Fix ERROR_BAD_RECOVERY_POLICY (0x177C) on Windows 10/11

When this error shows up

You're trying to enable BitLocker on a Windows 10 or 11 machine. Maybe you just joined a domain, or your IT pushed a new group policy. You run manage-bde -on C: and get the error ERROR_BAD_RECOVERY_POLICY (0X0000177C). The exact message: "Recovery policy configured for this system contains invalid recovery certificate."

I've seen this mostly after a forced group policy update (gpupdate /force) that replaced the existing recovery certificate with a broken one. Also happens when you import a certificate that's corrupted or from a different machine.

What's actually happening

BitLocker needs a valid recovery certificate to store a backup of the recovery key. Without it, if you lose the password, you're locked out. Windows checks the certificate when you enable BitLocker. If the cert is missing, expired, or signed by an untrusted CA, it throws error 0x177C.

The root cause is almost always a mismatch between the recovery certificate stored in Local Computer \ Personal \ Certificates and what the group policy expects. The policy says "use certificate X", but the cert in the store is Y or nothing.

The fix — step by step

1. Open Certificate Manager
   Press Win + R, type certlm.msc, hit Enter. This opens certificates for the local machine.
2. Find the BitLocker recovery cert
   Go to Personal \ Certificates. Look for a certificate with "BitLocker" or "Recovery" in the friendly name. If you see one, note its thumbprint (double-click it, go to Details tab, scroll to Thumbprint).
3. Check the group policy
   Open gpedit.msc (or secpol.msc on non-Pro editions). Go to Computer Configuration \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption. Find "Choose how BitLocker-protected drives can be recovered". Double-click it. Look for "Save BitLocker recovery information to Active Directory" and "Save BitLocker recovery information to a recovery certificate". If it's enabled, it specifies a certificate thumbprint.
4. Compare thumbprints
   The thumbprint in the policy must exactly match the thumbprint of the cert in Personal store. If they don't match, you need to fix it. If there's no cert at all, proceed to step 5.
5. Delete the bad cert and create a new one
   In certlm.msc, delete the existing BitLocker recovery cert (if any). Then, in an elevated PowerShell window, run:
   

   New-SelfSignedCertificate -Type Custom -Subject "CN=BitLocker Recovery" -KeyUsage DataEncipherment -CertStoreLocation Cert:\LocalMachine\My

   
   This creates a new self-signed certificate. Note: it's not signed by a CA, but it works for local policies.
6. Update the policy with the new thumbprint
   Run certlm.msc again, double-click the new cert, go to Details, copy the Thumbprint. Then open gpedit.msc back, edit the same policy setting, and paste that thumbprint into the "Certificate thumbprint" field.
7. Force a group policy update
   Open CMD as admin and run: gpupdate /force. Wait for it to finish.
8. Try enabling BitLocker again
   Run manage-bde -on C:. It should succeed now.

If it still fails

Two things to check:

• Certificate chain issues — If your organization uses a CA, the cert must be issued by that CA. Self-signed won't work if the policy requires a chain. You'll need to request a proper cert from your CA admin.
• Corrupt group policy — Sometimes the policy itself is broken. Reset it: delete the registry key HKLM\SOFTWARE\Policies\Microsoft\FVE (after backing it up). Then run gpupdate /force again. This forces Windows to re-download policies from the domain.
• Event Logs — Check Event Viewer \ Windows Logs \ System for events from source BitLocker-DrivePreparation or volmgr. They often give the exact certificate status.

If none of that works, you might need to remove BitLocker features via dism /online /disable-feature /featurename:BitLocker and re-add them. But that's rare — 90% of cases are fixed by steps 1-8.