BitLocker using Startup Key refuses to work unless configured 'Allow' rather than 'Require' in Group Policy.

Question

Hi,
I'm having difficulties setting up BitLocker with Startup Key on my Windows 11 (Pro) machine.

the setting to allow Startup Key authentication is located at the following Group Policy Path (same for both gpmc.msc and gpedit.msc):

Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives

Policy setting is called Require additional authentication at startup.

now, for some reason, If I try to choose the Require startup key with TPM option under Configure TPM startup key
and then, run manage-bde -protectors -add C: -TPMAndStartupKey E: it returns the following error:

"The Group Policy settings for BitLocker startup options are in conflict and cannot be applied."

This error occurs If I choose a "Require..." option in any one of the options available (TPM and PIN, TPM and Startup key, TPM and PIN and Startup key).

But if I choose the "Allow startup key with TPM", only then it works.

Can anyone explain to me please where does BitLocker sees a "conflict" by choosing "require" for TPM and Startup Key and "allow" to all other options ?

Thank you in advance.

Answer 1

Hi Michael Hodeda,

Thanks for trying that. What exact error message or code do you get when running the command with the USB path included?

Please also confirm whether this is a personal or work-managed device and share the results of:

manage-bde -status C:

manage-bde -protectors -get C:

Before posting, remove the recovery password, protector IDs, device name and any account or organization details.

If TPM And Startup Key is listed but the USB is not recognized during startup, try another built-in USB port and connect it directly rather than through a hub or dock. For now, please don’t clear the TPM or remove the existing protector until the recovery password is safely backed up and the new startup method has been tested successfully