Bitlocker recovery key required every boot

gdu90 21 Reputation points
2021-02-04T11:00:36.077+00:00

I have a Win10 PC with Bitlocker protected OS drive C:, that has started to request the Bitlocker Recovery key be input upon cold boots, restarts, and resumes from hibernation even when no changes have been made to the hardware or to the selected UEFI boot device in-between. I have:

  • suspended and resumed Bitlocker protection from within Windows
  • cleared and reinitialized TPM through UEFI and again through CLI
  • decrypted and re-encrypted the drive.

None of the above restores the Bitlocker behaviour to the normal operation it previously had (ie. to requirement for Recovery key input on C: only if dual-booting from an external drive). Is there another known solution to attempt ?

If not, am I left to assume that either (1) the TPM is faulty, or (2) some hardware/firmware component of the PC is mis-reporting its identity to TPM each boot, or (3) something is incorrectly writing to GPT every shutdown. Is there another possibility that might be causing this behaviour ?

Thanks.

Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,769 questions

4 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Bagitman 581 Reputation points
    2021-02-04T21:34:59.07+00:00

    No, I am not talking about removing the TPM itself, but the bitlocker TPM protector.
    You do it like this on an elevated command prompt:

    manage-bde -protectors -delete C: -Type TPM

    This assumes, you use TPM without a PIN, if you use it with PIN, use instead:
    manage-bde -protectors -delete C: -TypeTPMAndPIN

    Then re-add it:
    manage-bde -protectors -add c: -tpm
    (or manage-bde -protectors -add c: -TPMAndPIN)

    3 people found this answer helpful.
  2. Bagitman 581 Reputation points
    2021-02-04T19:42:47.54+00:00

    Remove the TPM protector and re-add it again.
    If that does not help, verify if the TPM is operating as TPM 2.0 and if yes, if the OS drive uses GPT partitioning (it has to, for TPM 2.0).

  3. AliceYang-MSFT 2,081 Reputation points
    2021-02-05T08:54:00.427+00:00

    Hi,

    Could you please tell us your model?

    Here is a KB from Dell Support which might help, BitLocker Asks for a Recovery Key Every Boot on USB-C / Thunderbolt Systems When Docked or Undocked.

    Update your system's BIOS before proceeding, as some BIOS updates have implemented a fix for this issue.

    Before you update the BIOS, please Suspend BitLocker protection.

    Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.

    ----------

    If the Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

  4. Marian Vulpe 1 Reputation point
    2021-04-23T11:40:28.257+00:00

    Have you managed to find a solution for this? Facing similar issues on some computers, starting the current month (March, 2021).
    BitLocker event log warning in one of the affected machines: "BitLocker cannot use Secure Boot for integrity because the TCG Log for PCR [7] contains invalid entries"