Q: BitLocker Troubleshooting

On this page:

This article is designed for desktop technicians to understand how to better manage BitLocker enabled machines.

To use MBAM you need the Enterprise version of Windows.

The MBAM installer will not run on non-Enterprise editions of Windows, e.g. Professional, Home, Basic.

I made a BIOS change and now I'm prompted for a BitLocker recovery key? How do I resolve this?*

BitLocker is designed to secure the disk by detecting changes to the hardware, which include changes to the BIOS. This means you need to suspend BitLocker prior to making a settings change. You can do this by going to the Control Panel in Windows, then selecting BitLocker Drive Encryption. Select "Suspend Protection." Once that is done you can reboot into the BIOS and make necessary changes. Be sure to enable it from the same spot once your change is complete.

When I switch my monitor from the output of on-board video card to the discrete video card, I'm prompted for the BitLocker recover key on the next reboot. What is going on?

Windows is detecting a hardware change as the on-board video is disabled while the monitor is plugged into the discrete video card. Your best bet is to use the same video card every time. If you need to switch, follow the above steps to suspend and re-enable BitLocker.

When I enter my recovery key ID at the MBAM recovery portal I get an error message saying "Invalid Key ID". What's going on?

In order for you to use BitLocker recovery key self service, you must have logged into the machine at least once. If you are working on an end user machine this might not be the case. Otherwise you will need to contact the help desk or endpoint management team to get the recovery key. It is also possible the user did not escrow the key within MBAM and may need to check LastPass or somewhere else if they saved the key manually.