Update of the motherboard BIOS caused BitLocker problems.
Update of the motherboard BIOS caused BitLocker problems.
I changed my motherboard, a Gigabyte B850 EAGLE WIFI6E, from BIOS version F6 to F8 recently. Afterwards, the main boot drive won’t unlock automatically and always requires me to input the recovery key. I tried resetting the secure boot settings, clearing the TPM, switching from AMD fTPM to Microsoft Pluton fTPM, and deleting the protectors through manage-bde, but nothing worked. Under the new BIOS, the system isn’t saving BitLocker keys correctly in the TPM, even though the TPM functions properly elsewhere. The error messages appear differently now. When checking, BitLocker requests PCRs 0, 2, 4, and 11 instead of the expected 7 and 11, and I can’t connect to them. I understand Microsoft is rolling out new certificates that will expire soon, which might be contributing to the problem. Any suggestions or assistance would be greatly appreciated.
Based on what you discovered, it’s recommended to pause BitLocker before updating your BIOS to avoid conflicts. If the BIOS update alters security settings, you can access Windows using the recovery key. You might also consider disabling BitLocker temporarily and then re-enabling it after the reboot.
I paused BitLocker prior to the upgrade, yet it seems the BIOS modifications could affect more than before. I managed to revert the BIOS to version F6 and everything is functioning properly again. I plan to keep it at F6 until the next update fixes this. Through additional investigation, I also understand that PCR7 was probably never enabled on this machine. The F8 feature does contain an AGESA update, which I suspect relates to this issue.