Unsolved
2 Posts
0
1172
October 12th, 2020 15:00
Device encryption disabled and can't enable
Hello,
I recently had an issue with my Inspiron 15 7579 which culminated in the LED diagnostic indicators flashing that I had invalid memory installed. I reseated the memory and that seems to have solved the issues I was having with performance, but after this fix I was being prompted for my BitLocker Recovery key at every startup.
I followed the steps at this link to no avail: https://www.dell.com/support/article/en-us/sln304584/bitlocker-asks-for-a-recovery-key-every-boot-on-usb-c-thunderbolt-systems-when-docked-or-undocked?lang=en (with the caveat that I could not find any setting to "Disable USB Type-C or Thunderbolt 3 (and PCIe behind TBT) Pre-boot" in my BIOS menu).
I finally ended up suspending my encryption by typing "manage-bde -protectors -disable c:" in my command prompt as an administrator. I intended to enable the protectors again but when I run that command I get an error that no TPM is found on my device, which makes sense as Inspiron's don't have one. However, now I'm stuck with my encryption suspended and can't figure out how to resume it.
Any help is appreciated! Thanks!
0 events found


jphughan
11 Legend
•
14K Posts
•
79.9K Points
0
October 13th, 2020 07:00
@stachio The combination of things you're describing don't add up. If you got a Recovery Key prompt after a hardware change, that would have been because the TPM's "platform integrity check" failed and the TPM therefore refused to release the key in case the hardware change was part of a security breach. But you're saying you don't have a TPM. However, I question that statement, since Inspirons have had TPMs for years now, at least in regions where TPMs are allowed by law. And if you enabled BitLocker without having to first specifically enable plain password-based unlocking and you don't have to enter a password at every boot, then you have a TPM, because Windows by default won't enable BitLocker on an OS partition when the system doesn't have a TPM, and the TPM is where the decryption key lives. How else did you think your drive was being unlocked at each startup without any input from you?
But even setting that aside, a Recovery Key prompt triggered by a hardware change should have only prompted for a Recovery Key the FIRST time afterward. After you provided the Recovery Key, the system should have "re-sealed" to the new configuration and trusted it going forward, not prompted you at every boot. The only reason you should end up seeing a Recovery Key at every startup would be if the TPM was cleared or was somehow rendered non-functional.
On top of that, suspending BitLocker will bypass the Recovery Key prompt, but only for as long as BitLocker remains suspended. I'm not sure why you can't re-enable BitLocker at this point, but even if you could, you wouldn't have solved the problem by just temporarily suspending BitLocker. You'd just end up with the Recovery Key prompt again after BitLocker was no longer suspended.
It sounds like your TPM and/or BitLocker protectors are screwed up somehow. You could try fixing the latter by deleting and re-adding the appropriate protectors (there are manage-bde commands for that) or just completely disabling and then re-enabling BitLocker if you don't feel comfortable modifying protectors directly, since doing that incorrectly could potentially leave you with no way to unlock/decrypt the drive at all. If you want to see your current protectors, you can enter "manage-bde -protectors -get C:". If you find you have a TPM protector after all, you could try deleting and re-adding one, which will re-initialize the TPM with the new key. If the TPM was cleared, then that should resolve the issue. If on the other hand you see an error about a missing TPM trying to do that, then it seems you have a TPM problem, which would explain the constant Recovery Key prompt and the inability to get BitLocker working normally again. At that point, you'd either have to solve your TPM problem or configure BitLocker to allow password-based protectors on OS partitions, and then enable BitLocker that way.
stachio
2 Posts
0
October 13th, 2020 13:00
Thanks for your reply. I got most of this information from trying to figure out the problem myself so sorry if some is incorrect. I am not an expert in these systems.
Running that manage command does seem to show a TPM. I'll try to look up how to delete and re-add one.
cess0227
1 Message
0
October 25th, 2021 07:00
Hi I have the same exact problem after replacing my keyboard. I have to type in recovery key every startup too. And I did the exact same thing by using this command "manage-bde -protectors -disable c:" and I can't seem to enable it again. It shows that my computer does not have TPM (I am using Dell Inspiron 15 7570).
Please let me know if you have found the solution. Thank you.