Can't enable BitLocker auto-unlock on drive ("invalid function")

Question

I just upgraded my computer to Windows 10 by doing a clean install after formatting my boot drive. My boot drive is an SSD, and all my files are on an HDD that I didn't erase. I have all my volumes encrypted using BitLocker. That's three volumes, not including my boot volume, and the passwords are all quite long, so I like to turn on auto-unlock so I don't have to enter them each time I boot up my computer.

Normally this works fine. And it did for my E: and F: drives. But for my D: drive--the most important one, where the majority of my files are stored--it wouldn't work. When I try to turn it on in Control Panel, it gives me a message box saying "Invalid function", which isn't particularly useful. Trying to do it from the command line (manage-bde -autounlock -enable D:) gives me the same message, only it also says the error code is 0x80070001.

I don't know if this is relevant, but my D: drive is a dynamic volume, which is not true of any of my other drives. In fact it wouldn't mount when I first installed Windows 10; it said in Disk Management that it was "foreign" and I had to add it to my configuration. After doing that, however, it worked fine, with the exception of the problem mentioned above.

Does anyone know how I can fix this? I thought of doing a workaround where I set a startup script to unlock the drive with the recovery key, but it only accepts that in the form of a .BEK file, which I don't know how to export. If someone could tell me how to export this file, that would be helpful, but I'd prefer a way to get the normal auto-unlock to work.

Answer 1

I managed to figure out how to fix this. It doesn't use the native auto-unlock function like I was hoping (rather a script that unlocks using a .BEK file, as I mentioned) but it seems to work just as well.

First, you need to create a .BEK file that can unlock the disk. This is the command I used:

manage-bde -protectors -add d: -rk c:\

Substitute d: with whichever drive you want to auto-unlock. The output will look something like this (take note of the "external key file name"):

BitLocker Drive Encryption: Configuration Tool version 10.0.10011
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

Key Protectors Added:

    Saved to directory c:\

    External Key:
      ID: {9DDF4900-5E08-479A-8C4C-6ADE2DA00551}
      External Key File Name:
        9DDF4900-5E08-479A-8C4C-6ADE2DA00551.BEK

Now you need to create the script to unlock the drive. Just create a batch file in the root directory with the following line:

manage-bde -unlock d: -rk C:\[external key filename]

Again, replace d: with the correct drive letter. Replace [external key filename] with the filename you got before.

Finally, you need to tell Windows to run this script at startup, before you log in. (Or at least I needed it to run then, because that's where my desktop, etc. are stored.) Here's how you do that:

1. Press Win+R and enter gpedit.msc. (This is only in Pro, but so is BitLocker, so that's not an issue here.)

2. On the left, navigate to Computer Configuration > Windows Settings > Scripts (Startup/Shutdown)

3. Double-click "Startup" on the right

4. Click "Add..." and select the batch file you created before.

5. Click OK and exit Group Policy Editor.

Now you can reboot the computer to test it. You should see your drive automatically unlocked!