This article shows you how to troubleshoot issues that can occur with the 探花大神 Windows BitLocker Policy.
- See Create a BitLocker Policy for Windows Devices to learn how to configure BitLocker using 探花大神.
- See Diagnose BitLocker Issues Using PowerShell to learn how to collect device information for troubleshooting.
探花大神 only stores one Recovery Key. When the extra keys are cleared, the BitLocker policy can be applied successfully. Until the Recovery Key appears in the Admin Portal, it is a good idea to back up your Recovery Key. Not properly backing up Recovery Keys may result in potential data loss. Proceed with caution.
If your BitLocker policy returns an error similar to {"state": "FAILED", "detail": "Bitlocker Protected - More than one numerical password currently set. This configuration is not supported, please ensure that the system only has one or no numerical password in place."}:
Cause
The device has multiple Recovery Keys set. This policy is failing because 探花大神 can't determine which key is ours, and can鈥檛 rotate the key properly until an admin clears the extras.
Resolution
To remove extra BitLocker Recovery Keys from a device that has its disk fully encrypted:
- On the Windows device, open a command prompt, running it as an administrator.
- Run the following command: manage-bde.exe -protectors c: -get.
- Run manage-bde.exe -protectors c: -delete -id {ID} to remove the extra numerical password.
If your BitLocker policy returns a 鈥淭PM Ownership has not been established鈥 error, follow these steps:
- On your device, open PowerShell as an administrator and enter execute Get-Tpm into the prompt.
- In the results, verify that TpmOwned and AutoProvisioning are set to False/Disabled.
- Enter Execute Enable-TpmAutoProvisioning in the prompt.
- Reboot your device.
- Repeat step 1 and verify that TpmOwned and AutoProvisioning are now set to True/Enabled. In the event this doesn鈥檛 occur, follow the steps in the procedure below.
If your BitLocker policy returns a 鈥淭PM is not ready to be used on this device鈥 error, follow these steps:
- Open the Run window on your device by pressing the Windows + R keys simultaneously.
- Enter tpm.msc into the Run window.
- Verify that the status displays The TPM is not ready for use.
- From the Actions menu on the Run window, select Prepare TPM.
- Using the prompt that appears, restart your device.
If your device recommends clearing the TPM, this could result in data loss. If you need to reset TPM, follow .
- After you restart your device, you may be prompted on the boot screen to accept changes to the TPM state. Verify these changes and accept.
- Repeat steps 1 and 2 and verify that the TPM status displays The TPM is ready for use.
BitLocker encryption was applied via the portal, and devices showed successful encryption. However, the Bitlocker policy results show this message: 鈥淐: Volume does not have Tpm Key Protector. Non-OS volumes will not be encrypted鈥
Cause
An additional authentication method was enabled on the systems through GPO.
Resolution
Follow these steps to resolve the issue:
- From Start menu, press the Windows logo key on the keyboard.
- Type gpedit.msc command and press Enter.
- On the Local Group Policy Editor window, follow the path:
Computer Configuration > Administrative Templates > Windows Components > Bit Locker Drive Encryption
. - Select Operating System Devices.
- On the right pane, double-click Require additional authentication at startup.
- Select the Disabled radio button.
- Ensure the Allow BitLocker without a compatible TPM checkbox in the Options section is unchecked.
- Once done, click OK to allow the changes to take effect and close the Local Group Policy Editor window.
Symptoms
- In the Admin Portal, the BitLocker policy results show the following error:
鈥漎ou cannot call a method on a null-valued expression鈥 - Runing
manage-bde -Status
in a Command Prompt on the device returns the following error:
PS C:\WINDOWS\system32> manage-bde -Status
BitLocker Drive Encryption: Configuration Tool version 10.0.19041
Copyright (C) 2013 Microsoft Corporation. All rights reserved.
ERROR: An error occurred (code 0x8004100e): Invalid namespace
Cause
The "Invalid Namespace" error typically indicates an issue with Windows Management Instrumentation (WMI) on the device. This occurs if the namespace that the policy or script is attempting to access is missing, corrupt, or unavailable.
Resolution
If the BitLocker Recovery Key is visible in the Admin Portal, back it up and unbind the device from the policy before proceeding to prevent potential data loss.
To rebuild the WMI Repository:
- On the affected device, open Command Prompt as an Administrator.
- Run the following command:
net stop winmgmt
- If prompted to stop dependent services, press Y and Enter.
- Run the following commands to reset the WMI repository:
winmgmt /resetrepository
net start winmgmt
- Restart the device and rebind the BitLocker policy to it.