FVE_E_TPM_NOT_OWNED (0X80310018) Fix: Take Ownership of TPM

I've seen this error trip up people who just built a new machine or swapped motherboards. It's maddening — you're trying to encrypt your drive, and Windows throws FVE_E_TPM_NOT_OWNED (0X80310018). The fix is straightforward once you understand what's missing: the TPM chip hasn't been claimed by the OS.

The Short Fix: Take TPM Ownership via tpm.msc

1. Press Win + R, type tpm.msc, hit Enter.
2. If you see "Compatible TPM cannot be found" — stop. That's a different problem. If you see a status like "The TPM is ready for use" but also a message about it not being owned, skip to the PowerShell fix below.
3. In the Actions pane on the right, click Prepare the TPM. You might need to reboot and press a key during POST to confirm. That's normal — the hardware requires physical presence.
4. After reboot, open tpm.msc again. The status should now say "The TPM is ready for use" with no ownership warning.

Try BitLocker again. If it still chokes, move to the next step.

When tpm.msc Won't Let You Own: PowerShell

Sometimes Windows 10 or 11 blocks the GUI option. Run PowerShell as Administrator and execute:

Initialize-Tpm -AllowClear -AllowPhysicalPresence

If that fails with a compatibility error, try:

Clear-Tpm

Then reboot, re-enter the TPM during POST (usually F1, F2, or Del), and run Initialize-Tpm again. I've had to clear the TPM on a Gigabyte Z790 board after a BIOS update — same exact 0X80310018 error.

Why Did This Fix Work?

The TPM is a separate security processor. Before BitLocker can bind a volume to it, the TPM must be "owned" — basically, the OS has to establish a shared secret (the Storage Root Key). When you take ownership, that key is created, and the TPM can then release the BitLocker key during boot.

If you skipped TPM initialization during a fresh Windows install, or after a BIOS/UEFI update that cleared the TPM, the ownership flag gets reset. That's the most common trigger. Another big one: swapping a motherboard without clearing the TPM from the old system — Windows sees a new TPM and refuses to hand over keys.

Less Common Variations

TPM Provisioning in Group Policy

On domain-joined machines, your IT department might have locked down TPM ownership. Run gpedit.msc and go to Computer Configuration > Administrative Templates > System > Trusted Platform Module Services. Check if "Configure the level of TPM owner authorization that is available to the operating system" is set to "Disabled." If so, you won't be able to take ownership through normal means. You'd need a Group Policy override or a local admin with rights to set it to "Enabled."

BitLocker Without TPM

If taking ownership still fails — maybe your TPM is old or broken — you can bypass the TPM check entirely. Open Group Policy Editor, go to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives, and enable "Require additional authentication at startup." Check the box for "Allow BitLocker without a compatible TPM." You'll then use a USB key or password instead of the TPM. This isn't ideal, but it works on hardware from 2012 onward.

"I once saw a Dell OptiPlex 7080 where the TPM was stuck in 'Deactivated' state in BIOS. No amount of software ownership would fix it. Had to enable and activate the TPM in the firmware settings first."

Prevention: Keep Your TPM Happy

• Don't clear the TPM unless you have to. Every time you clear it, you lose BitLocker keys. Back up your recovery key (write it down, store in Azure AD, or print it).
• After a BIOS update, check TPM status. Some updates reset the TPM to default. Run tpm.msc right after the update and re-take ownership if needed.
• If you're building a PC, initialize the TPM before installing Windows. On ASUS boards, go to Advanced > Trusted Computing > Security Device Support and set it to Enable. Then install Windows. You'll rarely hit 0X80310018 that way.
• Keep your recovery key accessible. If you screw up ownership and the TPM gets locked, you'll need that 48-digit key to unlock the drive. Store it in your Microsoft account (bit.ly/bitlocker-recovery) or on a USB stick in a safe place.

That's it. No voodoo, no third-party tools. Just take ownership, and you're done.