Unable to Enable Bitlocker with TPM

I'm having problems initializing BitLocker on Windows 7 Enterprise X64 on some Dell Latitude Laptops (Broadcom TPM 1.2).
I'm using the build in Windows drivers as recommended and the latest BIOS version from Dell.
I can initialize the TPM/set the owner password but Bitlocker always throws this error at the Initializing Drive section:
Access Denied
I though that maybe I had configured group policy incorrectly so I've rebuild one of the laptops off the domain/left all the default settings but I still have this issue.
I can encrypt external drivers on the same laptop when not using TPM.
Is there any way to proceed from here/does BitLocker log anywhere else?
Many thanks.

Hi,
To troubleshoot the issue, please perform the following steps.
1. Modify the “Choose how BitLocker-protected operating system drives can be recovered” policy is disabled. You can locate the policy under the following
path.
Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives
2. Assure the current user profile has administrator privilege to turn on BitLocker and modify group policy. If the issue persists, please create a new admin user
account for a test.
3. If the machine is built by SCCM, please refer to the following article:
Access
Denied Error 0x80070005 message when initializing TPM for Bitlocker
Thanks,
Novak

Similar Messages

Bitlocker with TPM and PIN testing?

Good day all,
We are about to deploy 10 Surface Pro 3's running Windows 8.1 Enterprise x64. We have enabled the TPM, enabled "Allow Enhanced PINS for Startup", "Pre-boot Keyboard" and turned on Bitlocker through the gui which recommended setting
a PIN which I did.
Everything seems to work as it should, how can I be convinced TPM and PIN are working together? I seem to be able to punch into Bitlocker many bad passwords without warning or asking me to reboot which is does for all other laptops without tpm.
1. How many bad password attempts do I get with TPM by default before lockout?
2. Where is my *.tpm recovery key?
3. Why when the TPM locks out can I still gain entry by typing in the Bitlocker PIN (not recovery password)
4. I want TPM to lockout after 5 incorrect attempts.
To test the TPM working I disabled the TPM in the BIOS and on next reboot Bitlocker asked for the Recovery Password which to me proves Bitlocker private encryption keys are safely held in the TPM. Is this safe to presume TPM is working?
here is the output from manage-bde and get-tpm status
   Size:                 59.11 GB
    BitLocker Version:    2.0
    Conversion Status:    Fully Encrypted
    Percentage Encrypted: 100.0%
    Encryption Method:    AES 128
    Protection Status:    Protection On
    Lock Status:          Unlocked
    Identification Field: Unknown
    Key Protectors:
        TPM And PIN
        Numerical Password
TpmPresent          : True
TpmReady            : True
ManufacturerId      : 1229346816
ManufacturerVersion : 5.0
ManagedAuthLevel    : Full
OwnerAuth           : u2uAKH0Sr+d98s+oGXLLU8DHUuc=
OwnerClearDisabled : True
AutoProvisioning    : Enabled
LockedOut           : False
SelfTest            : {}

Hi Paddy,
"1. How many bad password attempts do I get with TPM by default before lockout?"
It depends on the the TPM chips.
"Some TPM chips may not store failed attempts over time. Other TPM chips may store every failed attempt indefinitely. Therefore, some users may experience increasingly longer delays when they mistype an authorization value that is sent to the TPM"
"4.I want TPM to lockout after 5 incorrect attempts."
We can set the group policy "Standard User Individual Lockout Threshold " in this path (Check the detailed information of this policy):
Computer Configuration\Administrative Templates\System\Trusted Platform Module Services\
Here is a link for reference("About TPM lockout" part and "Use Group Policy to manage TPM lockout settings"part ):
Manage TPM Lockout
https://technet.microsoft.com/en-us/library/dn466535.aspx
"2. Where is my *.tpm recovery key?"
When we set owner of the TPM ,we will be given a chance to save the TPM passowrd .
And when the BitLocker recovery key is saved to a file, BitLocker also saves a TPM owner password file (.tpm) with the TPM owner password hash value.We also can save them to the AD (Check the group policy in the same path as before). Have you tried to save
the recovery keys to a external media ?
Here are links for reference:
Reset the TPM Lockout (Check the first part)
https://technet.microsoft.com/en-us/library/dd851452.aspx?f=255&MSPPError=-2147217396
Windows Trusted Platform Module Management Step-by-Step Guide(Check "Step 2: Set ownership of the TPM" part )
https://technet.microsoft.com/pt-pt/library/cc749022%28WS.10%29.aspx?f=255&MSPPError=-2147217396
"3. Why when the TPM locks out can I still gain entry by typing in the Bitlocker PIN (not recovery password)"
When the TPM is locked out, it is also possible that the user will enter the correct PIN, but the TPM will respond as if the incorrect PIN was entered for a period of time.
Check the "When should I reset the TPM lockout" part .
Reset the TPM Lockout
https://technet.microsoft.com/en-us/library/dd851452.aspx?f=255&MSPPError=-2147217396
" Is this safe to presume TPM is working?"
From the output of the command line ,we can get the information that the TPM is working .It is not recommended to disable the TPM when the data is encrypted with TPM .
Best regards

Windows 10 - wont enable bitlocker with AD but Windows 8 does

Have you tried a clean install of 10 after the upgrade? I wonder if it's a 10 issue or just related to the in-place upgrade.

Ok, 2008 R2 domain.
Windows 8 systems, via GPO have it set that if they dont have a TPM, bitlocker still works. Password ID is configured to be stored in AD - works ( triple tested it just now)
If I upgrade a Windows 8 system to Windows 10 that was never bitlockered, I cannot enable bitlocker, get error "there is no such object on the server" but it works for Windows 8 systems
Any ideas?
This topic first appeared in the Spiceworks Community

Unable to Enable BitLocker

Hi There,
While enabling the BitLocker I am getting the error "The path specified in the Boot Configuration Data (BCD) for a BitLOcker Drive Encryption integrity-protected
application is incorrect. Please verify and correct your BCD settings and try again." When I checked bcdedit I got the below result. Can anyone tell me where is the issue in BCDEDIT?
C:\Windows\System32>bcdedit
Windows Boot Manager
identifier {bootmgr}
device partition=\Device\HarddiskVolume2
description Windows Boot Manager
locale en-US
inherit {globalsettings}
default {current}
resumeobject {0f393114-b477-11e3-a4be-a5bcb0cd3c7b}
displayorder {current}
toolsdisplayorder {memdiag}
timeout 30
Windows Boot Loader
identifier {current}
device partition=C:
path \Windows\system32\winload.exe
description Windows Embedded Standard
locale en-US
inherit {bootloadersettings}
osdevice partition=C:
systemroot \Windows
resumeobject {0f393114-b477-11e3-a4be-a5bcb0cd3c7b}
nx OptIn
bootux Disabled
Thanks -
souravdgupta
Born to Learn

Hi,
This problem occurs if one of the following entries in the Boot Configuration Data (BCD) store points to the incorrect partition:
Windows Boot Manager
Windows Memory Tester
Resume from Hibernate
To resolve this problem, edit the following BCD entries as the article referred to.
http://support.microsoft.com/kb/929834
Andy Altmann
TechNet Community Support

Pre-provision bitlocker during OSD with a Windows 7 Enterprise image fails at Enable Bitlocker - SCCM 2012 SP1 beta

I'm trying the SP1 feature to pre-provision bitlocker during OSD, using an MDT integrated task sequence. It seems like the pre-provision part is working, but when the task sequence tries to enable bitlocker after installing the
OS, it fails. ZTIBDE.log contains the following:
Property UDI is now = ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
Microsoft Deployment Toolkit version: 6.1.2373.0 ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
The task sequencer log is located at C:\WINDOWS\CCM\Logs\SMSTSLog\SMSTS.LOG. For task sequence failures, please consult this log. ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
System drive is: C: ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
The deployment method is using ConfigMgr. ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
Property BdeInstallSuppress is now = NO ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
This script is not currently running in Windows PE ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
We are running a OS that supports BitLocker ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
OSDBitLockerTargetDrive= , OSDBdeTargetDriveLetter= , sOSDBitLockerTargetDrive= C: ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
This is a Refresh Build where BDE protectors were disabled. ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
OS Version is Windows 7 or higher. ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
Encryptable Volume Count:1 ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
Attempting to bind to: C: ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
Success setting oBdeVol ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
BDE Instance Bind Complete ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
Attempting to enable BDE Protectors ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
FAILURE ( 6767 ): -2144272377 0x80310007: Enable BDE Protectors ZTIBde 11/14/2012 5:04:42 PM 0 (0x0000)
This laptop is in an OU with bitlocker related settings applied via GPO, including allowing enhanced PINs, requiring backup of the recovery passwords and key packages to AD, and to require TPM+PIN for the startup authentication.
Bitlocker provisioning is working on my production server using only MDT (No SCCM), with a task sequence deploying Windows 7. I copied some of the variables from the customsettings.ini over to a collection variable in SCCM for
the collection I'm testing deployment to. Putting those same variables in collection variables should work the same as if they were in the custom settings, but only for members of that collection, right?
The variables set in the collection variables area are
BDEInstall - TPMPIN
BDEInstallSuppress - NO
BDEPin - SET
BDERecoveryKey - AD
BDERecoveryPassword - TRUE
TPMOwnerPassword - SET
OSDBitlockerMode - TPMPin (This one wasn't copied from the other MDT share, but added just for sccm.
I didn't copy the BDEWaitforEncryption variable, it didn't seem like that one would be necessary with the pre-provisioning. What am I doing wrong here?

If not you could add a set variable action to your task sequence after the UDI wizard to set OSDBitLockerPIN to %BDEPin%. You could add a condition to the action to only run if BDEPin exists.
I don´t quite fallow, how I can switch these variables between. I admit I some time have difficulties to understand the variables. Could you mark discribe me the settings of set variable step I have to enter. Thanks!
With Confmgr step Enable Bitlocker I have another issue - it does not allow to to enter pin code with letters.
No problem :-). There is a task sequence action called "set task sequence variable". Just add one of these actions to the task sequence after the UDI wizard. There are only two things you have to configure in the action, the variable you want to set
and the value you want to set that variable to. The UDI wizard will create the variable BDEPin with a value equal to the PIN you enter in the UDI wizard page. So in your "set task sequence variable" action enter the variable name as OSDBitlockerPIN
and the value as %BDEPin%. This action will then create the OSDBitlockerPIN variable with the value that was stored in BDEPin by the UDI wizard. The built in SCCM action will then use this as the PIN rather than whatever value is configured in the task sequence
editor.
However the best solution would probably be to get the UDI wizard to set OSDBitlockerPIN rather than BDEPin in the first place. I think you can do this in the UDI wizard editor or directly in the XML. I don't use the editor these days so can't recall offhand.
I will take a look at this next week.
Most of the task sequence actions support variables and it enables you to configure the action dynamically at runtime. For example the same sequence can be used to deploy systems into different domains, languages, applications etc. all by setting variables.
It's the basis of how the UDI wizard works, it just sets variables which are then consumed by either MDT scripts or task sequence actions. The variables can be configured by UDI, collections, MDT customsettings.ini, MDT database or scripts. Dynamic deployment
is definitely the way to go :-).
I think you are correct about the built-in action not supporting enhanced PIN. I think it only supports standard numeric PIN. Whether setting the PIN via the variable works around a restriction in the task sequence editor I am not sure, I suspect not.
Mark.

Deploy Lenovo with SCCM and enable Bitlocker during deploying?

Hi!
Do anyone got information how to activate TPM and enable bitlocker during deploy of new Lenovo with SCCM ?
Something like this but for Leonovo
http://www.nullsession.com/2010/12/02/enable-tpm-in-task-sequence-with-sccm-and-cctk/
Thanks, Magnus
Solved!
Go to Solution.

jamessnarey wrote:
has anyone been successful with the WMI script on the M92p models, I recently attempted to activate the TPM using the same script that we use for our M91p and it fails. When I check the logs, it states that access is denied, when I run it manually I get the same error (access denied). Our lenovo rep says that you cannot use the WMI to enable the TPM and that the Enable Bitlocker step should enable the TPM. However we automate our OS deployments so manually enabling bitlocker is not an option, any assistance or feedback is appreciated.
I was having the same issue and I discovered another way to accomplish this task. Download this utility:
http://download.lenovo.com/ibmdl/pub/pc/pccbbs/thinkcentre_bios/9sjw67usa.exe
Run the EXE to extract the files to the location of your choice, then copy them to your script location. From your script, run the following command:
srwin.exe /tpm active
Then do a couple reboots (this may not be necessary, but I didn't have time to test it.)
There are a couple of caveats. First, the working directory must be the directory the utility is stored in (presumably so it can find the two .sys files). I.e. you can't do
c:\utilities\srwin.exe /tpm active
you have to do
cd /D c:\utilities
srwin.exe /tpm active
Also, I was attempting to run this in a WinPE session (doing OS deployment using SCCM 2012) and I was getting an 0x80070134 error in my logs. I had been using an x64 boot image, and switching to an x86 boot image resolved that issue.
Hope this helps someone.

How to enable bitlocker on Tecra M5 with Windows 7

Hi!
Can anybody help me to enable bitlocker on M5 with Win7?
I also think an BIOS update is nessessary but the version I downloaded from Toshiba (3.70) doesnt work on the M5. "This computer is not supported"
please, help me
Tanks, bye

As far as I know this issue is not related to Toshiba but to preinstalled OS version so for more info contact Microsoft.
Which Win7 version you have installed on your Tecra notebook?

Questions about using Bitlocker without TPM

We currently use Bitlocker to encrypt our Windows 7 computers with TPM. Now we are looking at encrypting some Windows 7 computers without a TPM. I see how to change the group policy setting to allow Bitlocker without a TPM. I have looked at a lot of other
threads and I have a few questions about how the Bitlocker without TPM works.
1) I see a USB drive containing a key is required for Bitlocker configurations without a TPM, say the end user loses this USB drive, what are the recovery options for their computer?
This article seems to indicate that without the USB drive connected, you are unable to even access recovery options http://blogs.technet.com/b/hugofe/archive/2010/10/29/bitlocker-without-tpm.aspx
We have recovery backed up to AD when Bitlocker is enabled, but how could we do this recovery on a computer on computer where it's USB is lost? Would we have to remove the HD itself and attach it to another computer to access?
2) After enabling Bitlocker on a computer without a TPM and using the USB Drive for the key, is there a way to also add a PIN or password protection at bootup?

Hi,
Sorry for my dilatory reply,
Configuring a startup key is another method to enable a higher level of security with the TPM. The startup key is a key stored on a USB flash drive, and the USB flash drive must be inserted every time the computer starts. The startup key is used to provide
another factor of authentication in conjunction with TPM authentication. To use a USB flash drive as a startup key, the USB flash drive must be formatted by using the NTFS, FAT, or FAT32 file system.
You must have a startup key to use BitLocker on a non-TPM computer.
From: http://technet.microsoft.com/de-de/library/ee449438(v=ws.10).aspx#BKMK_Key
For more Q&A about BitLocker, you can refer to the link above.
hope this is helpful.
Roger Lu
TechNet Community Support

Windows 8.1 Pro Bitlocker with HP Envy 700

I just got a new HP Envy 700-249. I upgraded to Windows 8.1 Pro immediately for Bitlocker and Remote Access. The PC will be stored in a relatively unsecure location and is for public use - but will have a few users who have access to install software, store private files, etc. SO I want to be sure that the OS stays safe as well as the data.
I want a way to keep someone from accessing anything on C drive that isn't in the Public folders and make the drive unable to be viewed if booted from anything other than itself. So I figured BitLocker. I've gone into gpedit.msc and set option to allow bitlocker without TPM. BitLocker runs and allows me to turn on encryption. I've tried a couple of types of USB drives and BitLocker says it has saved the key to them. I've checked and they have a BitLocker recovery file on them.
BUT - when the system reboots, it will not recognize the USB drive as the key and will not encrypt the drive. I am stumped.
Has anyone gotten an HP non-TPM desktop to encrypt the OS and data drives with Win 8.1 Bitlocker? How?????

Hi,
Bit locker was meant to encrypt entire physical drives. Review this MS article.
I would suggest that you install a second hard drive and then move your sensitive files and documents to that physical hard drive and use bit locker to encrypt that hard drive. If you are going to keep the key on an external device (USB flash drive) then make a backup copy in case the USB drive fails or is lost.
HP DV9700, t9300, Nvidia 8600, 4GB, Crucial C300 128GB SSD
HP Photosmart Premium C309G, HP Photosmart 6520
HP Touchpad, HP Chromebook 11
Custom i7-4770k,Z-87, 8GB, Vertex 3 SSD, Samsung EVO SSD, Corsair HX650,GTX 760
Custom i7-4790k,Z-97, 16GB, Vertex 3 SSD, Plextor M.2 SSD, Samsung EVO SSD, Corsair HX650, GTX 660TI
Windows 7/8 UEFI/Legacy mode, MBR/GPT

Enabling BitLocker makes BIOS POST very slow

With BitLocker enabled using the TPM of my Thinkpad X61T the BIOS POST time increases for 1 to 17 sec.
After the BIOS POST Win7 takes 15 Sec to start. So enabling BitLocker doubles my boot time.
Is this long boot time the expected behaviour with BitLocker and Thinkpads, or can it be omitted?
The positive: Windows itself does not feel slower with BitLocker encryption. HDTUNE does not measure a slowdown.
X61T, Bios 1.2.2, Window 7 Beta x64, 1400x1050, 4GB RAM, 1GB Turbo Memory, Intel X25-M SSD

Updating to BIOS 1.23 released 2009/04/27 did not help.
Installing Intel Matrix Storage driver 8.9.2.1002 released 2009/10/02 (offerd by the Win7 compatible version of System Update) did not help.
Is Lenovo planning to fix this problem?
X61T, Bios 1.2.3, Window 7 Final, 1400x1050, 4GB RAM, 1GB Turbo Memory (disabled), Intel X25-M SSD

Bitlocker with PIN and can't encrypt second drive

I have my OS drive encrypted, and have a boot PIN. All is well. I'm trying to encrypt the data drive in my laptop, and I'm getting a prompt
"The Group Policy settings for BitLocker startup options are in conflict and cannont be applied". The options are configured as this:
Configure TPM startup: Allow TPM
Configure TPM startup PIN: Allow startup PIN with TPM
Configure TPM startup key: Allow startup key with TPM
Configure TPM startup key and PIN: Allow startup key and PIN with TPM
I've tried setting the bottom two to not allow, but that doesn't seem to matter. I've verified that there are no domain GPOs that adjust these settings.
What am I missing?

Hi,
How did you encrypt the data drive? Which settings did you change?
For the Fixed Data Drives encryption, the group policy located here:
Computer Configuration\Windows Components\BitLocker Drive Encryption\Fixed Data Drives
It seems your operating system drive encryption group policy is correctly configured.
Use the command gpresult /h gpreport.html to export the group policy settings, check if there's any clue.
And, this is for your reference:
Best Practice for BitLocker
Regards,
Miya
TechNet Subscriber Support in forum. If you have any feedback on our support, please contact
[email protected]
Miya Yao
TechNet Community Support

Unable to enable SPDIF??? X-Fi XtremeGamer (non-PRO) w/ Digital I/O Module

JUnable to enable SPDIF? X-Fi XtremeGamer (non-PRO) w/ Digital I/O Module? I recently purchased the Digital I/O module in order to use SPDIF Out on my X-Fi XtremeGamer in order to send audio to my 5. receiver via digital coax.
However after hooking up my Digital I/O module to the flexijack (the one with the red light) I am unable to enable SPDIF.
I read and followed the directions listed here:
<a rel="nofollow" href="http://support.creative.com/kb/ShowArticle.aspx?sid=64440"]http://support.creative.com/kb/ShowArticle.aspx?sid=64440[/url]
The options that they tell you to set are simply are not there on my system.
I am running the most current drivers and console launcher that Creative has on their website.
I have been trying to get it to work both under Windows XP and Windows 7.
I have spent the last 3 hours beating my head on a wall, I hope someone can help me with this...
Thanks in advance for any suggestions!

Ah that's what I am afraid of.
Quoted from the article in your message: "For SB073X series : Supports Microphone-in, Line-in and Optical out connections. On a SB073X series card, this jack does not have the Digital-in function to support the Digital I/O Module. It does however connects to external digital audio devices that accept stereo PCM or compressed Dolby Digital/DTS Bitstream from the Optical output. This will require using a "Toslink to Mini Toslink" cable for connection only."

Provisioning BITLocker with Windows to Go via SCCM2012

Hello,
I am following this document http://technet.microsoft.com/en-us/library/jj651035.aspx to provision Windows to go via Pre-Staging.
The instructions on what to put in the pre-start command is a little wooly, as best I can make out, I am pasting this directly in in prestart command window:
dim osd: set env = CreateObject(“Microsoft.SMS.TSEnvironment”)
dim logPath
logPath = env(“_SMSTSLogPath”)
env(“OSDBitLockerPIN”) = "password"
However, the task sequence falls flat when running the Bitlocker to go package, looking at the logs I see:
Failed to find Passphrase
I am running the package after the 'Configure Windows and SCCM Agent' step; OC the machine re-boots into windows here so I am not convinced it is the right place to call the package.
Can someone who has done this before give me sa quick hand please :)

Hello, any simple explanation for this? I´m running osdbitlocker_wtg.exe during TS in OSD, and before enabling bitlocker, I import all EVE reg settings which I exported from Bitlocker Group Policies. With those Group Polices, I´m able to enable bitlocker
manually on a desktop on a WTG USB stick.

Unable to enable routing in 3750x switch

im unable to enable ip routing in the WS-C3750X-24T-L switch. Tried with SDM prefer routing option but still same issue.
Can some suggest on this?
MOdel: WS-C3750X-24T-L
IOS :flash:c3750e-ipbasek9-mz.122-55.SE5.bin
sh license
Index 1 Feature: ipservices
        Period left: 0 minute 0 second
Index 2 Feature: ipbase
        Period left: 0 minute 0 second
Index 3 Feature: lanbase
        Period left: Life time
        License Type: Permanent
        License State: Active, In Use
        License Priority: Medium
        License Count: Non-Counted
regards,
Ezra.

Index 3 Feature: lanbase        Period left: Life time        License Type: Permanent        License State: Active, In Use
You don't have the license to run routing.

Unable to initialize BitLocker on 7 Enterprise w/USB drive

I have seen documentation that says you can use BitLocker with Windows 7 Enterprise with either the TPM Chip OR a USB drive. I have laptops running Windows 7 Ent and when I try to initialize BitLocker, it fails at the first screen. There is no TPM chip on
the system. I have run into this problem regardless if the system is part of the domain or a workgroup before joining the domain. How do I troubleshoot this so I can recover from the error?

Hi,
Could you please have a share with the full error messages that you received?
Besides, regarding BitLocker usage for Windows 7, here is a step by step guide:
BitLocker Drive Encryption Step-by-Step Guide for Windows 7
In addition, here is the FAQ of BitLocker in Windows 7, see:
BitLocker Drive Encryption in Windows 7: Frequently Asked Questions
And more questions, please feel free to ask.
Best regards
Michael Shao
TechNet Community Support

Unable to Enable Bitlocker with TPM

Similar Messages

Maybe you are looking for