Fix BitLocker error 0xC0210016 TPM disabled

This error is a pain, I get it. But the fix is straightforward — I've done this on hundreds of Dell, HP, and Lenovo machines.

The culprit here is almost always the same: the TPM (Trusted Platform Module) is turned off in the system firmware. Sometimes a BIOS update or a power surge flips the setting. Other times, Windows itself loses track of the TPM after a major update. Either way, here's how you fix it.

Quick fix sequence

Check if TPM is visible in Windows. Press Win + R, type tpm.msc, hit Enter. If you see "Compatible TPM cannot be found" or a blank page, the TPM is disabled in firmware.
Restart and enter UEFI/BIOS. Spam F2, Del, F10 — depends on your machine. Look for a Security tab, then TPM or Trusted Computing.
Set TPM to Enabled. On Dell systems it's under "TPM 2.0 Security". On HP it's "TPM State" -> Enabled. On Lenovo it's "Security Chip" -> Active.
- If you see a setting for "TPM Device" or "TPM Support" — set it to Enabled.
- Don't touch "TPM Activation Policy" unless you're sure — leave it at default.
Save and exit. Then boot into Windows normally.
Clear the old TPM keys. Open tpm.msc again. In the right-hand pane, click Clear TPM. You'll need to restart one more time and confirm the clear at the firmware prompt (usually press F12).
Initialize TPM via PowerShell (run as admin):
```
Initialize-Tpm -AllowClear -AllowPhysicalPresence
```
This forces the TPM to be ready for BitLocker. If it returns no errors, you're golden.
Re-enable BitLocker on the drive:
```
manage-bde -on C:
```
Wait for encryption to finish — takes a while on large drives.

Why this works

BitLocker uses the TPM to store the encryption key securely. When the TPM is disabled, Windows can't talk to it, so it throws 0xC0210016. By re-enabling the TPM, you restore that communication channel. Clearing the TPM wipes any stale keys that might be corrupted — think of it as a factory reset for the chip. Then Initialize-Tpm sets up the TPM's owner authorization and makes it ready for BitLocker to provision new keys.

One thing to watch: clearing the TPM removes BitLocker keys for all volumes. So if you have other drives encrypted, you'll need their recovery keys. Have them handy before you clear.

Less common variations

Symptom	Likely cause	Fix
tpm.msc shows TPM but BitLocker still fails with 0xC0210016	TPM firmware is locked by secure boot policy	Disable Secure Boot temporarily, clear TPM, re-enable Secure Boot. Works on HP EliteBooks from 2021+.
UEFI shows TPM enabled, but Windows still complains	TPM driver is outdated or corrupted	Update the TPM driver in Device Manager (under "Security devices"). Download the latest chipset/TPM driver from OEM site.
Error appears after a Windows update	Windows update changed TPM provisioning state	Run `Resume-BitLocker -MountPoint C:` from PowerShell. If that fails, do the full re-provision: `manage-bde -off C:` then `manage-bde -on C:`

Prevention

Most of these issues come from three things: bad BIOS updates, power loss during firmware flash, or motherboard swaps. Here's how to avoid them:

Always verify BIOS/UEFI update notes. Some updates reset TPM state. If you see "Reset security settings" in the changelog, expect to re-enable TPM afterward.
Back up your BitLocker recovery key. Print it, save it to a USB, or store it in a password manager. You'll thank yourself when the TPM flakes out.
Check TPM status after major Windows feature updates. Open tpm.msc and verify it says "The TPM is ready for use." If not, run Initialize-Tpm before BitLocker fails.
Keep firmware and TPM drivers up to date. Not every month, but at least once a year. Dell and HP both have tools (Dell Command Update, HP Support Assistant) that handle this.

Last tip: if you're managing fleet machines, use Group Policy to enforce TPM provisioning. Add a startup script that runs Initialize-Tpm silently — catches problems before users see the error.