BitLocker 0xC021001A: TPM + PIN not working fix

When this error hits

You boot your Windows 10 or 11 machine, see the BitLocker PIN screen, type it in, and then get slapped with error 0xC021001A. The screen says something like "The BitLocker encryption key could not be obtained from the TPM and PIN." This usually happens right after a BIOS update, a TPM firmware update, or if you swapped hardware like the motherboard or SSD. I've also seen it after a CMOS battery replacement that cleared TPM settings.

The culprit here is almost always that the TPM chip lost its stored key material. It's not a corrupt drive or a bad password — it's the TPM and PIN combo that broke.

Root cause explained simply

BitLocker with TPM + PIN uses the TPM to store a secret that, when combined with your PIN, unlocks the drive. The TPM holds a hash of the PIN plus the encryption key. When you update BIOS or reset the TPM, that stored secret gets wiped. So the system can't verify your PIN anymore — hence the error. It's not your fault, it's a security feature that bit you.

Important: Your data is still encrypted and safe. You just need to give BitLocker a different way to unlock the drive — the recovery key.

The fix — step by step

Step 1: Get your BitLocker recovery key

Before you do anything else, find that 48-digit recovery key. Without it, you're stuck. Check these places:

• Your Microsoft account: login.microsoftonline.com, go to Devices > BitLocker recovery keys
• Your domain admin (if it's a work PC)
• A printed copy or file you saved

Don't have it? You're in trouble. If this is a company machine, call your IT department. For personal machines, check if you saved it to a USB drive or printed it during setup.

Step 2: Boot into recovery mode

On the error screen, you should see an option to press Enter to try again or Escape to skip. Press Escape. If you don't see that, press and hold the power button to force shutdown. Boot again and let it fail — then you'll get the recovery screen.

Step 3: Enter the recovery key

Type the 48-digit key using the on-screen keyboard or a physical keyboard. Be careful — one wrong digit and it fails. Hit Enter. Windows should boot normally.

Step 4: Suspend BitLocker protection

Once you're in Windows, open an elevated Command Prompt (right-click Start > Windows Terminal (Admin)). Run this command:

manage-bde -protectors -disable C:

This suspends BitLocker protection. It does NOT decrypt your drive — it just tells Windows to skip the TPM + PIN check on next boot. You'll still be protected by the recovery key if something changes.

Step 5: Clear and reinitialize the TPM

Now reset the TPM so it gets a fresh start. In the same admin terminal, run:

tpm.msc

In the TPM Management window, click "Clear TPM" on the right. Your PC will reboot. After reboot, Windows will reinitialize the TPM automatically.

Step 6: Re-enable BitLocker with a new PIN

After the TPM is ready, open an admin Command Prompt again and run:

manage-bde -protectors -enable C:

Then add a new PIN:

manage-bde -protectors -add C: -TPMAndPIN

You'll be prompted to enter a new PIN. Use something you'll remember but not obvious. Confirm it. Windows will store the new key in the TPM.

Step 7: Test it

Restart your machine. You should see the BitLocker PIN screen again. Type your new PIN. If it works, you're done. If not, go to the next section.

Still failing? Check these

• BIOS settings: Make sure TPM is enabled in BIOS. Look for "TPM 2.0", "Intel PTT", or "AMD fTPM". It must be set to enabled, not hidden or disabled.
• Secure Boot: Some systems require Secure Boot to be on for TPM + PIN to work. Check that it's enabled in BIOS.
• TPM firmware version: If you updated the TPM firmware, it might have cleared the endorsement key. Run get-tpm in PowerShell to see if TPM is ready. If it says "TpmReady: False", you need to initialize it again via the BIOS.
• Windows updates: I've seen a handful of cases where a specific Windows update (like KB5003690 on Windows 10) messed up BitLocker. If you can boot into Windows using the recovery key, check for pending updates and install them.
• Hardware issue: If you recently replaced the motherboard or SSD, the TPM chip is tied to the motherboard. You can't reuse the old TPM key. You'll have to decrypt and re-encrypt the drive — that's a last resort.

One last thing: if you're in a hurry and just want to get back to work, you can permanently disable BitLocker (decrypt the drive) by running manage-bde -off C:. But that removes encryption, so only do that if you're sure. I'd recommend fixing the PIN instead.