When trying to enable encryption, next message is shown in Bitlocker Drive Encryption window:
This device can’t use a Trusted Platform Module. Your administrator must set the “Allow BitLocker without a compatible TPM” option in the “Require additional authentication at startup” policy for OS volumes
Secure Boot State is On, PCR7 Configuration is Bound, tpm.msc reports TPM is ready, all group policies under Bitlocker Driver Encryption are Not configured.
This was possibly caused by migration (Clonezilla) from motherboard which had no TPM (i.e. system previously used only password based Bitlocker).
Just in case – alternative Windows 10 OS (which was installed directly, without cloning) allows to enable Bitlocker from the same standard GUI without errors.
Workaround:
This appeared to be GUI only failure, i.e. command line manage-bde -protectors -add C: -tpmandpin worked correctly and after reboot (and policy edit to allow the -rp on data disk) status is correctly displayed in Bitlocker Drive Encryption window.
After this command line bitlocking, there is still For your security, some settings are managed by your system administrator. message in the Bitlocker Drive Encryption, which may be caused by only one currently configured policy Require additional authentication at startup:
Policy: enabled
Allow BitLocker without a compatible TPM : unchecked
Configure TPM startup: No
Configure TPM startup PIN: Require startup PIN with TPM
Configure TPM startup key: No
Configure TPM startup key and PIN: No
Workaround will probably help someone, but how GUI can be properly fixed and what caused this difference between GUI and command line?
Policy settings are expected to be on default (Not configured).
I can’t easily confirm full solution of the original error any more since Bitlocker already enabled (this is expected to be done by other people who will encounter similar specific problem), but still can compare registry differences between two Windows 10 systems, one of which had GUI failure.
