My laptop xps13 got a BIos software update by Dell yesterday. On restart my laptop was Bitlocked. I desperately need to get my laptop up and running again. Please help
@Wolraad Newer versions of Dell Update default to suspending BitLocker when you choose to install a BIOS update, specifically to avoid this situation. Maybe you're running an outdated version or unchecked that option? In any case, what's happening here is that normally, the TPM releases the decryption key for BitLocker -- but it will only do that after a successful "platform integrity check" that verifies that certain hardware and firmware aspects of the environment have not changed since the trusted state that the key was "sealed" against, since some changes could be part of an attempt to compromise the key when the TPM releases it. On some systems, a BIOS version change counts as a change that breaks that platform integrity check. At that point, the TPM won't release the key, and you're prompted for the Recovery Key instead. If you enter it, the TPM re-seals to the new state. (Alternatively, if BitLocker is suspended at the time of the change that normally would cause the platform integrity check to fail, then the TPM reseals against the new state automatically and you don't have to deal with a Recovery Key prompt.)
So ideally you'd have the key backed up somewhere, possibly in the cloud under some Microsoft account you've used with that laptop. If you can't find that, then the only other way to solve this would be to use the BIOS update utility built into the firmware to revert to whatever BIOS version you were previously running, which will return the system to its trusted state and allow the TPM to release the key -- assuming you haven't gone ahead and cleared the TPM to try to troubleshoot this, in which case the key will be gone. To use the built-in BIOS update utility, press F12 during startup and choose "BIOS Flash Utility" in the one-time boot menu. That will take you to an interface where you can specify a flash drive that contains a BIOS update EXE file. You can find those files on the Dell Support site. Enter your model or Service Tag, go to the Downloads section, and search BIOS. Click the appropriate search result and select "View older versions". If you don't remember which version you were running before, you'll have to try a few. But download those EXEs and put them on the flash drive to use with the utility.
And whenever you get out of the woods, back up your BitLocker Recovery Key. There are times you will need it and won't have another option like this, such as after a motherboard replacement where you'll have a new TPM that won't have the decryption key anymore. That is another situation that has caught several people out.
Hello Jphughan. Man you make my day, my month, my year. I thought my life came to an end when I could not access my laptop. Your professionalism and eloquence and detailed description was so well done. I want to thank you profusely. If you ever come to Cape Town, South Africa please look me up. It will be an honour to thank you in person.
May the Universe bless you abundantly and exponentially.
@Wolraad Glad to hear you're ok again, and thanks for the kind words! But given that you had such a close call, I have some recommendations for you:
Update to the latest release of Dell Update, which I believe is 4.0 or slightly higher. It should automatically suspend BitLocker for future BIOS updates.
Back up your Recovery Key to some location that you would be able to access even if your laptop was unusable.
If you weren't already doing this, start backing up your data on a regular basis. You may even want to consider making periodic image backups so that you can always restore your entire OS and application environment quickly, as opposed to only having backups of your personal data. There are several applications that can do this. Macrium Reflect is a popular choice, and even its Free version has sufficient functionality for making occasional image backups if you would be backing up your personal data more regularly using another solution. That way even if your entire system becomes unbootable for some reason, you have a quick way to get back to a working state.
jphughan
11 Legend
•
13985 Posts
•
79931 Points
8909
0
Posted August 17th, 2021 12:00
@Wolraad Newer versions of Dell Update default to suspending BitLocker when you choose to install a BIOS update, specifically to avoid this situation. Maybe you're running an outdated version or unchecked that option? In any case, what's happening here is that normally, the TPM releases the decryption key for BitLocker -- but it will only do that after a successful "platform integrity check" that verifies that certain hardware and firmware aspects of the environment have not changed since the trusted state that the key was "sealed" against, since some changes could be part of an attempt to compromise the key when the TPM releases it. On some systems, a BIOS version change counts as a change that breaks that platform integrity check. At that point, the TPM won't release the key, and you're prompted for the Recovery Key instead. If you enter it, the TPM re-seals to the new state. (Alternatively, if BitLocker is suspended at the time of the change that normally would cause the platform integrity check to fail, then the TPM reseals against the new state automatically and you don't have to deal with a Recovery Key prompt.)
So ideally you'd have the key backed up somewhere, possibly in the cloud under some Microsoft account you've used with that laptop. If you can't find that, then the only other way to solve this would be to use the BIOS update utility built into the firmware to revert to whatever BIOS version you were previously running, which will return the system to its trusted state and allow the TPM to release the key -- assuming you haven't gone ahead and cleared the TPM to try to troubleshoot this, in which case the key will be gone. To use the built-in BIOS update utility, press F12 during startup and choose "BIOS Flash Utility" in the one-time boot menu. That will take you to an interface where you can specify a flash drive that contains a BIOS update EXE file. You can find those files on the Dell Support site. Enter your model or Service Tag, go to the Downloads section, and search BIOS. Click the appropriate search result and select "View older versions". If you don't remember which version you were running before, you'll have to try a few. But download those EXEs and put them on the flash drive to use with the utility.
And whenever you get out of the woods, back up your BitLocker Recovery Key. There are times you will need it and won't have another option like this, such as after a motherboard replacement where you'll have a new TPM that won't have the decryption key anymore. That is another situation that has caught several people out.