Unsolved
This post is more than 5 years old
1 Message
0
6456
Dell XPS 15 BIOS Upgrade - Reboot asking for Bitlocker Recovery Key
I have a Dell XPS 15 9550, and after a recent BIOS upgrade, it seems to have lost the PIN, and is asking me to enter a BitLocker recovery key, which so far at least, I've been unable to find. So does anyone know how to:
- Reenter the PIN so that the system boots normally (TPM/UEFI/etc.)?
- If that is not possible, re-install Windows 10?
The system was upgraded right after purchase from Windows 10 Home to Pro, otherwise is pretty stock.
When I go through the various recovery options to Troubleshoot:
- Reset this PC: It asks again for the recovery key (which I do not have)
- Advanced > System Restore: Same (recovery key which I do not have)
I realize that the without the Bitlocker recovery key, that the data may be all lost, but what I would like to do is get the system running again, at least to the point I can re-install Windows. I have the PIN of course, but cannot seem to get to the point where the system prompts for it, it is stuck on the Bitlocker key, which I cannot find.
Suggestions?
jphughan
4 Operator
4 Operator
•
14K Posts
0
August 30th, 2017 08:00
And just as a note for future reference, if you choose to Suspend BitLocker (not completely disable it) immediately before running a BIOS update, you won't have to deal with that prompt, since suspending BitLocker temporarily writes the key in the clear on the drive, and then the TPM will automatically "reseal" against the new hardware environment. For the life of me I don't know why Dell BIOS updates don't offer to do that automatically when they detect that BitLocker is being used, but they don't.
Other great reasons to back up your Recovery Key are if you ever need to recover data from that drive outside the system or if you get a motherboard replacement, since in either of those cases you won't have the TPM to release the key at all.
jphughan
4 Operator
4 Operator
•
14K Posts
0
August 30th, 2017 08:00
The TPM hasn't lost the key. The reason you're seeing this prompt is because the TPM performs a platform integrity check to make sure that no key hardware in the system has changed, since such changes could be part of an attempt to get the TPM to release its decryption key under inappropriate circumstances. A BIOS update constitutes a change to a key portion of your hardware, since for example someone might attempt a BIOS downgrade in order to reintroduce a security vulnerability. That's why it's asking for the entire Recovery Key (which can be used to decrypt the drive) rather than just the PIN, which relies on the TPM to still release its key.
If you didn't back up your Recovery Key though, you are completely stuck. If this system is joined to an Active Directory domain, it's possible that the domain admin configured Recovery Keys to be backed up to Active Directory. Otherwise, when you first set up BitLocker, you are prompted to either print it, store it as a text file (which Windows specifically does not allow you to save to the drive being encrypted, for this reason) or save it to your Microsoft account. If you can't find your Recovery Key in any of those places, then there is no recovery mechanism, which is by design. I personally choose to print mine to PDF and then copy/paste the key into a Secure Note in my LastPass vault so that I can access that information from my phone.
Saltgrass
3 Apprentice
3 Apprentice
•
4.3K Posts
0
August 30th, 2017 08:00
I have been asked for a BitLocker key under some circumstances. It may depend on your system and what processor it is using but my keys were in my Microsoft Account. I went there, and I was told where to look, and copied and pasted the key and it decrypted the drive.
jphughan
4 Operator
4 Operator
•
14K Posts
0
August 30th, 2017 08:00
If you want to reinstall Windows 10, then first download the installer from Microsoft here: www.microsoft.com/.../windows10
From there, create USB installation media and boot from it -- make sure you choose to boot the flash drive in UEFI mode! When Windows Setup appears, I usually like to clean the entire disk, but if you have other partitions that you wish to preserve, that's technically not necessary. I'll cover both options below:
- To clean your whole disk and start fresh, press Shift+F10 to open Command Prompt. Then enter the following:
diskpart
list disk
select disk x (substitute the correct disk number based on the output of "list disk"; it will probably be 0)
clean
exit
exit
(Now proceed with Windows Setup and it will see a completely empty hard drive.)
- To avoid cleaning your whole hard drive because you have other partitions you want to preserve, proceed with Windows Setup, choosing a "Custom" install (not Upgrade), then when you get to the prompt about where to install it, click Advanced and delete the EFI, MSR, Recovery, and OS partitions, all of which will be recreated by this installer. Then select the new block of unallocated space and click Next.