Share via

After turning on Bitlocker and restarting my laptop will not boot and does not ask for key

Thomas Westfall 10 Reputation points
2023-10-06T19:33:22.4933333+00:00

This is Windows 11 Pro

I have a Lenovo laptop. After purchasing the machine I immediately removed Bitlocker. Completely installed all new software and the sysprepped the drive. Once the drive was sysprepped an image was created to be used to install on similar laptops.

The image was copied to a new machine and then completely setup for a user. The machine was renamed and joined to a domain and all the software for the new user was installed. Once all that was completed and we were ready to hand the PC to the user, we remembered that we had forgotten to install Bitlocker.

We made sure the laptop was in the correct OU in AD and proceeded to turn on BitLocker. While turning on Bitlocker I was presented with 3 options, 1 was to use a PIN, 2 was to use a USB, and 3 was to print to a file. I chose print to file and selected a network share and confirmed the key was there. I did select the New encryption mode which was the default.

After the process had completed I was prompted to restart the laptop which I did and that was it. When it restarted I get a BSOD:

Recovery

Your PC/Device needs to be repaired....

File \WINDOWS\system32\winload.efi

Error code: 0xc000000f

You'll need to use recovery tools....

Enter to Try Again (does nothing)

F1 to enter Recovery Environment (produces errors)

F8 to enter Startup Settings (does nothing)

ESC for UEFI Firmware Settings (this works)

The bitlocker key did find it's way into AD.

I've tried creating bootable media but nothing sees the internal drive.

I tried various recovery options but still nothing sees the internal drive.

I even tried to reinstall Windows but it suggests no hard drive. What?

Using Clonezilla I can see the partition is there and shows that bitlocker is enabled.

Is there any way to fix this? I have to deploy 35 of these and they are all supposed to have bitlocker enabled. Well, it's enabled and so secure that it is unusable.

Any help would be appreciated.

Windows for business | Windows Client for IT Pros | User experience | Other

4 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Thomas Westfall 10 Reputation points
    2023-10-07T20:55:44.8066667+00:00

    Not sure what you mean by coincidence. What is the coincidence?

    Anyway, the problem here is that I need to get bitlocker working on these devices. I just restored my image to another laptop and this time, went through the initial OBE and immediate setup bitlocker. Figured, let's try this again but before we put all the work in. And again, same exact errors as before. Now what?

    1 person found this answer helpful.
    0 comments
  2. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    1 deleted comment

    Comments have been turned off. Learn more

  3. toby33 21 Reputation points
    2025-01-12T21:38:40.2733333+00:00

    I didn't find the exact cause but I did find a work around to achieve similar results as to what I was trying in the first place.

    Here are the steps to reproduce and the work around:

    My original process was, that lead to the problem:

    1. Started with the OEM Windows 11 Home, fully patched, that came with the laptop (Which resulted in Bitlocker being on by default)
    2. Logged in as a dummy free MS account
    3. Upgraded it to Windows 11 Enterprise
    4. Disabled Bitlocker
    5. Sysprepped
    6. Signed in with my EntraID account in the OOBE process
    7. Enabled Bitlocker with key backed up to Entra
    8. Rebooted
    9. Boot fails, doesn't ask for recovery key, just boots into recovery environment
    10. Open CLI from recovery environment
    11. Disable Bitlocker using manage-bde commands and backed up key
    12. Boot back into Windows
    13. Re-enable Bitlocker
    14. Reboot to enable Bitlocker again fails in the same way and boots to recovery environment
    15. Recovery environment presents the options "Shutdown" or "Advanced"
    16. Click Advanced this time, laptop shuts down
    17. Boot using install media into setup
    18. Click Advanced and see "Command Prompt" option
    19. Click Command Prompt, get error that something went wrong and it can't launch, error 80070003, which is a pretty generic error code.

    No matter how I sliced that, it would fail the same way. Reset TPM, reset secure boot, set BIOS defaults, nothing really mattered.

    Process that worked:

    1. Started with the OEM Windows 11 Home, fully patched, that came with the laptop (Which resulted in Bitlocker being on by default)
    2. Logged in as a dummy free MS account
    3. Upgraded it to Windows 11 Enterprise
    4. Disabled Bitlocker
    5. Created new local admin account for my user
    6. Logged in with new local account
    7. Enabled Bitlocker
    8. Rebooted to set Bitlocker
    9. Boot succeeds, login as new local user
    10. Add EntraID account via Accounts > Work or School

    I was too tired of screwing with it to further test if it was the Sysprep, starting in the Entra account from OOBE, or a combination that was causing it. Whatever the case, weird bug.

    Hopefully this saves someone some headaches.

  4. Jesnar Miranda 0 Reputation points
    2025-05-19T05:28:23.95+00:00

    sysprep tends to wipe the bcd values. Windows Boot Manager is lenient and works even entries in bcd for device and osdevice are loosely mapped, the system can figure it out but when Bitlocker is enabled, it must have a precise partition bindings, if anything differs like wrong device or osdevice entry, altered BCD, mismatch in volume identifiers, partition layout shift etc. fails to boot.

    If you are in Automatic Repair go to Command Prompt and type these commands then after that boot normally:

    bcdedit /set {default} device partition=C:

    bcdedit /set {default} osdevice partition=C:

    You can create a script to run after your answerfile.xml of sysprep.

    @echo off
    bcdedit /set {default} device partition=C:
    bcdedit /set {default} osdevice partition=C:

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.