Management of Native Encryption 5.x user enters into an endless recovery loop on a Surface Pro 4 Tablet

Technical Articles ID: KB91314
Last Modified: 10/4/2022

Environment

Management of Native Encryption (MNE) 5.0.0 and later
Microsoft Surface Pro 4 Tablet

Summary

MNE relies on Microsoft BitLocker to perform full disk encryption. But, there's an issue with Microsoft BitLocker that affects the functionality of the recovery feature of Preboot when it runs on a Surface Pro 4 tablet.

Problem

After a user clicks the 'Forgot my password' link, while at the Preboot screen, they're guided through the recovery process provided by Microsoft BitLocker. This process involves entering a 48-digit recovery key to access the drive.

When the above is performed on the Surface Pro 4 tablet, Microsoft BitLocker accepts the recovery key without actually recovering the drive.

The above leads to a system restart, and thus traps the user in an endless loop.

Solution

This situation can be avoided. Install Microsoft Windows 10 version 1803 (April 2018 Update) or later on systems that run Preboot protection.

IMPORTANT: It's not possible to update the operating system for systems that have already entered the state described in this article. For those systems, implement the workaround below first, and then upgrade to Windows 10 version 1803.

Workaround

Enter the 'Recovery/Command Prompt' and manually enter the recovery key. Skip the initial prompt to enter the recovery key and instead follow the Troubleshooting workflow.

While Preboot is shown, initiate the recovery process by clicking the 'Forgot my password' link. A series of Microsoft BitLocker recovery screens is shown.
At the first Microsoft BitLocker recovery screen, choose to skip inserting a USB recovery drive by pressing the ESCAPE key. Another Microsoft BitLocker recovery screen is shown.
At the second Microsoft BitLocker recovery screen, choose to skip typing a recovery key by pressing the ESCAPE key. A further Microsoft BitLocker recovery screen is shown.
At the third Microsoft BitLocker recovery screen, confirm the intention to skip inserting a USB drive (or typing a key) by clicking 'Skip this drive.' An extended selection of options is shown.
From the new options shown, select Troubleshoot. A limited set of further options is shown.
From these limited options, select Advanced options. A further extended set of options is shown.
From these extended options, select Command Prompt. A command-prompt window is shown.
In this command prompt window, enter the following two commands:

Manage-bde -unlock <drive-letter-with-colon> -rp <recovery-key-with-dashes>

Here:
<drive-letter-with-colon> - The drive-letter, with a trailing colon, of the drive containing Windows; for example: C:, D:, or E:.
<recovery-key-with-dashes> - The 48-digit recovery key retrieved via ePolicy Orchestrator

Manage-bde -protectors -disable <drive-letter-with-colon>

Here:
<drive-letter-with-colon> - The same drive-letter as above

Exit the command-prompt. Either close the window or enter the exit command. The original set of recovery options is presented.
From the original list of options, select Continue. This action exits the recovery workflow and boots into Windows 10.
The user is presented with the Windows 10 logon screen and must follow their organizational policy for resetting their password.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Management of Native Encryption 5.x user enters into an endless recovery loop on a Surface Pro 4 Tablet

Environment

Summary

Problem

Solution

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

Management of Native Encryption 5.x user enters into an endless recovery loop on a Surface Pro 4 Tablet

Environment

Summary

Problem

Solution

Workaround

Affected Products

Languages:

Choose your region

Title

Title