question

JL-8177 avatar image
0 Votes"
JL-8177 asked wfillmer-0953 commented

Bitlocker: "the startup options on this pc are configured incorrectly" and "tpm is ready for use"

Hello,
I have just upgraded to Windows 10 Pro and am attempting to enable Bitlocker on my main drive "C".
I have checked the TPM and it reports "The TPM is ready for use.". I have also cleared the TPM.
When I then enable Bitlocker, it reports "the startup options on this pc are configured incorrectly".
It should be noted that I have set the "BitLocker authentication requiring preboot keyboard input on slates" to enabled.
Thank you.

windows-10-security
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

JennyFeng-MSFT avatar image
2 Votes"
JennyFeng-MSFT answered wfillmer-0953 commented

@JL-8177
Hi,
Does BIOS have Legacy options enabled? That may need to be disabled and changed over to UEFI to allow secure boot of the OS.
https://docs.microsoft.com/en-US/troubleshoot/windows-client/windows-security/tpm-is-ready-for-use-with-reduced-functionality

Also, run gpedit
Local computer policy> computer configuration > administrative templates > Windows Components > bitlocker drive encryption > Operating system drives

Require additional authentication at startup

Enable it, then open up a command prompt and run a gpupdate /force

Hope above information can help you.

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

This was very helpful for re-enabling bitlocker on a boot-drive that once had bitlocker enabled and then turned off.

1 Vote 1 ·
JL-8177 avatar image
0 Votes"
JL-8177 answered

Hi, thank you for your response. When I change the Boot Device Control from "UEFI and Legacy OPROM" to "UEFI only", the Boot Priority drives (in my case PE: Samsun SSD 850 EVO" disappears and every restart returns to the BIOS and doesn't load the OS.
Any suggestions?
I think this may be the problem, but am unsure what my next steps would be. Do I have to obtain device signatures? If so, how? Or are there other steps to take that will allow me to use this TPM?

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

JL-8177 avatar image
0 Votes"
JL-8177 answered

I have solved this issue thanks to the direction that JennyFeng-MSFT provided.

In order to allow the BIOS to operate in UEFI without the Legacy support, I had to convert the boot drive (disk) from the Master Boot Record (MBR) to the GUID Partition Table (GPT) partition style. Once this was done, the rest worked like a charm.

Should anyone find a similarly difficult situation, below are some links that will help:
https://docs.microsoft.com/en-us/windows/deployment/mbr-to-gpt
https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/boot-to-uefi-mode-or-legacy-bios-mode
https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/winpe-create-usb-bootable-drive

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

JennyFeng-MSFT avatar image
0 Votes"
JennyFeng-MSFT answered

Hi,
Glad to hear that you have found a solution and thank you for sharing it here, it will be helpful to other community members who have same questions.
If the reply helped you, please remember to accept as answer.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.