FVE_E_NO_TPM_BIOS (0X80310002) — No TPM Support During Boot

You hit this error, and it's annoying

You try to turn on BitLocker in Windows 10 or 11, and instead of encryption you get FVE_E_NO_TPM_BIOS (0X80310002). The message says the firmware doesn't support using a TPM during boot. It doesn't mean you're stuck — it means you need to pick one of two paths, depending on whether your machine actually has a TPM chip.

The fast fix: bypass the TPM requirement

If your PC doesn't have a TPM at all (or you'd rather not use it), you can tell BitLocker to use a startup key instead. You'll need a USB flash drive that stays plugged in every time you boot. Here's how:

1. Press Win + R, type gpedit.msc, hit Enter. (If you're on Windows Home, jump to the alternative below.)
2. Go to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
3. Double-click Require additional authentication at startup.
4. Set it to Enabled. Check Allow BitLocker without a compatible TPM. Click OK.
5. Close Group Policy, open Command Prompt as admin, and run manage-bde -on C:. Follow the prompts to save your startup key to a USB drive.

On Windows Home (no gpedit), use the registry instead:

reg add HKLM\SOFTWARE\Policies\Microsoft\FVE /v EnableBDEWithNoTPM /t REG_DWORD /d 1 /f

Then reboot and run manage-bde -on C: from an admin command prompt. It'll ask for the USB key — have one ready.

Why this works

The core issue is that BitLocker, by default, wants the TPM to hold the encryption key and release it only after verifying the boot chain hasn't been tampered with. When the BIOS or UEFI firmware doesn't expose the TPM interface during boot — or when there's no TPM at all — BitLocker refuses to start encryption. The Group Policy switch bypasses that check entirely, letting the OS use a USB key as the key holder. It's less convenient (you need the USB every boot), but it works on any hardware.

If your machine actually has a TPM

Sometimes the TPM is physically present but disabled in the BIOS, or the firmware just isn't talking to it correctly. Try these in order:

1. Reboot into BIOS/UEFI setup. Look for a section called Security, Trusted Computing, or TPM. Set it to Enabled or Firmware TPM (if you have an AMD CPU, that's fTPM). Save and exit.
2. Boot to Windows, open an admin PowerShell, and run Get-Tpm. If it shows TpmPresent: True but TpmReady: False, run Initialize-Tpm. This clears and provisions the TPM — it'll ask you to reboot a couple times.
3. If the BIOS has a TPM Device Selection option, make sure it's set to Firmware TPM (for AMD) or PPT (Intel Platform Trust Technology). On some Dell or Lenovo machines, you also need to enable TPM State separate from TPM Security.

After that, try enabling BitLocker again from Control Panel. If you still get 0x80310002, you're probably on older BIOS that doesn't support TPM boot — use the USB key workaround above.

Less common variations

• Virtual machines: Hyper-V and VMware don't expose a TPM to the guest OS by default. You'd need to enable a virtual TPM (vTPM) in the VM settings. On Hyper-V, that's under Security > Enable Trusted Platform Module. Without that, the workaround with the USB key is your only option inside the VM.
• BitLocker To Go: This error only applies to the OS drive. If you're encrypting a removable USB drive with BitLocker To Go, the TPM isn't involved — the error shouldn't appear. If it does, check that the drive isn't somehow being treated as a boot device in BIOS.
• Windows Server 2016/2019: Same fix applies, but on Server Core you'll need the manage-bde command approach. Group Policy isn't available in Server Core.
• Custom-built PCs: Some aftermarket motherboards have buggy TPM firmware. Update the BIOS to the latest version from the board manufacturer — that often resolves TPM detection issues at boot.

Prevention for next time

If you're building a system or buying a laptop and plan to use BitLocker, check two things beforehand:

1. That the motherboard or laptop has a TPM header/soldered chip (or firmware TPM for AMD/Intel 8th gen and newer).
2. That the BIOS version is current — many early UEFI implementations had broken TPM boot support, fixed in later updates.

Keep a USB key dedicated as your BitLocker startup key. Label it, tape it inside the case if it's a desktop, or store it somewhere safe. That way, even if the TPM dies or you swap motherboards, you're not locked out.

One more thing: if you're encrypting a work laptop and IT pushes a policy that enforces TPM-only boot, you can't bypass it with the Group Policy trick — that policy overrides local settings. Talk to your admin.