be disabled.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">

Translations/Language.da.xml

@@ -1740,6 +1740,8 @@
     <entry lang="en" key="SYSENC_EFI_WINDOWS_LOADER_MIGRATION_GUIDANCE">This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation.</entry>
     <entry lang="en" key="RESCUE_DISK_EFI_BOOT_MANAGER_PCA2011">The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks.</entry>
     <entry lang="en" key="RESCUE_DISK_EFI_BOOT_MANAGER_CHECK_FAILED">VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media.</entry>
+    <entry lang="en" key="CLEAR_KEYS_ON_DEVICE_INSERTION_LOCK_PROMPT">Do you also want to prevent this option from being disabled until Windows restarts?\n\nIf you answer Yes, the option cannot be turned off in VeraCrypt or in the registry, and the VeraCrypt system service cannot be stopped, until Windows restarts. If you need to connect a new device before then, you will have to restart Windows first.\n\nNote: this does not protect against someone who has administrator privileges on this computer, who can, for example, terminate the VeraCrypt system service.</entry>
+    <entry lang="en" key="CLEAR_KEYS_ON_DEVICE_INSERTION_LOCK_FAILED">VeraCrypt could not prevent the option "Clear encryption keys from memory if a new device is inserted" from being disabled until Windows restarts.\n\nThe option is enabled, but it can still be disabled.</entry>
   </localization>
   <xs:schema attributeFormDefault="unqualified" elementFormDefault="qualified" xmlns:xs="http://www.w3.org/2001/XMLSchema">
     <xs:element name="VeraCrypt">