Microsoft Surface Pro 3 computer running W10 Pro bitlocker issue

Question

Microsoft Surface Pro 3 computer running W10 Pro bitlocker issue

Break80 0

My Surface Pro 3 running W10 Pro keeps asking for bitlocker recovery key after update 2 days ago. I have manually entered the 48 characters about 20 times already. I spent 2 days following Copilot M365 instructions to try to get it working properly, which are basically what I also found googling. Nothing worked. It is a microsoft computer, operating system and bitlocker. It should work. What is going on? Right now I have suspended bitlocker but that is NOT good. Anyone know how to fix this for my old SP3 which has been running just file until I updated two days ago. I tried to roll it back but that failed. I noticed someone say you need to turn off bitlocker BEFORE updating. NOT YOU TELL ME! Do I need to have bitlocker off to roll back successfully? Sorry for all the questions, but I am frustrated by now.

0 comments

2 answers

Your answer

Answer 1

S.Sengupta 32,021 MVP Volunteer Moderator

This sounds like a BitLocker/TPM issue triggered by the recent Windows update, not a problem with your 48-digit recovery key. If the correct key works but BitLocker asks for it again after every reboot, the TPM is likely not accepting the new boot state.

You do not normally need to completely turn off/decrypt BitLocker to roll back an update. Keeping BitLocker suspended while troubleshooting is actually the safer approach.

First, check which KB update was installed two days ago and run:

manage-bde -status C:

0 comments

Answer 2

What is going on is a known Surface issue after UEFI or TPM firmware updates. On Surface Pro 3, BitLocker can keep prompting for the recovery key after firmware changes if the device is using PCR values other than the default PCR 7 and PCR 11. Common reasons are Secure Boot being off or PCR values being explicitly configured by Group Policy. In that state, entering the correct 48-digit key may still not let Windows start normally, and the device can loop, go straight to UEFI, or keep asking again.

Since BitLocker is already suspended, the next fix is to restore the default Secure Boot and PCR configuration.

Boot into Surface UEFI.
Open Security.
Under Secure Boot, select Change Configuration.
Set it to Microsoft Only.
Select OK.
Select Exit > Restart.
After Windows starts, run an elevated PowerShell window and resume BitLocker:

Resume-BitLocker -MountPoint "C:"

Also verify whether the drive is using non-default PCR bindings. In an elevated Command Prompt, run:

manage-bde.exe -protectors -get C:

If PCR settings were defined by Group Policy, disable those policies or remove the device from the group applying them, then suspend and resume BitLocker again so it can rebind using the default values.

Suspend-BitLocker -MountPoint "C:" -RebootCount 0
Resume-BitLocker -MountPoint "C:"

About rollback: the documented prevention is to suspend BitLocker before TPM or UEFI firmware updates. The documentation does not state that BitLocker must be turned off for rollback to succeed. It specifically says to suspend BitLocker during firmware updates because those updates can require multiple reboots.

Important: leaving BitLocker suspended reduces protection for the device. Re-enable it after Secure Boot and PCR settings are corrected.

If the device still cannot boot properly even with the correct recovery key, the documented recovery path is:

Get the BitLocker recovery key.
On another PC, download a Surface recovery image and create a USB recovery drive.
Boot the Surface from that USB.
Go to Troubleshoot > Advanced Options > Command Prompt.
Run:

manage-bde.exe -unlock -recoverypassword <Password> <DriveLetter>:
manage-bde.exe -protectors -disable <DriveLetter>:

Restart and enter the recovery key when prompted.

If Windows still does not start after that, data can be copied off from the recovery environment after unlocking the drive, and the device can then be reset by using the Surface recovery image.

References: