Bitlocker + TPM + PIN + error code 0x80310031

Question

When I try to add PIN protection to my bitlocker set-up I get the following error:

ERROR: An error occurred (code 0x80310031): This key protector cannot be added. Only one key protector of this type is allowed for this drive.

I have selected "Require startup PIN with TPM" in group policy settings. The rest is set to 'allow'.

Then I used the following command:

manage-bde -protectors -add c: -TPMAndPIN

From what I recall this is a proper setting (I am not setting up TPM+PIN bitlocker for the first time).

Ideas?

Answer 1

Here's the steps I used, note this was for a cluster shared volume but presumably will work just as well for a local volume.

$BLV = Get-BitLockerVolume -MountPoint "C:\clusterstorage\volume3"
Remove-BitlockerKeyProtector -MountPoint "C:\clusterstorage\volume3" -KeyProtectorId $BLV.KeyProtector[0].KeyProtectorId

Note that in the MS documentation it uses index 1, but if you only have one protector then it should actually be index 0! You can check this by comparing the output from $BLV.KeyProtector[0] to the (probably zero) output from $BLV.KeyProtector[1].

Also, until I added the final .KeyProtectorID I kept getting "invalid class string".

Reference: https://docs.microsoft.com/en-us/powershell/module/bitlocker/remove-bitlockerkeyprotector?view=win10-ps

Answer 2

In Command Prompt:

manage-bde -protectors -delete c:
manage-bde -protectors -add c: -TPMAndPIN
manage-bde -protectors -enable c:

Reboot & enjoy BitLocker boot protection with your new Startup PIN.

Answer 3

I don't have any expertise with your problem, but from your description, it appears that there is already a key protector enacted. Logic suggests to me that you would have to remove the previous key protector before you could add a new one. I await my education. :)

Answer 4

Get-BitLockerVolume C: | fl

ComputerName : xxxxxxx
MountPoint : C:
EncryptionMethod : None
AutoUnlockEnabled :
AutoUnlockKeyStored : false
MetadataVersion : 2
VolumeStatus : FullyDecrypted
ProtectionStatus : Off
LockStatus : Unlocked
EncryptionPercentage : 0
WipePercentage : 0
VolumeType : OperatingSystem
CapacityGB : 464,1874
KeyProtector : {tpm}

mit Remove-BitLockerKeyProtector kann er gelöscht werden.

$BLV = Get-BitLockerVolume -MountPoint "C:"
Remove-BitlockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[1]