Tag: Device Encryption

Introduction

When deploying a Microsoft Surface Pro 9, you may encounter a situation where BitLocker encryption does not start automatically, even though the device is correctly joined to the organization and all standard BitLocker requirements appear to be met.

A common cause is that the Windows Recovery Environment (WinRE) is disabled or not properly configured. Without WinRE, Windows cannot proceed with automatic device encryption and BitLocker remains inactive.

This article explains how to identify the issue and how to resolve it.

Symptoms

You may notice one or more of the following symptoms:

• BitLocker encryption does not start automatically.
• The device remains unencrypted several minutes after deployment.
• No recovery key is uploaded to Microsoft Entra ID.
• The BitLocker status shows encryption as pending or inactive.

How to Verify the Cause

Open Event Viewer and navigate to:

Applications and Services Logs

└─ Microsoft
 └─ Windows
  └─ BitLocker-API
   └─ Management

If WinRE is not configured correctly, you may find an event similar to the following:

Failed to enable Silent Encryption.
WinRE is not configured.

Error:
This PC cannot support device encryption because WinRE is not properly configured.

Resolution

Open an elevated Command Prompt (Run as Administrator) and execute:

reagentc /enable

If the command succeeds, you should receive a confirmation similar to:

REAGENTC.EXE: Operation Successful

Verify WinRE Status

You can confirm that WinRE has been enabled by running:

reagentc /info

A correctly configured system should display:

Windows RE status: Enabled

What Happens Next?

After enabling WinRE:

1. Wait a few minutes.
2. Windows should automatically retry the device encryption process.
3. BitLocker encryption should begin without requiring any further action.

You can verify the encryption status by running:

manage-bde -status

Conclusion

If BitLocker encryption is not starting on a Surface Pro 9, the issue may not be related to TPM, Intune policies, or Microsoft Entra ID. In some cases, the root cause is simply that Windows Recovery Environment (WinRE) is disabled.