Windows 10: Bitlocker randomly activated after windows update - Unlock key not saved anywhere

The computer in question:
HP-Elitebook 840 G3 - running windows 10 professional



Hi,


After arriving to work today, I was greeted with a wonderful "please enter your bitlocker key" message on my computer, completely locking me out of my system. The last thing I did the day before was to let my computer complete a windows update the june 10 cumulative update, I'm pretty sure by using the update and shut downoption. Nothing else was installed, or changed, on the entire system - in fact, the machine itself has not seen much use because of Covid-19 in the past few months. No one has remote access to my computer, I don't run any other antivirus software other than malwarebytes and windows defender, and I am the admin of my system and it requires a password to access normally.


The most important part to take home here is that I did not configure bitlocker at any point during the ownership of this PC Since september 2018, in fact, I didn't even know I had the option to use bitlocker until it had locked me out, and then it was too late to think about configuring it, because it was done automatically during this update.


Here's the problem:

In spite of Microsoft claiming that "Bitlocker should not allow encryption without depositing the key in your MS Account at the link you gave." [source: https://answers.microsoft.com/en-us/windows/forum/all/windows-10-finding-bitlocker-recovery-key/b2481a9f-cc4d-49a7-b66f-cd15002f72b5], this is exactly what happened. My microsoft account says my BitLocker is on, and no bitlocker recovery keys have been uploaded, and I definitely did notprint it out or save it as a file - and if the key was saved to my computer, then it's been encrypted too - way to go!

And just for the record, there are also no key's stored here: https://onedrive.live.com/recoverykey , so don't try telling me to go look there either.



What I have tried:
I have called Microsoft support, got asked repeatedly "did it happen because of an update?", and then passed between calls for about an hour before being told that there was nothing they could do, and that I should contact HP -because they might have activated it remotely excuse me, what?

So I called HP and they said that "only Microsoft can activate Bitlocker" and if it had been activated without a key being saved, then I'm screwed, and I'll need to reformat my harddrive and reinstall windows 10. Which is an unacceptable solution to a problem caused by a routine windows update.


I have been looking around, and there appears to be a much greater than normal amount of requests for assistance pertaining to a random activation of BitLocker without a key being saved. Now, a computer failing to boot is usually not a big deal, because you can still recover the files on your harddrive, but when an update not only forces the activation of the complete encryption of all the files on your computer,and then also throws away the key, almost completely ensuring that you cannot recover your files, that's a pretty big issue.


I don't want a canned response, because I have already tried all of the advice given in other threads about this - I simply wish for Microsoft to step up and find a solution that doesn't involve me needing to spend the better half of a day reinstalling and configuring all of the software I use on a regular day basis, after also discarding a large chunk of important personal files thankfully, no work related files were harmed in the encrypting of my stuff

:)

 

HELP: Automatic BitLocker Unlock.

Thank you sir, ill try your solution.

Windows Auto unlock ONLY works in case you have Bitlocker on your system drive, because if your system drive is not encrypted auto unlocking other drives means loss of security.
But in my case my system drive is Encrypted with hardware encryption that i password unlock during boot. So auto unlocking Bitlocker drives will do fine for me.

 

HELP: Automatic BitLocker Unlock.

more clear
0down voteaccepted
I managed to figure out how to fix this. It doesn't use the native auto-unlock function like I was hoping (rather a script that unlocks using a .BEK file, as I mentioned) but it seems to work just as well.

First, you need to create a .BEK file that can unlock the disk. This is the command I used:

manage-bde -protectors -add d: -rk c:\

Substitute d: with whichever drive you want to auto-unlock. The output will look something like this (take note of the "external key file name"):

BitLocker Drive Encryption: Configuration Tool version 10.0.10011
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

Key Protectors Added:

Saved to directory c:\

External Key:
ID: {9DDF4900-5E08-479A-8C4C-6ADE2DA00551}
External Key File Name:
9DDF4900-5E08-479A-8C4C-6ADE2DA00551.BEK

Now you need to create the script to unlock the drive. Just create a batch file in the root directory with the following line:

manage-bde -unlock d: -rk C:\[external key filename]

Again, replace d: with the correct drive letter. Replace [external key filename] with the filename you got before.

Finally, you need to tell Windows to run this script at startup, before you log in. (Or at least I needed it to run then, because that's where my desktop, etc. are stored.) Here's how you do that:

• Press Win+R and enter gpedit.msc. (This is only in Pro, but so is BitLocker, so that's not an issue here.)
  
  
• On the left, navigate to Computer Configuration > Windows Settings > Scripts (Startup/Shutdown)
  
  
• Double-click "Startup" on the right
  
  
• Click "Add..." and select the batch file you created before.
  
  
• Click OK and exit Group Policy Editor.
  

Now you can reboot the computer to test it. You should see your drive automatically unlocked

 

BitLocker key cannot unlock the disk. Neither can i reinstall cause the drive is blocked

Hi Havard,

Thank you for posting your query in Microsoft Community.

I understand the inconvenience you are facing currently.

I would appreciate if you can provide us the following information to help us understand the issue better.

• Did you try to unlock the drive using the Bitlocker application in Windows 10?
  
• If yes, did you get any error message while trying that?

I suggest you to follow the methods below and check if that helps:

Method 1:

I would suggest you to try unlocking the drive using the Bitlocker facility available in Windows 10 and check if you are able to unlock it successfully. If you are getting any error message with says “Application not found”, then I would suggest you
to refer the article provided in the link below:

http://windows.microsoft.com/en-US/windows-8/unlock-bitlocker-protected-drive

Method 2:

I would suggest that you try the steps mentioned in the link below and check if it helps resolve your issue.

Important: This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For
added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following link to view the article “How to back up and restore
the registry in Windows” from the Microsoft Knowledge Base:

https://support.microsoft.com/en-us/kb/322756

(Applies to Windows 10)

For more information regarding BitLocker, you may refer the article "BitLocker Frequently Asked Questions (FAQ)" from this link:

http://technet.microsoft.com/en-us/library/hh831507.aspx

Hope the information helps. Please let us know if the issue persist and we will be happy to assist you further.