I have a Surface Pro 6. One day my computer got locked with BitLocker (for no apparent reason). After recovering the key I disabled device encryption and decrypted my hard drive.

If I now do manage-bde -status, I get this information:

enter image description here

However, this seemed to have disabled my TPM. When I boot into UEFI, the TPM option is disabled, and when trying to enable it I get a message saying

The system failed to change the state of the TPM. Please reboot the system to try again.

Disabling Secure boot does not help (I tried enabling TPM with secure boot on and off).

enter image description here

enter image description here

enter image description here

enter image description here TPM is also not found under Device Manager, as my Security Devices section does not appear even after I check "Show Hidden Devices". enter image description here

I learned that this could be an issue related to BitLocker. In efforts to enable TPM, I followed instructions that told me to pause BitLocker, but that command gave me an error:

enter image description here

I have another surface pro that has BitLocker encryption enabled, and the TPM is enabled (as by default).

From this, I have a few questions:

  • Are the issues between decrypting my drive and being unable to turn on TPM related?
  • How can I re-enable my TPM module?

*For more information, I have Surface Pro 6, model 1796.

  • 2
    BitLocker protection is disabled on your system. So a command to suspend the protection cannot work. Your drive isn’t encrypted at all. Can you provide us the exact errors you received when you attempted to enable your TPM?
    – Ramhound
    Oct 17, 2021 at 21:06
  • @Ramhound The error message was just a popup in UEFI, saying something like "failed to enable TPM, please restart the device and try again". There was nothing else, no error code.
    – Victor2748
    Oct 17, 2021 at 21:12
  • Before this problem we’re you storing the BitLocker key in the TPM? I am actually looking for the exact error you received
    – Ramhound
    Oct 17, 2021 at 21:26
  • @Ramhound I updated the question with the exact message
    – Victor2748
    Oct 17, 2021 at 21:34
  • 1
    That means TPM was unlikely ever enabled, since BitLocker wasn’t using it, to store its key. According to Microsoft documentation you need to clear the TPM. This is safe since BitLocker protection is disabled.
    – Ramhound
    Oct 17, 2021 at 21:54

3 Answers 3


Okay, so here’s what likely happened:

  1. Your computer shipped with BitLocker enabled with a TPM-protected key
  2. The TPM died
  3. You had to enter the recovery key because the TPM was no longer accessible to automatically unlock the BitLocker encryption

You need to get the device repaired, there is nothing more you can do.


No, disabling bitlocker will not disable TPM. TPM is managed from the BIOS/UEFI, and bitlocker is not capable of enabling/disabling TPM.

That said, if you change secure boot options in the BIOS/UEFI, it may disable TPM.

Given that your TPM is currently disabled, it sounds like you switched to legacy mode. For TPM to be allowed, Secure Boot must also be enabled.

It may be that you must enable secure boot, reboot, enter UEFI and then be allowed to enable TPM.

  • OP indicated Secure Boot is/was enabled. // A TPM can be used without Secure Boot, even though they can interact.
    – Daniel B
    Oct 17, 2021 at 21:04
  • @DanielB I've seen otherwise and OP says they have changed the secure boot setting, so better safe than sorry.
    – LPChip
    Oct 17, 2021 at 21:06
  • Secure boot is enabled when I initially tried it. I tried it with disabling it as well, but both failed. (It is now enabled, as it was by default)
    – Victor2748
    Oct 17, 2021 at 21:11
  • TPM has little to do with Secure Boot. Additionally, if Secure Boot is enabled, that means CSM must be disabled. I don’t believe SP6 devices even have CSM support. Intel certainly stopped supporting it
    – Ramhound
    Oct 17, 2021 at 22:03
  • It does not work. I tried all possible combinations.
    – Victor2748
    Nov 13, 2021 at 17:56

All the Surface devices I have seen had TPM and were BitLocked out of the factory. For the Surface, this seems to a requirement imposed by Microsoft.

The disk has not become BitLocked, but were so from the beginning. BitLocker was most likely already installed on your Surface by Microsoft, as most Surface devices are sold as BitLocked. At least we can be sure that TPM was still functional up till now.

To my knowledge, TPM devices are heavily protected, hardware and firmware, and will self-block on tampering, in effect putting then the burden of keys-keeping on the user. You were really lucky to be able to recover your data.

I think that when you disabled BitLocker, you have somehow activated some anti-tamper circuits in the TPM, which caused it to disable itself. It's possible that it became defective, but I would assume that this is less likely to happen spontaneously.

Since the BIOS cannot re-enable it, so Windows cannot see it, there is nothing that you can do except firmware update, which you tried but that did not restore the TPM functionality.

I suggest to try and get in touch with Microsoft Support, asking for any method or software that can reset or re-initialize the TPM. Information about it doesn't seem to be available to the public, perhaps for a reason.

I think it's unlikely that Microsoft will release to you any software that can reach into the TPM and modify things, except the software that is already installed, such as tpm.msc. Microsoft is much more likely to suggest sending them the Surface to be repaired, perhaps at some cost.

Your options for the moment seem to be, either to keep using the Surface without TPM, or to have it repaired.

  • “TPM technology is a requirement of BitLocker disk encryption” – Not it is not. The TPM is merely one possible key protector of several others.
    – Daniel B
    Nov 13, 2021 at 22:07
  • "TPM technology is a requirement of BitLocker disk encryption," - Nope; The author could easily enable BitLocker protection with TPM provided they didn't attempt to use it and instead used a password. "I think that when you disabled BitLocker, you have activated some anti-tamper circuits in the TPM, which caused it to disable itself. " - Nope
    – Ramhound
    Nov 13, 2021 at 23:18
  • @Ramhound: Yes, I meant for the Surface, but the sentence came out all wrong. I rewrote that part.
    – harrymc
    Nov 14, 2021 at 8:53
  • @Ramhound: How can you be so sure?
    – harrymc
    Nov 14, 2021 at 13:51
  • @Ramhound: Perhaps not as much as mine. So your experience says that the TPM was not designed for robustness?
    – harrymc
    Nov 14, 2021 at 15:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .