| Event Id | 24601 |
| Source | Microsoft-Windows-BitLocker-Driver |
| Description | The PCRs did not match during restart. |
| Event Information | According to Microsoft : Cause This event is logged when the PCRs did not match during restart. Resolution Check any system change and re-enable BitLocker BitLocker entered recovery, and a user has successfully completed the recovery process by using a recovery key (stored on a USB flash drive) or a recovery password (entered manually at the recovery screen). BitLocker entered recovery because the configuration of the computer has unexpectedly changed. This change could represent a deliberate attack or an unauthorized attempt to access data, or it could represent a change made deliberately by an administrator while BitLocker was enabled. Check that any changes to the early startup components or Windows system files were authorized. Once you have verified that the system has not been compromised, re-enable BitLocker to reset the configuration information. To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority. To disable and re-enable BitLocker: 1.Click Start, and then click Control Panel. 2.Click Security. 3.Click BitLocker Drive Encryption. 4.If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue. 5.Click Turn off BitLocker. 6.Click Disable BitLocker. 7.In the BitLocker Drive Encryption window, click Turn On BitLocker. 8.Close the BitLocker Drive Encryption window. Verify To verify that BitLocker has started successfully: 1.If the computer is not running, start the computer. 2.If BitLocker has been configured to use a USB flash drive, insert the USB flash drive. If BitLocker has been configured to use a PIN, enter your PIN when prompted. 3.Verify that Windows Welcome Screen, Logon Screen or Desktop appears. This indicates that BitLocker has correctly unlocked the Windows operating system volume. 4.Log on to Windows and access any data volumes that are encrypted with BitLocker. Note: Data volumes can be configured to be automatically unlocked or to require manual unlocking. |
| Reference Links | Event ID 24601 from Microsoft-Windows-BitLocker-Driver |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.