BitLocker believes there is FIPS enabled

Question

Hello All -
We are implementing BitLocker and for a number of reasons do not want to use FIPS.
Each time I attempt to activate, however, TPM goes just fine, then I receive a BCD error after creating the PIN which I remedy (at least it come back as successful) based on http://support.microsoft.com/kb/929834.
Following that - I get an error which stats we have FIPS enabled - and after using GPInventory to review the applied GPO's on the system and all the GPO's in our domain - with a fine tooth comb - I can find nothing.
I've attached the GPO info below (taking out any identifiables) in hopes someone has an answer.
Thanks
Rich Beach
Group Policy Management
body { font-size:68%;font-family:MS Shell Dlg; margin:0px,0px,0px,0px; border: 1px solid #666666; background:#F6F6F6; width:100%; word-break:normal; word-wrap:break-word; } .head { font-weight:bold; font-size:160%; font-family:MS
Shell Dlg; width:100%; color:#6587DC; background:#E3EAF9; border:1px solid #5582D2; padding- height:24px; } .path { margin- margin- margin-bottom:5px;width:100%; } .info { padding-width:100%; } table { font-size:100%; width:100%; border:1px solid #999999;
} th { border-bottom:1px solid #999999; text-align:left; padding- height:24px; } td { background:#FFFFFF; padding- padding-bottom:10px; padding- } .btn { width:100%; text-align:right; margin- } .hdr { font-weight:bold; border:1px solid #999999; text-align:left;
padding- padding- height:24px; margin-bottom:-1px; width:100%; } .bdy { width:100%; height:182px; display:block; background:#FFFFFF; padding- padding-bottom:10px; padding- border:1px solid #999999; } button { width:6.9em; height:2.1em; font-size:100%; font-family:MS
Shell Dlg; margin-right:15px; } @media print { .bdy { display:block; } button { display:none; } .head { color:#000000; background:#FFFFFF; border:1px solid #000000; } }
Setting Path:
Explanation
<button accesskey="P" name="Print">Print</button>
<button accesskey="C" name="Close">Close</button>
No explanation is available for this setting.
Supported On:
Not available
Group Policy Management
Generalhide
Detailsshow
Domain XXX
Owner XXX\Domain Admins
Created 6/16/2014 8:18:26 AM
Modified 6/26/2014 11:36:46 AM
User Revisions 0 (AD), 0 (sysvol)
Computer Revisions 76 (AD), 76 (sysvol)
Unique ID {XXXXX}
GPO Status Enabled
Linksshow
Location Enforced Link Status Path
Win7Laptops Yes Enabled XXXXXX/XXX-Users & Workstations/Win7Laptops
This list only includes links in the domain of the GPO.
Security Filteringhide
The settings in this GPO can only apply to the following groups, users, and computers:Name
NT AUTHORITY\Authenticated Users
Delegationshow
These groups and users have the specified permission for this GPOName Allowed Permissions Inherited
XXX\Domain Admins Edit settings, delete, modify security No
XXX\Enterprise Admins Edit settings, delete, modify security No
NT AUTHORITY\Authenticated Users Read (from Security Filtering) No
NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS Read No
NT AUTHORITY\SYSTEM Edit settings, delete, modify security No
Computer Configuration (Enabled)hide
Policieshide
Windows Settingshide
Security Settingshide
Public Key Policies/Trusted Root Certification Authoritieshide
Propertieshide
Policy Setting
Allow users to select new root certification authorities (CAs) to trust Enabled
Client computers can trust the following certificate stores Third-Party Root Certification Authorities and Enterprise Root Certification Authorities
To perform certificate-based authentication of users and computers, CAs must meet the following criteria Registered in Active Directory only
Administrative Templateshide
Policy definitions (ADMX files) retrieved from the central store.Windows Components/BitLocker Drive Encryptionhide
Policy Setting Comment
Choose drive encryption method and cipher strength Enabled  
Select the encryption method: AES 128-bit with Diffuser (default)
Policy Setting Comment
Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista) Enabled  
Important: To prevent data loss, you must have a way to recover BitLocker encryption keys. If you do not allow both recovery options below, you must enable backup of BitLocker recovery information to AD DS. Otherwise, a policy error occurs.
Configure 48-digit recovery password: Require recovery password (default)
Configure 256-bit recovery key: Do not allow recovery key
Note: If you do not allow the recovery password and require the recovery key, users cannot enable BitLocker without saving to USB.
Policy Setting Comment
Provide the unique identifiers for your organization Enabled  
BitLocker identification field: XXXXXX
Allowed BitLocker identification field: XXXXXX
Policy Setting Comment
Store BitLocker recovery information in Active Directory Domain Services(Windows Server 2008 and Windows Vista) Enabled  
Require BitLocker backup to AD DS Enabled
If selected, cannot turn on BitLocker if backup fails (recommended default).  
If not selected, can turn on BitLocker even if backup fails. Backup is not automatically retried.
Select BitLocker recovery information to store: Recovery passwords only
A recovery password is a 48-digit number that unlocks access to a BitLocker-protected drive.
A key package contains a drive's BitLocker encryption key secured by one or more recovery passwords
Key packages may help perform specialized recovery when the disk is damaged or corrupted.  
Windows Components/BitLocker Drive Encryption/Fixed Data Driveshide
Policy Setting Comment
Choose how BitLocker-protected fixed drives can be recovered Enabled  
Allow data recovery agent Enabled
Configure user storage of BitLocker recovery information:
 Allow 48-digit recovery password
 Do not allow 256-bit recovery key
Omit recovery options from the BitLocker setup wizard Disabled
Save BitLocker recovery information to AD DS for fixed data drives Enabled
Configure storage of BitLocker recovery information to AD DS: Backup recovery passwords only
Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives Enabled
Windows Components/BitLocker Drive Encryption/Operating System Driveshide
Policy Setting Comment
Choose how BitLocker-protected operating system drives can be recovered Enabled  
Allow data recovery agent Enabled
Configure user storage of BitLocker recovery information:
 Require 48-digit recovery password
 Do not allow 256-bit recovery key
Omit recovery options from the BitLocker setup wizard Disabled
Save BitLocker recovery information to AD DS for operating system drives Enabled
Configure storage of BitLocker recovery information to AD DS: Store recovery passwords only
Do not enable BitLocker until recovery information is stored to AD DS for operating system drives Enabled
Policy Setting Comment
Configure minimum PIN length for startup Enabled  
Minimum characters: 5
Policy Setting Comment
Require additional authentication at startup Enabled  
Allow BitLocker without a compatible TPM Disabled
(requires a startup key on a USB flash drive)
Settings for computers with a TPM:
Configure TPM startup: Do not allow TPM
Configure TPM startup PIN: Require startup PIN with TPM
Configure TPM startup key: Do not allow startup key with TPM
Configure TPM startup key and PIN: Do not allow startup key and PIN with TPM
Policy Setting Comment
Require additional authentication at startup (Windows Server 2008 and Windows Vista) Enabled  
Allow BitLocker without a compatible TPM Disabled
(requires a startup key on a USB flash drive)
Settings for computers with a TPM:
Configure TPM startup key: Do not allow startup key with TPM
Configure TPM startup PIN: Require startup PIN with TPM
Important: If you require the startup key, you must not allow the startup PIN.  
If you require the startup PIN, you must not allow the startup key. Otherwise, a policy error occurs.
Note: Do not allow both startup PIN and startup key options to hide the advanced page on a computer with a TPM.
Windows Components/BitLocker Drive Encryption/Removable Data Driveshide
Policy Setting Comment
Choose how BitLocker-protected removable drives can be recovered Enabled  
Allow data recovery agent Enabled
Configure user storage of BitLocker recovery information:
 Allow 48-digit recovery password
 Do not allow 256-bit recovery key
Omit recovery options from the BitLocker setup wizard Disabled
Save BitLocker recovery information to AD DS for removable data drives Enabled
Configure storage of BitLocker recovery information to AD DS: Backup recovery passwords only
Do not enable BitLocker until recovery information is stored to AD DS for removable data drives Enabled
Extra Registry Settingshide
Display names for some settings cannot be found. You might be able to resolve this issue by updating the .ADM files used by Group Policy Management.
Setting State
SOFTWARE\Policies\Microsoft\SystemCertificates\FVE\Certificates\91ED17F3BEA87845F8C4AA4ADF5B9980C76659AD\Blob Unknown data format
User Configuration (Enabled)hide
No settings defined.

Answer 1

Hi,
I never heard this problem with Bitlocker, but for your problem, what's the exactly error of BCD? It would be better to provide an screenshot for your problem.
Roger Lu
TechNet Community Support