2

This post is to seek more of an understanding than solution.

Currently I am running Windows 11 (latest 22H2 build) with BitLocker enabled with initial PIN login.

I recently been facing some Sleep/Wake and Crash issue (different issue) with my desktop, so I decided to update my BIOS to see if it will fix it.

After I updated BIOS and rebooted, it took me to the PIN login to unlock BitLocker. I entered my usually PIN but it says is incorrect. I tried again multiple time and I made sure to enter slowly to not enter wrong number. I also tried using the keypad as well, but all failed. I eventually had to use my recovery key to unlock the drive and login to Windows. But after I used the recovery key and entered Windows, and rebooted again, my old PIN worked again.

I searched online and it seemed to be a common issue (feature?)

I guess my question is, why did my PIN not work initially after BIOS update, but worked again later? (I am assuming it has something to do with TPM?)

2
  • 1
    This is unfortunately quite common. Make sure you have a BitLocker recovery key before updating your BIOS,
    – Massimo
    Commented Dec 7, 2022 at 23:22
  • Good question for Super User, too.
    – Sam Erde
    Commented Dec 25, 2022 at 2:08

2 Answers 2

3

Bitlocker actually has two functions:

  • encrypt storage volumes attached to your computer, including hard disks etc

  • ensure the integrity of the boot process—ensures bitlocker can't be tricked into passing the encryption keys to a rogue operating system.

On systems with a Trusted Platform Module, the bitlocker encryption key is stored securely in the TPM using a key that can only be used when the boot process matches the expected value. The boot process is measured using the BIOS firmware and configuration, as well as the Windows boot manager. If any of these are modified, then the boot measurements will no longer match the values expected by the TPM. The TPM will refuse to provide your bitlocker key, and you must use bitlocker recovery to restore access to your system.

By default, bitlocker is protected using the TPM only. This protects against several kinds of attacks, and if the TPM validation succeeds, the boot process is unchanged, making this the most convenient option.

In addition to the TPM, you can also chose to use a startup key or a PIN (or both)—these options are slightly less convenient than TPM-only, but they protect against more sophisticated kinds of attacks than TPM-only.

In your case, when you upgraded the BIOS version, you modified the boot process, and the TPM refused to unlock your bitlocker key—even with the correct PIN.

Further reading:

0

This is a typical scenario. Before restarting BitLocker is suspended. After updates are complete it is resumed. This can be controlled in the manage-bde command and other ways.

Without this you will encounter challenges due to signature changes.

2
  • is there any documentation or more detail on this though?
    – YTKme
    Commented Dec 8, 2022 at 0:35
  • manage-bde -? pause and resume
    – Greg Askew
    Commented Dec 8, 2022 at 0:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .