BitLocker Cannot Protect a System Volume with an Unsupported Partition Layout

Use this assessment path for the unsupported partition layout condition:

1. Verify the current partition layout.
   • Open an elevated Command Prompt.
   • Run:

          diskpart.exe
          list volume
     

   • Confirm that the device has a separate system partition and operating system partition.
   • If the recovery partition is missing or any volume is not healthy, Windows might need to be reinstalled.
2. Check the BitLocker partition requirements.
   • BitLocker requires two partitions:
     • An operating system partition formatted as NTFS.
     • A separate system partition used for boot files.
   • The system partition must:
     • be separate from the OS partition
     • not be encrypted
     • be configured as the active partition
     • not be used for user files
     • have at least 250 MB of space
   • Format requirements depend on firmware:
     • UEFI systems: system partition must be FAT32
     • BIOS/legacy systems: system partition must be NTFS
   • On some guidance, the system partition should be at least 350 MB in size.
3. Check boot and recovery dependencies.
   • BitLocker depends on boot files being on the separate system partition.
   • Windows RE should be enabled.
   • Run reagentc.exe to verify Windows RE status.
   • If Windows RE is not configured, BitLocker provisioning can stop.
   • Windows RE boot files must be on a volume that is not protected by BitLocker.
4. Review policy, TPM, and platform state.
   • Export configuration details from an elevated Command Prompt:

          gpresult.exe /h <Filename>
          msinfo.exe /report <Path> /computer <ComputerName>
     

   • Export these registry keys in Registry Editor:
     • HKLM\SOFTWARE\Policies\Microsoft\FVE
     • HKLM\SYSTEM\CurrentControlSet\Services\TPM\
   • Check TPM state by reviewing the output of the get-tpm PowerShell cmdlet.
   • Local Administrators membership is required to turn on or change BitLocker on operating system drives.
5. Determine whether the device is TPM or non-TPM.
   • If there is no TPM, BitLocker can still protect the OS drive only if BIOS or UEFI can read a USB flash drive during boot.
   • In that case, use a startup key on USB and run the BitLocker system check before encryption to confirm the platform can read the key material at boot.
6. Use supported remediation options for partition layout.
   • If the disk does not already have the required split layout, use the BitLocker Drive Preparation Tool where applicable. It can:
     • create the second volume BitLocker requires
     • migrate boot files to the new volume
     • make the new volume active
   • After the tool finishes, restart the computer, then enable BitLocker from Control Panel.
   • The tool has strict requirements, including a basic disk, primary NTFS partition, no compression, and no software RAID/spanning/mirroring.
7. Validate the expected end state.
   • A supported layout has:
     • separate OS and system partitions
     • correct system partition format for the firmware type
     • unencrypted system partition
     • sufficient free space on the system partition
     • Windows RE available on an unencrypted volume
     • healthy volumes and valid boot files

If the layout is still unsupported after these checks, the most likely blockers are:

• missing separate system partition
• wrong file system on the system partition for the firmware type
• encrypted system partition
• insufficient system partition space
• missing or misconfigured Windows RE
• unhealthy or missing recovery partition

• BitLocker planning guide
• Description of the BitLocker Drive Preparation Tool | Microsoft Support
• BitLocker drive encryption in Windows 11 for OEMs
• BitLocker Drive Encryption
• BitLocker FAQ
• Guidelines for troubleshooting BitLocker
• Enforcing BitLocker policies by using Intune: known issues