Troubleshooting guide
How to fix the problem
Windows device encryption can be turned on even if you didn't intentionally turn it on. Before making changes to the BIOS, TPM or motherboard, check the status and make sure you have the correct recovery key.
Possible solutions
Choose the method that matches your situation. Start with the simplest suitable option and check the result. If the problem is fixed, you do not need to continue with the other methods.
Checking the encryption status
The location of the section depends on the edition of Windows.
Steps to follow
- Open Settings and type "Device encryption" or "BitLocker" in the search.
- If the partition exists, write down the system disk protection status; don't turn it off just for testing.
- Additionally, the manage-bde -status command on the administrator's Command line shows the encryption and protection statuses of volumes.
- If the system is managed by an organization, check with the administrator where the copy of the key is kept and who authorizes the BIOS change.
Saving the recovery key before changing
Check not only that some key is there.
Steps to follow
- Open your list of recovery keys and check the key ID of your specific device via Microsoft's official guide.
- Keep a safe copy on another medium or hard copy. A copy stored on an encrypted C: drive alone won't help if it's locked.
- From another device, verify that you can access the key storage location and sign in to your account.
- Only then follow the manufacturer's instructions for updating the BIOS and, if provided, temporarily stopping the protection of the BitLocker. After work, check the protection status again.
If the problem persists
If encryption is active but you can't find a copy of the key, resolve key storage first. BIOS update should not be started with the expectation that the key will not be needed. Coordinate organization-managed encryption with your administrator.
Request a repair