BitLocker TPM Error: Fix Device Can’t Use TPM

Quick Answer

Use this order to fix the BitLocker TPM error:

1. Run tpm.msc or Get-Tpm to check whether a TPM is present and ready.
2. If a TPM exists but is disabled, enable Intel PTT, AMD fTPM, or TPM in UEFI firmware.
3. If no compatible TPM exists, open Local Group Policy Editor.
4. Enable Require additional authentication at startup.
5. Select Allow BitLocker without a compatible TPM.
6. Apply the policy and start BitLocker again.
7. Back up the 48-digit recovery key before encryption begins.
8. Verify protection with manage-bde -status C:.

This Group Policy method applies to supported Windows Pro, Enterprise, and Education editions. Windows Home does not provide the complete BitLocker management and Local Group Policy workflow used in this guide.

Video: Fix the BitLocker TPM Error

This short walkthrough shows the TPM check, the required Group Policy setting, BitLocker startup options, and the final protection-status command.

1. Why the BitLocker TPM Error Appears

BitLocker normally uses a TPM to protect the encryption key and verify that the expected startup environment has not been changed. Windows can display the TPM message when:

• The device does not contain a compatible TPM.
• The TPM, Intel PTT, or AMD fTPM setting is disabled in UEFI firmware.
• The TPM is present but not ready, provisioned, or available to Windows.
• The TPM is temporarily locked after repeated authorization failures.
• A firmware or TPM problem prevents automatic provisioning.
• A virtual machine was created without a virtual TPM.
• Local or domain policy does not allow BitLocker without TPM.
• The device is using an unsupported Windows edition for manual BitLocker management.

Microsoft explains that BitLocker provides its strongest startup protection when used with a TPM. A device without TPM can still use BitLocker, but it loses the TPM-based verification of the preboot environment.

For the full encryption workflow, recovery-key guidance, and maintenance commands, see the SupportSolved BitLocker on Windows guide.

2. Check Whether the TPM Is Present and Ready

Method 1: TPM Management

1. Press Windows + R.
2. Enter tpm.msc.
3. Select OK.
4. Review the status and TPM manufacturer information.

A ready TPM normally displays The TPM is ready for use. If Windows reports that a compatible TPM cannot be found, the device may not have one, or it may be disabled in UEFI firmware.

Method 2: PowerShell

Open PowerShell as Administrator and run:

Get-Tpm

Check these fields:

• TpmPresent: Whether Windows detects a TPM
• TpmReady: Whether it is ready for use
• TpmEnabled: Whether it is enabled
• LockedOut: Whether dictionary-attack protection has locked it temporarily
• RestartPending: Whether the current TPM operation needs a restart

The Microsoft Get-Tpm reference documents these status fields.

3. Enable TPM, Intel PTT, or AMD fTPM

When the computer supports TPM but Windows cannot find it, check the UEFI firmware settings before bypassing TPM protection.

1. Open Settings → System → Recovery.
2. Under Advanced startup, select Restart now.
3. Choose Troubleshoot → Advanced options → UEFI Firmware Settings.
4. Open a section such as Security, Advanced, or Trusted Computing.
5. Enable the available TPM setting.
6. Save the changes and start Windows.
7. Run tpm.msc or Get-Tpm again.

The option can appear under names such as:

• Security Device Support
• TPM State
• Intel Platform Trust Technology or Intel PTT
• AMD CPU fTPM or AMD PSP fTPM

The exact menu varies by manufacturer. Microsoft’s TPM enablement guide lists common firmware labels and access methods.

For additional firmware terminology, use the SupportSolved BIOS vs UEFI comparison.

4. Fix the BitLocker TPM Error Without a Compatible TPM

Use this method only when the device genuinely lacks a usable TPM or the intended configuration specifically requires non-TPM startup protection.

1. Press Windows + R.
2. Enter gpedit.msc and press Enter.
3. Open:
   Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption → Operating System Drives
4. Open Require additional authentication at startup.
5. Select Enabled.
6. Select Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive).
7. Select Apply → OK.
8. Run gpupdate /force from an elevated terminal, or restart Windows.

Microsoft’s BitLocker policy reference confirms that this setting enables BitLocker on a computer without a compatible TPM.

Startup Key or Password?

A USB startup key stores the startup information on removable media and must be connected when the computer starts. A password can be more convenient, but Microsoft discourages the non-TPM operating-system password option because it does not have TPM-backed rate limiting and is more exposed to brute-force attempts.

Use the startup method required by the organization’s policy and threat model. Keep the recovery key separate from the startup key.

5. Start BitLocker and Back Up the Recovery Key

1. Search for Manage BitLocker.
2. Select Turn on BitLocker for the operating-system drive.
3. Choose the available startup method.
4. Back up the recovery key to an approved location.
5. Confirm that the saved key belongs to this device.
6. Choose the appropriate encryption scope and mode.
7. Run the system check when Windows offers it.
8. Start encryption.

The BitLocker recovery key is a 48-digit number. Microsoft Support cannot retrieve, provide, or recreate it after it is lost. Store it somewhere accessible when the encrypted computer cannot start.

Review Microsoft’s recovery-key backup guidance before starting encryption.

6. Verify the BitLocker TPM Error Fix

Open Command Prompt or Terminal as Administrator and run:

manage-bde -status C:
manage-bde -protectors -get C:

After encryption completes, verify:

• Conversion Status: Fully Encrypted
• Percentage Encrypted: 100%
• Protection Status: Protection On
• Key Protectors: The expected startup and recovery protectors

The BitLocker TPM error is resolved only when BitLocker starts successfully and the expected protectors appear. A policy change by itself does not confirm that the drive is protected.

7. Additional Troubleshooting

Microsoft maintains a current list of known BitLocker TPM issues for cases involving lockout, provisioning, firmware, and managed environments.

Frequently Asked Questions

Summary

The BitLocker TPM error usually means that Windows cannot find, initialize, or use the expected TPM protector. Check the TPM state before changing BitLocker policy.

When the device supports TPM, enable Intel PTT, AMD fTPM, or the manufacturer’s TPM setting and verify that Windows reports it as ready. When no compatible TPM is available, supported Windows editions can allow BitLocker without TPM through the additional startup-authentication policy.

Back up the recovery key before encryption and verify the final protection status and key protectors. Do not treat the disappearance of the error message as proof that the drive is encrypted.