Fix FVE_E_WRONG_BOOTSECTOR 0x8031002A BitLocker

BitLocker won't enable with FVE_E_WRONG_BOOTSECTOR when the boot sector isn't TPM-measurable. Usually a third-party boot loader or corrupted MBR. Fix it with bcdboot.

Quick answer: The TPM can't hash your boot sector because something non-standard is sitting in it—usually Grub, a cloned drive with a mismatched MBR, or a BIOS-mode install on a UEFI machine. Rebuild the boot files or fix the boot mode and BitLocker will enable.

You'll see this one when you try to turn on BitLocker and Windows throws 0X8031002A at you. The full text is "The system partition boot sector does not perform TPM measurements." What that actually means: before Windows encrypts anything, it asks the TPM to measure the boot chain—first the MBR or EFI system partition, then the boot manager, then winload, then the kernel. If the very first thing the TPM tries to measure doesn't look like a standard Windows boot sector, the measurement fails and BitLocker refuses to proceed. It's a safety check, not a corruption.

The culprit here is almost always one of three things. A third-party boot manager (Grub, rEFInd, EasyBCD, old Acronis loaders) has overwritten the MBR with custom code the TPM won't touch. Or the disk was cloned from another machine and the MBR is signed with the wrong disk signature. Or—my favorite—someone installed Windows in legacy BIOS mode on a machine that's actually booting UEFI, or vice versa. Windows sees a boot sector that doesn't match the expected format for the firmware mode and bails.

I've hit this most often on refurbished Dells and HPs that came in with cloned images. The tech before me used Macrium Reflect to clone a drive, didn't run the boot repair, and now BitLocker won't enable. Takes ten minutes to fix once you know what you're looking at.

Step-by-step fix

Confirm your boot mode. Boot into Windows and run:
```
msinfo32
```
Look at BIOS Mode. If it says UEFI, your system partition should be FAT32 and contain \EFI\Microsoft\Boot\bootmgfw.efi. If it says Legacy, you should have a 500 MB system reserved partition or an NTFS C: active partition with bootmgr on it. Mismatches here cause this error every time.
Back up the BCD. Don't skip this. From an elevated command prompt:
```
bcdedit /export C:\bcd_backup
```
You'll thank yourself if the next step goes sideways.
Rebuild the boot files. This is the actual fix nine times out of ten. Mount your EFI system partition (or use the active system partition if you're legacy) and rebuild:
```
mountvol S: /s
bcdboot C:\Windows /s S: /f UEFI
```
For a legacy BIOS system, swap the last flag:
```
bcdboot C:\Windows /s C: /f BIOS
```
If you don't know which mode you should be in, match it to what msinfo32 reports. Rebuilding with the wrong firmware flag just recreates the problem.
Fix the MBR if you're in legacy mode. If bcdboot alone doesn't cut it, repair the MBR code:
```
bootrec /fixmbr
bootrec /fixboot
bootrec /rebuildbcd
```
On a UEFI system, bootrec /fixmbr writes a BIOS-style MBR and can make things worse. Skip it unless you're certain you're in legacy mode.
Wipe any third-party boot loader. If EasyBCD, Grub, or a vendor recovery partition utility has touched the MBR, bcdboot won't always overwrite it. Boot from Windows install media (Shift+F10 for a command prompt) and run:
```
bootsect /nt60 SYS /mbr
```
This rewrites the boot sector with Microsoft's standard code, which is exactly what the TPM wants to measure.
Reboot and retry BitLocker. Don't just click through Control Panel. Run it from an elevated prompt so you see the real error if it fails again:
```
manage-bde -on C: -used
```
If it succeeds, you'll see progress and eventually a recovery key prompt. Save that key somewhere off the machine.

If that doesn't work

Sometimes the disk signature is the issue. On a cloned drive, the MBR disk signature is duplicated from the source machine. Windows flags this as a non-standard boot sector in some scenarios. You can rewrite the signature with bcdedit /set {default} ...—no, actually, that won't help. Use diskpart:

diskpart
list disk
select disk 0
uniqueid disk
uniqueid disk ID=NEWGUID

Then rerun the bcdboot step. This is rare but I've seen it twice on Dells that were imaged from a golden master without sysprep.

If you're on a machine with a non-Microsoft recovery partition that boots ahead of Windows, you might need to disable it in firmware or physically remove the boot entry. Some Lenovo and Acer machines ship with a recovery environment that boots before Windows and it confuses the TPM measurement. Check bcdedit /enum firmware and delete anything suspicious with bcdedit /delete.

And if all else fails, a clean install on a freshly initialized GPT disk with the firmware set to UEFI and Secure Boot on will work every time. It's the nuclear option but for factory-refurb machines sometimes it's faster than chasing a mystery boot loader.

Prevention

When you clone drives, always run bcdboot on the destination before you ship the machine. Never install a third-party boot manager on a machine that's going to use BitLocker unless you're prepared to disable the TPM protector entirely. And verify the firmware mode before you install Windows—installing legacy BIOS on a UEFI-capable box is asking for this exact error six months later when someone tries to enable encryption.