mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-15 18:33:43 +00:00
Merge branch 'master' into nimishasatapathy-4939910
This commit is contained in:
Diana Hanson
GitHub
@ -22,7 +22,7 @@ ms.topic: troubleshooting
|
||||
There are several reasons why a Windows-based computer may have problems during startup. To troubleshoot boot problems, first determine in which of the following phases the computer gets stuck:
|
||||
|
||||
|
||||
| **Phase** | **Boot Process** | **BIOS** | **UEFI** |
|
||||
| Phase | Boot Process | BIOS | UEFI |
|
||||
|-----------|----------------------|------------------------------------|-----------------------------------|
|
||||
| 1 | PreBoot | MBR/PBR (Bootstrap Code) | UEFI Firmware |
|
||||
| 2 | Windows Boot Manager | %SystemDrive%\bootmgr | \EFI\Microsoft\Boot\bootmgfw.efi |
|
||||
@ -73,10 +73,12 @@ Each phase has a different approach to troubleshooting. This article provides tr
|
||||
To determine whether the system has passed the BIOS phase, follow these steps:
|
||||
|
||||
1. If there are any external peripherals connected to the computer, disconnect them.
|
||||
|
||||
2. Check whether the hard disk drive light on the physical computer is working. If it is not working, this indicates that the startup process is stuck at the BIOS phase.
|
||||
|
||||
3. Press the NumLock key to see whether the indicator light toggles on and off. If it does not, this indicates that the startup process is stuck at BIOS.
|
||||
|
||||
If the system is stuck at the BIOS phase, there may be a hardware problem.
|
||||
If the system is stuck at the BIOS phase, there may be a hardware problem.
|
||||
|
||||
## Boot loader phase
|
||||
|
||||
@ -105,29 +107,31 @@ To do this, follow these steps.
|
||||
|
||||
2. On the **Install Windows** screen, select **Next** > **Repair your computer**.
|
||||
|
||||
3. On the **System Recovery Options** screen, select **Next** > **Command Prompt**.
|
||||
3. On the **Choose an option** screen, select **Troubleshoot**.
|
||||
|
||||
4. After Startup Repair, select **Shutdown**, then turn on your PC to see if Windows can boot properly.
|
||||
4. On the **Advanced options** screen, select **Startup Repair**.
|
||||
|
||||
5. After Startup Repair, select **Shutdown**, then turn on your PC to see if Windows can boot properly.
|
||||
|
||||
The Startup Repair tool generates a log file to help you understand the startup problems and the repairs that were made. You can find the log file in the following location:
|
||||
|
||||
**%windir%\System32\LogFiles\Srt\Srttrail.txt**
|
||||
|
||||
|
||||
For more information see, [A Stop error occurs, or the computer stops responding when you try to start Windows Vista or Windows 7](https://support.microsoft.com/help/925810/a-stop-error-occurs-or-the-computer-stops-responding-when-you-try-to-s)
|
||||
For more information, see [A Stop error occurs, or the computer stops responding when you try to start Windows Vista or Windows 7](https://support.microsoft.com/help/925810/a-stop-error-occurs-or-the-computer-stops-responding-when-you-try-to-s)
|
||||
|
||||
|
||||
### Method 2: Repair Boot Codes
|
||||
|
||||
To repair boot codes, run the following command:
|
||||
|
||||
```dos
|
||||
```console
|
||||
BOOTREC /FIXMBR
|
||||
```
|
||||
|
||||
To repair the boot sector, run the following command:
|
||||
|
||||
```dos
|
||||
```console
|
||||
BOOTREC /FIXBOOT
|
||||
```
|
||||
|
||||
@ -139,51 +143,54 @@ BOOTREC /FIXBOOT
|
||||
If you receive BCD-related errors, follow these steps:
|
||||
|
||||
1. Scan for all the systems that are installed. To do this, run the following command:
|
||||
```dos
|
||||
|
||||
```console
|
||||
Bootrec /ScanOS
|
||||
```
|
||||
|
||||
2. Restart the computer to check whether the problem is fixed.
|
||||
|
||||
3. If the problem is not fixed, run the following command:
|
||||
```dos
|
||||
|
||||
```console
|
||||
Bootrec /rebuildbcd
|
||||
```
|
||||
|
||||
4. You might receive one of the following outputs:
|
||||
```dos
|
||||
|
||||
```console
|
||||
Scanning all disks for Windows installations. Please wait, since this may take a while ...
|
||||
Successfully scanned Windows installations. Total identified Windows installations: 0
|
||||
The operation completed successfully.
|
||||
```
|
||||
|
||||
```dos
|
||||
```console
|
||||
Scanning all disks for Windows installations. Please wait, since this may take a while ...
|
||||
Successfully scanned Windows installations. Total identified Windows installations: 1
|
||||
D:\Windows
|
||||
Add installation to boot list? Yes/No/All:
|
||||
```
|
||||
|
||||
If the output shows **windows installation: 0**, run the following commands:
|
||||
|
||||
```dos
|
||||
bcdedit /export c:\bcdbackup
|
||||
|
||||
attrib c:\\boot\\bcd -r –s -h
|
||||
|
||||
ren c:\\boot\\bcd bcd.old
|
||||
|
||||
bootrec /rebuildbcd
|
||||
```
|
||||
|
||||
After you run the command, you receive the following output:
|
||||
|
||||
```dos
|
||||
Scanning all disks for Windows installations. Please wait, since this may take a while ...
|
||||
Successfully scanned Windows installations. Total identified Windows installations: 1
|
||||
{D}:\Windows
|
||||
Add installation to boot list? Yes/No/All: Y
|
||||
```
|
||||
If the output shows **windows installation: 0**, run the following commands:
|
||||
|
||||
```console
|
||||
bcdedit /export c:\bcdbackup
|
||||
|
||||
attrib c:\\boot\\bcd -r –s -h
|
||||
|
||||
ren c:\\boot\\bcd bcd.old
|
||||
|
||||
bootrec /rebuildbcd
|
||||
```
|
||||
|
||||
After you run the command, you receive the following output:
|
||||
|
||||
```console
|
||||
Scanning all disks for Windows installations. Please wait, since this may take a while ...
|
||||
Successfully scanned Windows installations. Total identified Windows installations: 1
|
||||
{D}:\Windows
|
||||
Add installation to boot list? Yes/No/All: Y
|
||||
```
|
||||
|
||||
5. Try restarting the system.
|
||||
|
||||
@ -194,17 +201,20 @@ If methods 1, 2 and 3 do not fix the problem, replace the Bootmgr file from driv
|
||||
1. At a command prompt, change the directory to the System Reserved partition.
|
||||
|
||||
2. Run the **attrib** command to unhide the file:
|
||||
```dos
|
||||
|
||||
```console
|
||||
attrib -r -s -h
|
||||
```
|
||||
|
||||
3. Run the same **attrib** command on the Windows (system drive):
|
||||
```dos
|
||||
|
||||
```console
|
||||
attrib -r -s -h
|
||||
```
|
||||
|
||||
4. Rename the Bootmgr file as Bootmgr.old:
|
||||
```dos
|
||||
|
||||
```console
|
||||
ren c:\bootmgr bootmgr.old
|
||||
```
|
||||
|
||||
@ -230,6 +240,7 @@ If the system gets stuck during the kernel phase, you experience multiple sympto
|
||||
- A Stop error appears after the splash screen (Windows Logo screen).
|
||||
|
||||
- Specific error code is displayed.
|
||||
|
||||
For example, "0x00000C2" , "0x0000007B" , "inaccessible boot device" and so on.
|
||||
- [Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device](./troubleshoot-inaccessible-boot-device.md)
|
||||
- [Advanced troubleshooting for Event ID 41 "The system has rebooted without cleanly shutting down first"](troubleshoot-event-id-41-restart.md)
|
||||
@ -317,19 +328,21 @@ To fix problems that occur after you install Windows updates, check for pending
|
||||
1. Open a Command Prompt window in WinRE.
|
||||
|
||||
2. Run the command:
|
||||
```dos
|
||||
|
||||
```console
|
||||
DISM /image:C:\ /get-packages
|
||||
```
|
||||
|
||||
3. If there are any pending updates, uninstall them by running the following commands:
|
||||
```dos
|
||||
|
||||
```console
|
||||
DISM /image:C:\ /remove-package /packagename: name of the package
|
||||
```
|
||||
```dos
|
||||
```console
|
||||
DISM /Image:C:\ /Cleanup-Image /RevertPendingActions
|
||||
```
|
||||
|
||||
Try to start the computer.
|
||||
Try to start the computer.
|
||||
|
||||
If the computer does not start, follow these steps:
|
||||
|
||||
@ -377,14 +390,18 @@ If the dump file shows an error that is related to a driver (for example, window
|
||||
- If the driver is not important and has no dependencies, load the system hive, and then disable the driver.
|
||||
|
||||
- If the stop error indicates system file corruption, run the system file checker in offline mode.
|
||||
|
||||
- To do this, open WinRE, open a command prompt, and then run the following command:
|
||||
```dos
|
||||
|
||||
```console
|
||||
SFC /Scannow /OffBootDir=C:\ /OffWinDir=E:\Windows
|
||||
```
|
||||
|
||||
For more information, see [Using System File Checker (SFC) To Fix Issues](/archive/blogs/askcore/using-system-file-checker-sfc-to-fix-issues)
|
||||
|
||||
- If there is disk corruption, run the check disk command:
|
||||
```dos
|
||||
|
||||
```console
|
||||
chkdsk /f /r
|
||||
```
|
||||
|
||||
@ -397,4 +414,4 @@ If the dump file shows an error that is related to a driver (for example, window
|
||||
5. Copy all the hives from the Regback folder, paste them in the Config folder, and then try to start the computer in Normal mode.
|
||||
|
||||
> [!NOTE]
|
||||
> Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder.This change is by design, and is intended to help reduce the overall disk footprint size of Windows. To recover a system with a corrupt registry hive, Microsoft recommends that you use a system restore point. For more details, check [this article](https://support.microsoft.com/en-us/help/4509719/the-system-registry-is-no-longer-backed-up-to-the-regback-folder-start).
|
||||
> Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder.This change is by design, and is intended to help reduce the overall disk footprint size of Windows. To recover a system with a corrupt registry hive, Microsoft recommends that you use a system restore point. For more details, check [this article](https://support.microsoft.com/en-us/help/4509719/the-system-registry-is-no-longer-backed-up-to-the-regback-folder-start).
|
||||
|
||||
@ -104,7 +104,7 @@ where:
|
||||
- `<remove member>`: Specifies the SID or name of the member to remove from the specified group.
|
||||
|
||||
> [!NOTE]
|
||||
> When specifying member names of the user accounts, you must use following format – AzureAD/userUPN. For example, "AzureAD/user1@contoso.com" or "AzureAD/user2@contoso.co.uk".
|
||||
> When specifying member names of the user accounts, you must use following format – AzureAD\userUPN. For example, "AzureAD\user1@contoso.com" or "AzureAD\user2@contoso.co.uk".
|
||||
For adding Azure AD groups, you need to specify the Azure AD Group SID. Azure AD group names are not supported with this policy.
|
||||
for more information, see [LookupAccountNameA function](/windows/win32/api/winbase/nf-winbase-lookupaccountnamea).
|
||||
|
||||
@ -125,7 +125,7 @@ See [Use custom settings for Windows 10 devices in Intune](/mem/intune/configura
|
||||
|
||||
Example 1: AAD focused.
|
||||
|
||||
The following example updates the built-in administrators group with AAD account "bob@contoso.com" and an Azure AD group with the SID **S-1-12-1-111111111-22222222222-3333333333-4444444444. On an AAD joined machines**.
|
||||
The following example updates the built-in administrators group with AAD account "bob@contoso.com" and an Azure AD group with the SID **S-1-12-1-111111111-22222222222-3333333333-4444444444** on an AAD-joined machine.
|
||||
|
||||
```xml
|
||||
<GroupConfiguration>
|
||||
@ -239,7 +239,7 @@ To troubleshoot Name/SID lookup APIs:
|
||||
|
||||
1. Enable **lsp.log** on the client device by running the following commands:
|
||||
|
||||
```cmd
|
||||
```powershell
|
||||
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name LspDbgInfoLevel -Value 0x800 -Type dword -Force
|
||||
|
||||
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name LspDbgTraceOptions -Value 0x1 -Type dword -Force
|
||||
@ -249,11 +249,12 @@ To troubleshoot Name/SID lookup APIs:
|
||||
|
||||
2. Turn the logging off by running the following command:
|
||||
|
||||
```cmd
|
||||
```powershell
|
||||
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name LspDbgInfoLevel -Value 0x0 -Type dword -Force
|
||||
|
||||
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name LspDbgTraceOptions -Value 0x0 -Type dword -Force
|
||||
```
|
||||
|
||||
```xml
|
||||
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" version="1.0">
|
||||
<xs:simpleType name="name">
|
||||
|
||||
@ -661,6 +661,9 @@ After some time, you will have a Windows 10 Enterprise x64 image that is fully
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you encounter errors applying the image when using a BIOS firmware type, see [Windows 10 deployments fail with Microsoft Deployment Toolkit on computers with BIOS type firmware](https://support.microsoft.com/topic/windows-10-deployments-fail-with-microsoft-deployment-toolkit-on-computers-with-bios-type-firmware-70557b0b-6be3-81d2-556f-b313e29e2cb7). This
|
||||
|
||||
If you [enabled monitoring](#enable-monitoring), you can check the progress of the task sequence.
|
||||
|
||||
|
||||
|
||||
@ -87,6 +87,8 @@ Visit the [Download and install the Windows ADK](/windows-hardware/get-started/a
|
||||
- [The Windows ADK for Windows 10](https://go.microsoft.com/fwlink/?linkid=2086042)
|
||||
- [The Windows PE add-on for the ADK](https://go.microsoft.com/fwlink/?linkid=2087112)
|
||||
- [The Windows System Image Manager (WSIM) 1903 update](https://go.microsoft.com/fwlink/?linkid=2095334)
|
||||
- (Optional) [The MDT_KB4564442 patch for BIOS firmware](https://download.microsoft.com/download/3/0/6/306AC1B2-59BE-43B8-8C65-E141EF287A5E/KB4564442/MDT_KB4564442.exe)
|
||||
- This patch is needed to resolve a bug that causes detection of BIOS-based machines as UEFI-based machines. If you have a UEFI deployment, you do not need this patch.
|
||||
|
||||
>[!TIP]
|
||||
>You might need to temporarily disable IE Enhanced Security Configuration for administrators in order to download files from the Internet to the server. This setting can be disabled by using Server Manager (Local Server/Properties).
|
||||
@ -97,6 +99,7 @@ Visit the [Download and install the Windows ADK](/windows-hardware/get-started/a
|
||||
3. Start the **WinPE Setup** (D:\\Downloads\\ADK\\adkwinpesetup.exe), click **Next** twice to accept the default installation parameters, click **Accept** to accept the license agreement, and then on the **Select the features you want to install** page click **Install**. This will install Windows PE for x86, AMD64, ARM, and ARM64. Verify that the installation completes successfully before moving to the next step.
|
||||
4. Extract the **WSIM 1903 update** (D:\\Downloads\ADK\\WSIM1903.zip) and then run the **UpdateWSIM.bat** file.
|
||||
- You can confirm that the update is applied by viewing properties of the ImageCat.exe and ImgMgr.exe files at **C:\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\WSIM** and verifying that the **Details** tab displays a **File version** of **10.0.18362.144** or later.
|
||||
5. If you downloaded the optional MDT_KB4564442 patch for BIOS based deployment, see [this support article](https://support.microsoft.com/en-us/topic/windows-10-deployments-fail-with-microsoft-deployment-toolkit-on-computers-with-bios-type-firmware-70557b0b-6be3-81d2-556f-b313e29e2cb7) for instructions on how to install the patch.
|
||||
|
||||
## Install and initialize Windows Deployment Services (WDS)
|
||||
|
||||
|
||||
@ -60,7 +60,8 @@ After creating the database, you need to assign permissions to it. In MDT, the a
|
||||
|
||||
4. On the **Login - New** page, next to the **Login** name field, click **Search**, and search for **CONTOSO\\MDT\_BA**. Then in the left pane, select **User Mapping**. Select the **MDT** database, and assign the following roles:
|
||||
1. db\_datareader
|
||||
2. public (default)
|
||||
2. db\_datawriter
|
||||
3. public (default)
|
||||
5. Click **OK**, and close SQL Server Management Studio.
|
||||
|
||||
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 76 KiB After Width: | Height: | Size: 96 KiB |
@ -18,14 +18,14 @@ ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BCD settings and BitLocker
|
||||
# Boot Configuration Data settings and BitLocker
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
This topic for IT professionals describes the BCD settings that are used by BitLocker.
|
||||
This topic for IT professionals describes the Boot Configuration Data (BCD) settings that are used by BitLocker.
|
||||
|
||||
When protecting data at rest on an operating system volume, during the boot process BitLocker verifies that the security sensitive boot configuration data (BCD) settings have not changed since BitLocker was last enabled, resumed, or recovered.
|
||||
When protecting data at rest on an operating system volume, during the boot process BitLocker verifies that the security sensitive BCD settings have not changed since BitLocker was last enabled, resumed, or recovered.
|
||||
|
||||
## BitLocker and BCD Settings
|
||||
|
||||
|
||||
@ -28,7 +28,7 @@ This article for the IT professional explains how BitLocker features can be used
|
||||
|
||||
## Using BitLocker to encrypt volumes
|
||||
|
||||
BitLocker provides full volume encryption (FVE) for operating system volumes, as well as fixed and removable data volumes. To support fully encrypted operating system volumes, BitLocker uses an unencrypted system volume for the files required to boot, decrypt, and load the operating system. This volume is automatically created during a new installation of both client and server operating systems.
|
||||
BitLocker provides full volume encryption (FVE) for operating system volumes, as well as fixed and removable data drives. To support fully encrypted operating system drives, BitLocker uses an unencrypted system partition for the files required to boot, decrypt, and load the operating system. This volume is automatically created during a new installation of both client and server operating systems.
|
||||
|
||||
In the event that the drive was prepared as a single contiguous space, BitLocker requires a new volume to hold the boot files. BdeHdCfg.exe can create these volumes.
|
||||
|
||||
@ -110,9 +110,8 @@ The following table shows the compatibility matrix for systems that have been Bi
|
||||
|
||||
Table 1: Cross compatibility for Windows 10, Windows 8.1, Windows 8, and Windows 7 encrypted volumes
|
||||
|
||||
|||||
|
||||
|--- |--- |--- |--- |
|
||||
|Encryption Type|Windows 10 and Windows 8.1|Windows 8|Windows 7|
|
||||
|--- |--- |--- |--- |
|
||||
|Fully encrypted on Windows 8|Presents as fully encrypted|N/A|Presented as fully encrypted|
|
||||
|Used Disk Space Only encrypted on Windows 8|Presents as encrypt on write|N/A|Presented as fully encrypted|
|
||||
|Fully encrypted volume from Windows 7|Presents as fully encrypted|Presented as fully encrypted|N/A|
|
||||
|
||||
@ -43,7 +43,7 @@ Before Windows starts, you must rely on security features implemented as part of
|
||||
|
||||
### Trusted Platform Module
|
||||
|
||||
A TPM is a microchip designed to provide basic security-related functions, primarily involving encryption keys.
|
||||
A trusted platform module (TPM) is a microchip designed to provide basic security-related functions, primarily involving encryption keys.
|
||||
On some platforms, TPM can alternatively be implemented as a part of secure firmware.
|
||||
BitLocker binds encryption keys with the TPM to ensure that a computer has not been tampered with while the system was offline.
|
||||
For more info about TPM, see [Trusted Platform Module](/windows/device-security/tpm/trusted-platform-module-overview).
|
||||
@ -126,7 +126,7 @@ For SBP-2 and 1394 (a.k.a. Firewire), refer to the “SBP-2 Mitigation” sectio
|
||||
|
||||
## Attack countermeasures
|
||||
|
||||
This section covers countermeasures for specific types attacks.
|
||||
This section covers countermeasures for specific types of attacks.
|
||||
|
||||
### Bootkits and rootkits
|
||||
|
||||
@ -162,7 +162,7 @@ The following sections cover mitigations for different types of attackers.
|
||||
|
||||
Physical access may be limited by a form factor that does not expose buses and memory.
|
||||
For example, there are no external DMA-capable ports, no exposed screws to open the chassis, and memory is soldered to the mainboard.
|
||||
This attacker of opportunity does not use destructive methods or sophisticated forensics hardware/software.
|
||||
This attacker of opportunity does not use destructive methods or sophisticated forensics hardware/software.
|
||||
|
||||
Mitigation:
|
||||
- Pre-boot authentication set to TPM only (the default)
|
||||
@ -172,7 +172,7 @@ Mitigation:
|
||||
Targeted attack with plenty of time; this attacker will open the case, will solder, and will use sophisticated hardware or software.
|
||||
|
||||
Mitigation:
|
||||
- Pre-boot authentication set to TPM with a PIN protector (with a sophisticated alphanumeric PIN to help the TPM anti-hammering mitigation).
|
||||
- Pre-boot authentication set to TPM with a PIN protector (with a sophisticated alphanumeric PIN [enhanced pin] to help the TPM anti-hammering mitigation).
|
||||
|
||||
-And-
|
||||
|
||||
@ -197,4 +197,4 @@ For secure administrative workstations, Microsoft recommends TPM with PIN protec
|
||||
- [Blocking the SBP-2 driver and Thunderbolt controllers to reduce 1394 DMA and Thunderbolt DMA threats to BitLocker](https://support.microsoft.com/help/2516445/blocking-the-sbp-2-driver-and-thunderbolt-controllers-to-reduce-1394-d)
|
||||
- [BitLocker Group Policy settings](./bitlocker-group-policy-settings.md)
|
||||
- [BitLocker CSP](/windows/client-management/mdm/bitlocker-csp)
|
||||
- [Winlogon automatic restart sign-on (ARSO)](https://docs.microsoft.com/windows-server/identity/ad-ds/manage/component-updates/winlogon-automatic-restart-sign-on--arso-)
|
||||
- [Winlogon automatic restart sign-on (ARSO)](/windows-server/identity/ad-ds/manage/component-updates/winlogon-automatic-restart-sign-on--arso-)
|
||||
|
||||
@ -23,7 +23,7 @@ ms.custom: bitlocker
|
||||
- Windows 10
|
||||
|
||||
This topic explains how BitLocker Device Encryption can help protect data on devices running Windows 10.
|
||||
For a general overview and list of topics about BitLocker, see [BitLocker](bitlocker-overview.md).
|
||||
For a general overview and list of topics about BitLocker, see [BitLocker](bitlocker-overview.md).
|
||||
|
||||
When users travel, their organization’s confidential data goes with them. Wherever confidential data is stored, it must be protected against unauthorized access. Windows has a long history of providing at-rest data-protection solutions that guard against nefarious attackers, beginning with the Encrypting File System in the Windows 2000 operating system. More recently, BitLocker has provided encryption for full drives and portable drives. Windows consistently improves data protection by improving existing options and by providing new strategies.
|
||||
|
||||
|
||||
@ -18,17 +18,17 @@ ms.custom: bitlocker
|
||||
|
||||
# Guidelines for troubleshooting BitLocker
|
||||
|
||||
This article addresses common issues in BitLocker and provides guidelines to troubleshoot these issues. This article also provides pointers to start the troubleshooting process, including what data to collect and what settings to check in order to narrow down the location in which these issues occur.
|
||||
This article addresses common issues in BitLocker and provides guidelines to troubleshoot these issues. This article also provides information such as what data to collect and what settings to check. This information makes your troubleshooting process much easier.
|
||||
|
||||
## Review the event logs
|
||||
|
||||
Open Event Viewer and review the following logs under Applications and Services logs\\Microsoft\\Windows:
|
||||
|
||||
- **BitLocker-API**. Review the Management log, the Operational log, and any other logs that are generated in this folder. The default logs have the following unique names:
|
||||
- **BitLocker-API**. Review the management log, the operational log, and any other logs that are generated in this folder. The default logs have the following unique names:
|
||||
- Microsoft-Windows-BitLocker-API/BitLocker Operational
|
||||
- Microsoft-Windows-BitLocker-API/BitLocker Management
|
||||
|
||||
- **BitLocker-DrivePreparationTool**. Review the Admin log, the Operational log, and any other logs that are generated in this folder. The default logs have the following unique names:
|
||||
- **BitLocker-DrivePreparationTool**. Review the admin log, the operational log, and any other logs that are generated in this folder. The default logs have the following unique names:
|
||||
- Microsoft-Windows-BitLocker-DrivePreparationTool/Operational
|
||||
- Microsoft-Windows-BitLocker-DrivePreparationTool/Admin
|
||||
|
||||
@ -36,19 +36,20 @@ Additionally, review the Windows logs\\System log for events that were produced
|
||||
|
||||
To filter and display or export logs, you can use the [wevtutil.exe](/windows-server/administration/windows-commands/wevtutil) command-line tool or the [Get-WinEvent](/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-6) cmdlet.
|
||||
|
||||
For example, to use wevtutil to export the contents of the Operational log from the BitLocker-API folder to a text file that is named BitLockerAPIOpsLog.txt, open a Command Prompt window, and run a command that resembles the following:
|
||||
|
||||
For example, to use wevtutil to export the contents of the operational log from the BitLocker-API folder to a text file that is named BitLockerAPIOpsLog.txt, open a Command Prompt window, and run the following command:
|
||||
|
||||
```cmd
|
||||
wevtutil qe "Microsoft-Windows-BitLocker/BitLocker Operational" /f:text > BitLockerAPIOpsLog.txt
|
||||
```
|
||||
|
||||
To use the **Get-WinEvent** cmdlet to export the same log to a comma-separated text file, open a Windows Powershell window and run a command that resembles the following:
|
||||
To use the **Get-WinEvent** cmdlet to export the same log to a comma-separated text file, open a Windows Powershell window and run the following command:
|
||||
|
||||
```ps
|
||||
Get-WinEvent -logname "Microsoft-Windows-BitLocker/BitLocker Operational" | Export-Csv -Path Bitlocker-Operational.csv
|
||||
```
|
||||
|
||||
You can use Get-WinEvent in an elevated PowerShell window to display filtered information from the System or Application log by using syntax that resembles the following:
|
||||
You can use Get-WinEvent in an elevated PowerShell window to display filtered information from the system or application log by using the following syntax:
|
||||
|
||||
- To display BitLocker-related information:
|
||||
```ps
|
||||
@ -86,7 +87,7 @@ You can use Get-WinEvent in an elevated PowerShell window to display filtered in
|
||||
Open an elevated Windows PowerShell window, and run each of the following commands.
|
||||
|
||||
|Command |Notes |
|
||||
| - | - |
|
||||
| --- | --- |
|
||||
|[**get-tpm \> C:\\TPM.txt**](/powershell/module/trustedplatformmodule/get-tpm?view=win10-ps) |Exports information about the local computer's Trusted Platform Module (TPM). This cmdlet shows different values depending on whether the TPM chip is version 1.2 or 2.0. This cmdlet is not supported in Windows 7. |
|
||||
|[**manage-bde –status \> C:\\BDEStatus.txt**](/windows-server/administration/windows-commands/manage-bde-status) |Exports information about the general encryption status of all drives on the computer. |
|
||||
|[**manage-bde c: <br />-protectors -get \> C:\\Protectors**](/windows-server/administration/windows-commands/manage-bde-protectors) |Exports information about the protection methods that are used for the BitLocker encryption key. |
|
||||
@ -98,7 +99,7 @@ Open an elevated Windows PowerShell window, and run each of the following comman
|
||||
1. Open an elevated Command Prompt window, and run the following commands.
|
||||
|
||||
|Command |Notes |
|
||||
| - | - |
|
||||
| --- | --- |
|
||||
|[**gpresult /h \<Filename>**](/windows-server/administration/windows-commands/gpresult) |Exports the Resultant Set of Policy information, and saves the information as an HTML file. |
|
||||
|[**msinfo /report \<Path> /computer \<ComputerName>**](/windows-server/administration/windows-commands/msinfo32) |Exports comprehensive information about the hardware, system components, and software environment on the local computer. The **/report** option saves the information as a .txt file. |
|
||||
|
||||
@ -109,13 +110,13 @@ Open an elevated Windows PowerShell window, and run each of the following comman
|
||||
|
||||
## Check the BitLocker prerequisites
|
||||
|
||||
Common settings that can cause issues for BitLocker include the following:
|
||||
Common settings that can cause issues for BitLocker include the following scenarios:
|
||||
|
||||
- The TPM must be unlocked. You can check the output of the **get-tpm** command for the status of the TPM.
|
||||
- Windows RE must be enabled. You can check the output of the **reagentc** command for the status of WindowsRE.
|
||||
- The system reserved partition must use the correct format.
|
||||
- On Unified Extensible Firmware Interface (UEFI) computers, the system reserved partition must be formatted as FAT32.
|
||||
- On legacy computers, the system reserved partition must be formatted as NTFS.
|
||||
- The system-reserved partition must use the correct format.
|
||||
- On Unified Extensible Firmware Interface (UEFI) computers, the system-reserved partition must be formatted as FAT32.
|
||||
- On legacy computers, the system-reserved partition must be formatted as NTFS.
|
||||
- If the device that you are troubleshooting is a slate or tablet PC, use <https://gpsearch.azurewebsites.net/#8153> to verify the status of the **Enable use of BitLocker authentication requiring preboot keyboard input on slates** option.
|
||||
|
||||
For more information about the BitLocker prerequisites, see [BitLocker basic deployment: Using BitLocker to encrypt volumes](./bitlocker-basic-deployment.md#using-bitlocker-to-encrypt-volumes)
|
||||
@ -124,14 +125,14 @@ For more information about the BitLocker prerequisites, see [BitLocker basic dep
|
||||
|
||||
If the information that you have examined so far indicates a specific issue (for example, WindowsRE is not enabled), the issue may have a straightforward fix.
|
||||
|
||||
Resolving issues that do not have obvious causes depends on exactly which components are involved and what behavior you see. The information that you have gathered can help you narrow down the areas to investigate.
|
||||
Resolving issues that do not have obvious causes depends on exactly which components are involved and what behavior you see. The information that you have gathered helps you narrow down the areas to investigate.
|
||||
|
||||
- If you are working on a device that is managed by Microsoft Intune, see [Enforcing BitLocker policies by using Intune: known issues](ts-bitlocker-intune-issues.md).
|
||||
- If BitLocker does not start or cannot encrypt a drive and you notice errors or events that are related to the TPM, see [BitLocker cannot encrypt a drive: known TPM issues](ts-bitlocker-cannot-encrypt-tpm-issues.md).
|
||||
- If BitLocker does not start or cannot encrypt a drive, see [BitLocker cannot encrypt a drive: known issues](ts-bitlocker-cannot-encrypt-issues.md).
|
||||
- If BitLocker Network Unlock does not behave as expected, see [BitLocker Network Unlock: known issues](ts-bitlocker-network-unlock-issues.md).
|
||||
- If BitLocker does not behave as expected when you recover an encrypted drive, or if you did not expect BitLocker to recover the drive, see [BitLocker recovery: known issues](ts-bitlocker-recovery-issues.md).
|
||||
- If BitLocker does not behave as expected or the encrypted drive does not behave as expected, and you notice errors or events that are related to the TPM, see [BitLocker and TPM: other known issues](ts-bitlocker-tpm-issues.md).
|
||||
- If BitLocker does not behave as expected or the encrypted drive does not behave as expected, see [BitLocker configuration: known issues](ts-bitlocker-config-issues.md).
|
||||
- If BitLocker or the encrypted drive does not behave as expected, and you notice errors or events that are related to the TPM, see [BitLocker and TPM: other known issues](ts-bitlocker-tpm-issues.md).
|
||||
- If BitLocker or the encrypted drive does not behave as expected, see [BitLocker configuration: known issues](ts-bitlocker-config-issues.md).
|
||||
|
||||
We recommend that you keep the information that you have gathered handy in case you decide to contact Microsoft Support for help to resolve your issue.
|
||||
We recommend that you keep the information that you have gathered handy in case you decide to contact Microsoft Support for help to resolve your issue.
|
||||
|
||||
@ -1 +1,16 @@
|
||||
# Welcome to SV!
|
||||
---
|
||||
title: No title
|
||||
description: No description
|
||||
keywords: ["Windows 10"]
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
audience: itpro
|
||||
author: greg-lindsay
|
||||
ms.author: greglin
|
||||
manager: laurawi
|
||||
ms.localizationpriority: high
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# _
|
||||
Reference in New Issue
Block a user