Windows 10: BitLocker key protector management help

Seeking BitLocker help:

Win10 machine with TPM.
OS drive was successfully encrypted with "TPM & PIN" additional key protection.
Now I'm hoping to drop back to "just TPM" with no additional PIN protection without having to decrypt and re-encrypt. (note: the reason is so that updates will reboot back to windows login and leave this base station machine accessible by Remote (RDP) but the reason is not what I want to discuss)

I haven't found how to do it yet and don't know whether to concentrate on the "manage-bde" commands or gpupdate or both to find the answer. None of the local bitlocker policies are enabled (but the machine is in an AD domain.) If I try the following:
manage-bde -protectors -delete C: -Type TPMAndPIN
(within an admin cmd prompt) I get:
"ERROR: An error occurred while deleting the key protector.
Group Policy settings require the use of a PIN at startup. Please choose this Bitlocker startup option."

Is there a way I can check what the domain admin is requiring? I forget how to check the broader group policies on Win10.
Thanks!

:)

 

Bitlocker loop cannot boot

I was having an issue with Bitlocker prompting for the recovery key upon boot. group policy is correct. boot order is correct. manage-bde -protectors -type tpmandpin and I set my pin. still I was only receiving the recovery key prompt. manage-bde -protectors
showed tpm and pin and also numeric password. I deleted numeric password with manage-bde -protectors -delete -recoverypassword. so all that remained in status was tpm and pin. upon reboot i am in a never ending loop with preparing bitlocker recovery and restart.
it wont prompt for recovery password or pin. I need a solution as there is sensitive data on the drive and i do not want to have to format.

*** Post moved by the moderator to the appropriate forum category. ***

 

BitLocker key asking on every reboot

Hi Jefferson,

Tnx for the reply. I had tried the same laptop with windows 10 version 1703 and 1709, in which the bitlocker encrypts the HDD perfectly fine with any issue, the problem comes when i reboot. the one with version 1703 reboots without asking for bitlocker
key and the the one with version 1709 asks top enter the bitlocker key on every reboot.. i tried disabling and enabling the bitlocker by running this command

<manage-bde.exe -protectors -disable C:>

<manage-bde.exe -protectors -enable C:>

I had also ready that in windows 10 version 1709 changes were made in bitlocker features

Do let me know abt any updates or solutions on this.

Regards,

Akram

 

There is this very easy way: ask the admin. If admin accepts what you want to do, I am sure you get help. We cannot help you to work around policies set by your admin.

 

Thanks Kari, Yes, I'm trying to do that, it just takes time in a large organization. Meanwhile, if they are -not- ruling that my users have to have a PIN on top of the TPN I'm trying to figure out if I've found the right way to remove the PIN I set up without having to decrypt/re-encrypt....

~~