Bitlocker on surface pro 3

Erica Cutrone 0 Reputation points
2026-09-19T12:12:04.12+00:00

Every time I turn on my computer the Bitlocker Screen turns back on and i need to enter to code to access my surface pro 3

Surface | Surface Pro | Safety and security
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Thomas4-N 21,930 Reputation points Microsoft External Staff Moderator
    2026-09-20T11:29:33.52+00:00

    Hello Erica Cutrone,

    If you can enter the BitLocker recovery key and then get into Windows normally, I would not try the boot repair commands yet.

    Could you confirm whether the Surface starts normally after you enter the recovery key?

    If it does, Microsoft documents a Surface-specific situation where BitLocker can repeatedly enter recovery because of TPM/UEFI, Secure Boot, or PCR configuration. The guidance specifically includes Surface Pro 3. In that case, we can focus on the BitLocker/TPM configuration rather than repairing Windows startup.

    If Windows does not start even after you enter the correct recovery key, let me know, because Microsoft provides a different recovery procedure for that situation.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-09-19T12:12:20.09+00:00

    If the Surface Pro 3 does boot into Windows after entering the recovery key, the supported first step is to suspend BitLocker once, restart, and then resume protection:

    1. Open Control Panel > BitLocker Drive Encryption.
    2. Next to the system drive, select Suspend protection.
    3. Restart the Surface normally.
    4. Go back to BitLocker Drive Encryption and select Resume protection.

    If the problem started after a Surface firmware, UEFI, or TPM update, this repeated recovery prompt can happen when BitLocker is using PCR values other than the default PCR 7 and PCR 11, such as when Secure Boot is off or PCR values were changed by policy.

    If the device does not start normally even after entering the correct recovery key, use Windows Recovery Environment and repair the boot records:

    1. Force two failed boot attempts so the device enters Windows Recovery Environment (WinRE).
    2. Go to Troubleshoot > Advanced options > Command Prompt.
    3. Enter the BitLocker recovery key if prompted.
    4. Run: 
         bootrec /scanos
   bootrec /rebuildbcd
   bootrec /fixmbr
   bootrec /fixboot

    If the issue is specifically tied to a Surface TPM or UEFI update and Windows still will not start, the documented recovery path is:

    1. Get the BitLocker recovery password.
    2. Create a Surface recovery image USB on another computer.
    3. Boot the Surface from that USB.
    4. Open Troubleshoot > Advanced Options > Command Prompt.
    5. Unlock the OS drive and disable TPM protectors: 
         manage-bde.exe -unlock -recoverypassword <Password> <DriveLetter>:
   manage-bde.exe -protectors -disable <DriveLetter>:
    6. Restart and enter the recovery password again if prompted.

    Important: disabling protectors reduces BitLocker protection until it is turned back on. After Windows starts, re-enable protection from Manage BitLocker.

    To help prevent the issue from returning after firmware-related changes:

    • Verify Secure Boot is set to Microsoft Only in Surface UEFI.
    • Restore default PCR usage if Group Policy changed it.
    • On Surface devices, the default BitLocker binding is PCR 7 and PCR 11 when Secure Boot is correctly configured.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.