Fix 0xC0210000: BitLocker locked volume on boot

That error means your drive is locked by BitLocker

You're seeing 0xC0210000 and it says the volume must be unlocked before it can be used. Yeah, it's annoying. But it's an easy fix. It almost always happens after a hardware change, BIOS update, or when you plug the drive into a different machine. BitLocker sees a change and locks the drive to protect your data.

First thing: get your recovery key

Without the recovery key, you're stuck. Here's where to find it:

• On your Microsoft account: Go to https://account.microsoft.com/devices/recoverykey and log in. That's the most common place.
• Printed out: Did you save it when you first set up BitLocker? Check your paper files.
• Saved to a file: Look in your OneDrive or Documents folder for a file named BitLocker Recovery Key.txt.
• In Active Directory: If it's a domain-joined machine, your IT admin can pull it from AD.

If you don't have the key, you can't unlock it. Period. No workaround for that.

How to unlock the drive

You have two ways. Pick one.

Method 1: Unlock from the BitLocker recovery screen (easiest)

When the error pops up, you'll see a blue screen asking for the recovery key. Type the 48-digit key using the number keys (use Fn for function keys if needed). Hit Enter. The drive unlocks and Windows boots normally.

That's it. Done.

Method 2: Unlock from another working Windows PC

If the drive won't boot at all and you need to get data off it, pull the drive and plug it into another PC as an external drive. Then:

1. Open Command Prompt as admin.
2. Run: manage-bde -unlock X: -RecoveryPassword YOUR48DIGITKEY (replace X with your drive letter and key with the recovery key).
3. You'll see unlocked successfully.
4. Now you can access the drive in File Explorer.

If you want to disable BitLocker permanently after unlocking, run manage-bde -off X:. That decrypts the drive over time—takes a while on big drives.

Why does this happen in the first place?

BitLocker ties encryption to your system's hardware—TPM chip, motherboard, boot order, secure boot state. Any change that affects those triggers a lock. Common triggers:

• BIOS/UEFI update (even a minor one).
• Swapping the boot drive to a different SATA port.
• Adding or removing RAM (rare but possible).
• Booting into a different OS (dual-boot setups).
• Plugging the drive into a different PC.

The culprit here is almost always a BIOS update or a motherboard swap. If you updated your BIOS and it booted once, then next time you get this error, you probably changed some UEFI setting after the update.

Less common variations of this issue

Sometimes you see the same error but not at boot—like when you plug in an external BitLocker'd drive. Same fix: use the recovery key to unlock it from File Explorer (right-click the drive, select Unlock Drive, enter key).

Also, if you're in a corporate environment and the recovery key isn't in Active Directory, someone probably forgot to back it up. Run manage-bde -protectors -get C: on a working system to see all protectors—sometimes the key is stored in the registry. Don't bother with third-party tools; they rarely help.

How to prevent this from happening again

Do these three things:

1. Backup your recovery key to multiple places. Save it to your Microsoft account, print a copy, and store it in your wallet. Yes, the full 48 digits. Do it now.
2. Pause BitLocker before BIOS updates. Run manage-bde -protectors -disable C: before updating the BIOS. Then re-enable with manage-bde -protectors -enable C: after the update and a reboot.
3. Don't change hardware without suspending BitLocker first. Use manage-bde -protectors -disable C: before swapping drives or motherboard. Re-enable after the change.

If you do those, you'll rarely see this error again. I've fixed this dozens of times for users who skipped step 1. Don't be that person.