[Problem] BitLocker Prompt after Secure Boot off

Scenario: BitLocker prompt after Secure Boot off on Windows 10 Lenovo laptop

As the case shows, there is a user whose Windows requires BitLocker recovery key after he disable Secure Boot. How does this happen? These two features look quite extraneous during our daily usage, but the issue does appear on Windows PC. The truth is, since Secure Boot is highly related with TPM, the real problem might be between BitLocker and TPM.

In this post, we’ll explain why BitLocker prompt after Secure Boot off, and offer you one more choice to manage BitLocker on your PC.

Overview of BitLocker, Secure Boot & TPM

Secure Boot and BitLocker are both security features provided by Windows, but they serve different purposes and have a somewhat interconnected relationship, especially when Trusted Platform Module (TPM) is involved.

▶ Secure Boot

Secure Boot is a security standard developed by members of the PC industry to help make sure that your PC boots using only software that is trusted by the PC manufacturer. It is designed to protect the boot process:

1. Prevent Bootkits and Rootkits: Secure Boot helps prevent "bootkits" and other malware that try to attack the computer at the earliest stage of the boot process. 2. UEFI/BIOS Configuration: It is implemented in the UEFI (Unified Extensible Firmware Interface) firmware and ensures that only signed and certified boot loaders and drivers are executed during the system start-up.

▶ BitLocker

BitLocker is a full-disk encryption feature that helps protect data by encrypting the entire Windows system volume. It works with:

1. TPM for Enhanced Security: BitLocker can use the TPM to store a unique key that is needed to unlock the drive. This key is created when BitLocker is first enabled. 2. Pre-boot Authentication: It requires authentication before the operating system starts, ensuring that the data on the drive remains encrypted until the correct credentials are provided.

▶ The Role of TPM

TPM is a specialized chip on the motherboard that stores cryptographic keys and performs encryption and decryption processes at the hardware level. It plays a crucial role between Secure Boot and BitLocker.

1. Secure Boot and TPM: During the boot process, Secure Boot uses the TPM to verify the digital signatures of the boot components. If the signatures are valid, the boot process continues. 2. BitLocker and TPM: BitLocker uses the TPM to seal the encryption key to the state of the computer's hardware and software. This means that the encryption key can only be unsealed (released) when the system's configuration matches the state when the key was sealed.

▶ Connection and Interaction

1. TPM as a Bridge: The TPM is a common element that Secure Boot and BitLocker rely on. Secure Boot uses it to verify boot components, and BitLocker uses it to store and manage encryption keys. 2. Policy Enforcement: In some cases, BitLocker may be configured to require Secure Boot to be enabled as a policy to ensure that the system's boot environment is secure and trusted.

When Secure Boot is disabled, it can potentially allow unauthorized modifications to the boot environment, which BitLocker might interpret as a security risk. This is because the integrity checks performed by Secure Boot are no longer enforced, and BitLocker may lock the drive to protect the data until the correct recovery key is provided.

Why BitLocker prompt after Secure Boot off?

So, the reasons why BitLocker prompt after Secure Boot disabled are:

1. Dependency on TPM: BitLocker relies on the Trusted Platform Module (TPM) to store a portion of the encryption key, enhancing system security. Disabling Secure Boot may affect the normal operation of the TPM, triggering BitLocker's protective mechanisms.

2. Changes to System Boot Components: Secure Boot is designed to ensure that the components used during the system boot process are trusted. Disabling Secure Boot might allow modifications to boot components, which BitLocker could interpret as a security risk, thus prompting for a recovery key to unlock the drive.

3. BitLocker Group Policy Settings: If a user's computer is domain-joined, it may be subject to group policy controls that require re-verification of BitLocker protection after changes to critical BIOS settings, such as disabling Secure Boot.

Solution: Retrieve BitLocker recovery key via Microsoft account

At this time, there is no method to circumvent the necessity for the recovery key. This recovery key requirement is a security provision of BitLocker. If your local account was linked to a Microsoft Account, it is possible that your recovery key can be retrieved by accessing BitLocker recovery keys.

Step 1. Go to BitLocker recovery keys, and sign into Microsoft account.

Step 2. Go to the “Device security” page in your account settings.

Step 3. Look for the BitLocker recovery keys section or search for “BitLocker” within the settings.

Step 4. When you find the right section, you’ll be able to see and manage all your BitLocker recovery keys for each device connected to your Microsoft account.

Alternative BitLocker manager to system built-in tool

Windows BitLocker is a sophisticated data security utility. Nevertheless, it may not be accessible to all users due to its intricate technical skill requirements and the difficult troubleshooting steps that must be taken when issues arise. Additionally, we would like to suggest a more straightforward alternative for BitLocker management: AOMEI Partition Assistant Professional. The software's primary function, BitLocker, contains all the necessary components for management.

There is no requirement to navigate through the Control Panel or Settings to enable or disable it in the event of an issue; a few taps are sufficient. Additionally, it offers the ability to enable BitLocker for Windows Home users, which allows them to perform a variety of duties within a single function, including backing up the recovery key, changing the password, securing the drive, and turning off BitLocker.

1. How to back up recovery key

Step 1. When setting and confirming a password to encrypt the drive, you can choose the way to back up the recovery key.

If you select "Save to a file", please choose a location on your PC to save the recovery key.

Tips: Please do not save the recovery key in the encrypted drive path. For example, it is unable to encrypt D: and save the recovery key on the same D: drive.

If you select "Print the recovery key", it will enable the print function on your PC to print the recovery key. Then, you can click the "Next" button to finish the backup process.

2. Change BitLocker password

Step 1. Locate the encrypted drive for which you want to change the password, then click on the option "Change password".

Step 2. You have two options for changing the password: Use password to change drive password or Use recovery key to change drive password. Choose the method you prefer.

Step 3. If the change is successful, you'll see a window that says "Password changed successfully".

3. Lock/Unlock the drive

If the drive is unlocked, you can click the option "Lock the drive" to lock it directly.

If the drive is already locked, "Unlock the drive" will be the only available option to manage BitLocker. You must unlock the drive before you can manage BitLocker settings for the drive.

4. Turn off BitLocker

Besides easily turning on BitLocker on Windows 10 Home, AOMEI Partition Assistant also offers an easy way to turn it off.

Step 1. Locate the encrypted drive you want to decrypt, then click the option "Turn off BitLocker".

Step 2. You have two options for decrypting the drive: Use password to decrypt the drive or Use recovery key to decrypt the drive. Choose the method that suits your needs. And then begin the closing process.

Summary

BitLocker has close connection with Secure Boot and TPM, that's why the BitLocker prompt after Secure Boot off appears. If your Microsoft account doesn't store BitLocker recovery key, the only way to get system operation is to reinstall Windows, and you will lose all data.

AOMEI Partition Assistant Professional is a reliable tool for Windows management. To safely manage your BitLocker drives, we suggest you save your password on one more location and print it. You can also check BitLocker recovery key in Microsoft account to make sure you can unlock encrypted drive when BitLocker impedes your operation.