BitLocker Recovery Prompt When Using a New Thunderbolt Dock

Question

BitLocker Recovery Prompt When Using a New Thunderbolt Dock

William Carter 0

Hello community, after introducing a new Thunderbolt dock model, laptops connected to the dock started asking for the BitLocker recovery key during startup. It appears that the dock is causing changes to the TPM PCR measurements, which BitLocker interprets as a change in the trusted boot environment. How can we update the TPM PCR binding profile so that the laptops can boot normally without triggering BitLocker recovery when connected to this dock?

Many thanks.

0 comments

2 answers

Your answer

Answer 1

Hello,

The new Thunderbolt dock is changing TPM PCR measurements, so BitLocker detects a different boot environment and triggers recovery. The supported fix is to suspend BitLocker, boot once with the new dock connected, then resume BitLocker so the TPM protector is resealed with the new PCR values.

BAT

manage-bde -protectors -disable C:

``Reboot with the dock connected, then run:

BAT

manage-bde -protectors -enable C:

You can verify the current PCR profile using:

BAT

manage-bde -protectors -get C:

Avoid modifying the PCR validation profile unless absolutely necessary, as it reduces BitLocker security.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Domic V.

Answer 2

BitLocker recovery is expected when the TPM protector’s PCR validation profile no longer matches the measured boot state. A new dock can contribute to that if the boot environment changes and those changes affect PCRs used by BitLocker.

The supported way to reset BitLocker’s TPM validation profile is to:

Unlock the device with the BitLocker recovery key.
Start Windows normally.
Identify the current protector configuration and PCR profile from an elevated command prompt:
```
   manage-bde.exe -protectors -get C:
```
This shows which PCRs are currently in use.
Check why recovery was triggered by reviewing BitLocker-related events:
- Application and Services Logs > Microsoft > Windows > BitLocker-API > Management
- Windows Logs > System filtered for BitLocker sources
Reset BitLocker protection so the TPM protector is resealed to the current trusted state by suspending and then resuming BitLocker.

Important points:

BitLocker recovery can be triggered by changes to the boot manager, firmware, Secure Boot state, docking or undocking a portable computer, or modifying the PCRs used by the TPM validation profile.
If PCR 7 is in use, BitLocker expects Secure Boot measurements to remain consistent. If Secure Boot is disabled or its measurements change, recovery can occur.
If the root cause is an intended hardware or firmware-related change, resetting protection after the device is in the desired configuration prevents recovery on every startup.
If the root cause cannot be determined, or if tampering or malware is suspected, the device should be investigated before resealing BitLocker.

If the environment is using a nondefault PCR profile, verify that configuration first. On Surface and other modern devices that support it, BitLocker commonly uses PCR 7 and PCR 11 by default when Secure Boot is correctly configured.

References: