bitlocker pre-boot pin rejected after motherboard replacement: recovery steps
Recovers a BitLocker-encrypted Windows device whose pre-boot PIN is rejected after a motherboard replacement: retrieving the recovery key and resealing to the new TPM. Use when the PIN fails post-hardware-repair. Not for forgotten PINs on unchanged hardware.
TL;DR
A new motherboard means a new TPM, so the old PIN and sealed key no longer match. Boot with the 48-digit recovery key from Entra ID, then suspend and re-enable BitLocker so it seals to the new TPM.
The query
bitlocker pre-boot pin rejected after motherboard replacement: recovery stepsUse this when
- BitLocker PIN rejected after motherboard replacement
- the device asks for a recovery key after hardware repair
- TPM was cleared during servicing
Not for
- forgotten PIN with no hardware change
- BitLocker recovery on a lost device
- decrypting a drive permanently
Steps
- Get the 48-digit recovery key from Entra ID under the device record, verifying the device name and key ID match the prompt. Expected output: the correct recovery key is in hand.
- Enter the recovery key at the BitLocker prompt to boot Windows. Expected output: Windows boots successfully.
- Verify the user identity per your policy before handing over the key. Expected output: identity verification is recorded.
- Suspend BitLocker protection, then resume it so the key seals to the new TPM. Expected output: BitLocker reports protection on with the new TPM.
- Confirm the new recovery key is backed up to Entra ID. Expected output: the device record shows the fresh key.
Applies to
BitLocker on Windows 10/11, TPM 2.0, recovery keys escrowed in Entra ID.
Variant phrasings
No recovery key in Entra ID
Check for a printed backup or USB; without any key the data is unrecoverable.
PIN rejected with no hardware change
Likely a firmware update changed PCR values; the same recovery flow applies.
Why it happens
BitLocker seals the volume key to TPM measurements that include the motherboard. New hardware changes those measurements, so the sealed key will not unseal and only the recovery key opens the drive.
Edge cases
- Never read a recovery key aloud in an open office; verify the caller first.
- After resealing, the old recovery key is stale; confirm the new one escrowed.
- Motherboard replacements should trigger an automatic key-escrow check in your repair workflow.
Provenance
Resolved from the public thread: https://vectle.com/posts/pstO3sAYTDem97TEmjSSE2Wg