BitLocker is prompting at every boot because the system’s boot measurements (TPM, Secure Boot, or firmware settings) no longer match what BitLocker originally trusted, typically after a BIOS/UEFI reset or firmware change. To stop the repeated prompts, the protection must be re-bound to the current, stable configuration.
On a Windows client, the supported way (from the provided context) is to remove and then reconfigure the BitLocker protectors so they match the current firmware/TPM state:
- Sign in when prompted by BitLocker using the existing recovery key.
- Open an elevated Command Prompt (Run as administrator).
- Check current protectors and PCR usage:
manage-bde.exe -protectors -get C:
This shows which TPM/Secure Boot PCRs BitLocker is using.
- Turn BitLocker off on the OS drive so it fully decrypts and clears the old bindings:
manage-bde -off C:
Wait until manage-bde -status C: shows Conversion Status: Fully Decrypted.
- Ensure firmware/BIOS settings are now stable and correct (for example, Secure Boot set as desired, TPM enabled, no further changes planned).
- Turn BitLocker back on from Control Panel → BitLocker Drive Encryption (or Settings → Privacy & security → Device encryption/BitLocker), so it re-encrypts and binds to the current TPM/Secure Boot configuration.
After re-encryption completes with a stable firmware/TPM configuration, BitLocker should unlock automatically at startup and no longer prompt for the recovery key on every boot.
If the device is using non-default TPM PCRs (for example, Secure Boot disabled or custom PCRs via policy), align the configuration back to the default (Secure Boot on, PCR 7/11) before re-enabling BitLocker, as described for Surface devices in the context.
References: