Windows 10: Bitlocker TPM enabled(Not enabling PIN as a protector) prompts for recovery key during the...

Starting a Windows 10 with bitlocker TPM enabled(Not enabling PIN as a protector), PC asks for a recovery key during the restart.


Behavior is random, it is not happening in all the restarts, but can say it occurs 1 of 3 restarts.

Models: Lewnovo and HP

Is there any logs that can be checked to identify the problem?
Is there any suggetions ?

:)

 

Bitlocker fails to find USB Key ONLY When TPM+PIN+STARTUPKEY are enabled

Hi

I cant enable bitlocker with TPM+PIN+Startupkey. Bitlocker asks for the USB key to be insterted on bootup.

TPM+PIN works fine, I tested it.

TPM+Startupkey works fine, I tested it.

I have ownership of my TPM and its working for EFS right now.

When I enable TPM+Startupkey+PIN, bitlocker fails to unlock at bootup, asking me to insert my USB key.

I've tried both USB 2 and 3 ports on my PC, nothing works.

I'm forced to enter a recovery password to unlock.

My group policy allows all methods of authenication, and requires use of a TPM.

The USB drive is formatted as FAT32, containing 2GB.

My system is a EUFI installation, using GPT. The USB drive is detected in BIOS, windows boots first.

My BIOS is updated too.

Latest chipset drivers are installed.

Latest USB drivers installed.

I have a Sabertooth 990fx motherboard.

Windows 10, non beta, latest updates.

Moved here:

https://social.technet.microsoft.com/Forums/en-US/65424c29-25ec-4b8d-9090-2e85ca29f9cb/bitlocker-fails-to-find-usb-key-only-when-tpmpinstartupkey-are-enabled?forum=win10itprosecurity

 

Enabling pre-boot pin with a TPM

How can I enable a pre-boot PIN with a TPM installed and the drive is BitLocked? (Windows Pro)

 

BitLocker key protector management help


Seeking BitLocker help:

Win10 machine with TPM.
OS drive was successfully encrypted with "TPM & PIN" additional key protection.
Now I'm hoping to drop back to "just TPM" with no additional PIN protection without having to decrypt and re-encrypt. (note: the reason is so that updates will reboot back to windows login and leave this base station machine accessible by Remote (RDP) but the reason is not what I want to discuss)

I haven't found how to do it yet and don't know whether to concentrate on the "manage-bde" commands or gpupdate or both to find the answer. None of the local bitlocker policies are enabled (but the machine is in an AD domain.) If I try the following:
manage-bde -protectors -delete C: -Type TPMAndPIN
(within an admin cmd prompt) I get:
"ERROR: An error occurred while deleting the key protector.
Group Policy settings require the use of a PIN at startup. Please choose this Bitlocker startup option."

Is there a way I can check what the domain admin is requiring? I forget how to check the broader group policies on Win10.
Thanks!