BitLocker is a tool included in Windows 7 (Enterprise and Ultimate), Windows 8.1 (Pro and Enterprise) and Windows 10 (Pro and Enterprise) that can be used to encrypt data on any drive. However, in order to encrypt your system drive, you must have a TPM chip in your computer. If you don’t, it is still possible to use BitLocker but you need to set Windows so that it allows the use of BitLocker without this chip. In this article I will first explain the use of a TPM chip (what it is and why it is used) and how to set Windows so that it does not to require this chip in order to encrypt your system drive with BitLocker. There’s plenty of ground to cover, so let’s get started:
NOTE: The instructions in this guide apply to Windows 7 Enterprise, Windows 7 Ultimate, Windows 8.1 Pro, Windows 8.1 Enterprise, Windows 10 Pro and Windows 10 Enterprise.
What is a TPM (Trusted Platform Module) chip?
A TPM chip is a device used to generate secure & unique cryptographic keys and store them in an encrypted fashion, so that this data can be used to authenticate hardware devices. The cryptographic keys are encrypted and can be decrypted only by the TPM chip which created and encrypted them.
Encryption software like BitLocker in Windows 7, Windows 8.1 and Windows 10 use the TPM chip to protect the keys used to encrypt your computer’s data. Then, it is used to authenticate your encrypted computer and give you access to all the encrypted data when the device trying to access it is identified as trusted. Since the key stored in each TPM chip is unique to that device, encryption software can quickly verify that the system seeking access to the encrypted data is the expected system and not a different one.
Lots of different encryption software uses or supports the use of a TPM chip. Computers with TPM chips are produced by all major vendors (from Acer to Samsung to Dell and HP) but they are included mostly in computers designed for business use and sold to businesses. TPM chips tend not to be included in computers sold to home users.
If you want to learn more about these chips, we recommend that you read the following articles: Windows Trusted Platform Module Management Step-by-Step Guide and Trusted Platform Module.
Are you trying to use BitLocker without a TPM chip? Windows has a problem with that!
If you are trying to use BitLocker to encrypt your system drive and you don’t have a TPM chip in your computer, you will receive an error message. In Windows 7 the message states: "A compatible Trusted Platform Module (TPM) Security Device must be present on this computer, but a TPM was not found. Please contact your system administrator to enable BitLocker."
In Windows 8.1, the message is even more clear: "This device can’t use a Trusted Platform Module. Your administrator must set the ‘Allow BitLocker without a compatible TPM’ option in the ‘Require additional authentication at startup’ policy for OS volumes."
We like the error message in Windows 8.1 a lot better because it also points you in the right direction and shows you how to fix this problem.
In Windows 10, the message is identical to the one displayed by Windows 8.1: "This device can’t use a Trusted Platform Module. Your administrator must set the ‘Allow BitLocker without a compatible TPM’ option in the ‘Require additional authentication at startup’ policy for OS volumes."
Read the next page of this tutorial to learn how to use the Local Group Policy Editor for setting the policy which allows you to use BitLocker encryption without a TPM chip.