Fix BOOTMGR 0X80310006: TPM Measurement Mismatch Guide

Quick Answer

Boot to Windows Recovery, open Command Prompt, and run manage-bde -unlock C: -RecoveryPassword [your key] then manage-bde -protectors -disable C: to bypass the TPM check and boot normally.

If you're seeing 0X80310006 (FVE_E_WRONG_TPM_MEASUREMENTS) on a black screen before Windows loads, your TPM chip is refusing to release the encryption key because the boot files changed. I know this is infuriating — you didn't touch anything, and suddenly your PC is a brick. This happens more often than you'd think, especially after a BIOS update, a new SSD firmware, or even a Windows Update that modifies the boot manager.

The TPM (Trusted Platform Module) takes a snapshot of critical boot components. If any of those change — even a tiny driver tweak — the TPM won't validate the measurements, and BitLocker locks down. It's a security feature, but it feels like a betrayal when you're on a deadline.

Why This Error Appears

Here's the real-world trigger: you updated your BIOS last week, or you replaced a failing hard drive and cloned the old one. The TPM remembers the exact state of the boot chain. When the measurements don't match, it throws this error. Skipping the TPM check isn't insecure — it just means BitLocker will use a different key to decrypt, which is fine for a temporary fix.

Fix Steps

1. Boot to Windows Recovery Environment (WinRE). Insert your Windows installation USB, restart, and press any key to boot from it. Choose your language, then select Repair your computer at the bottom-left.
2. Open Command Prompt. Go to Troubleshoot > Advanced options > Command Prompt.
3. Identify your recovery key. You'll need the 48-digit numeric key. If you stored it in your Microsoft account, grab it from account.microsoft.com/devices/recoverykey on another device. It's a long string — copy it down carefully.
4. Unlock the drive manually. In the Command Prompt, type (adjust drive letter if yours isn't C:):

manage-bde -unlock C: -RecoveryPassword 000000-000000-000000-000000-000000-000000-000000-000000

Replace the zeros with your actual key. If it says 'success', you've unlocked the drive.

5. Disable the TPM protector temporarily. Now run:

manage-bde -protectors -disable C:

This tells BitLocker to stop using the TPM for now. It'll ask for confirmation — type Y.

6. Reboot. Type exit and restart your PC. Windows should boot normally now, without the TPM check.

If That Fails: Alternative Fixes

Didn't work? Don't panic — here are two other routes.

Clear the TPM from BIOS/UEFI

This resets the TPM to factory state, wiping all keys. It's a nuclear option, but it often solves stubborn mismatches. Reboot, enter BIOS (usually F2 or Del during boot), find Security or Trusted Computing settings, and select Clear TPM or Reset TPM. Save and exit. Then boot to Windows — you'll likely need your recovery key again, so have it ready.

Use Startup Repair

From the same WinRE menu, choose Startup Repair instead of Command Prompt. This can fix boot configuration issues that might have caused the mismatch in the first place. It's a shot in the dark, but it costs nothing.

Prevention Tip

Once you're back in, don't leave the TPM disabled forever. Re-enable it by opening an elevated Command Prompt (search 'cmd', right-click, 'Run as administrator') and typing:

manage-bde -protectors -enable C:

Then update your recovery key habit: every time you change BIOS/SSD firmware, back up your BitLocker recovery key to a safe place — not on the same drive. I've seen too many folks locked out because they stored the key on the encrypted disk itself. Also, check for pending Windows Updates that might have caused this. Happy booting.