What Triggers This Error?

When you attempt to enable BitLocker — or when Intune / Group Policy tries to enforce a BitLocker policy — Windows evaluates every startup authentication requirement that applies to the machine. If those requirements logically contradict each other, BitLocker halts and returns this message rather than applying a potentially insecure configuration.

The most common conflicting combinations are:

  • One policy requires a PIN at startup, while another policy disallows additional authentication (TPM-only mode).
  • One policy requires a startup USB key, while another specifies TPM + PIN only — these are mutually exclusive authentication chains.
  • A legacy on-premises GPO and an Intune configuration profile are both applying BitLocker settings to the same machine (common in hybrid Azure AD join environments).
  • Two separate GPOs at different OU levels have overlapping but inconsistent settings, and no "No Override" (Enforced) flag has been set to establish precedence.

GPO Paths Involved

All BitLocker startup authentication settings live under:

Computer Configuration > Windows Settings > Security Settings > BitLocker Drive Encryption > Operating System Drives

The specific policy settings that conflict most often are:

Policy SettingWhat It Controls
Require additional authentication at startupMaster toggle — enables PIN, USB, or TPM-only. Enabling this in two GPOs with different sub-options causes the conflict.
Configure TPM startup PINOptions: Allow, Require, Do not allow. "Require" in one GPO and "Do not allow" in another = conflict.
Configure TPM startup keySame Allow / Require / Do not allow structure. A "Require" USB key setting conflicts with a PIN-only requirement.
Configure TPM startup key and PINCombined key+PIN mode. Cannot be active simultaneously with a USB-key-only or PIN-only requirement.
Allow BitLocker without a compatible TPMEnabling this while also requiring TPM-based authentication creates a logical contradiction.

Diagnosing with gpresult

The fastest way to see every GPO applying BitLocker settings to a machine is to generate an HTML Group Policy results report. Run this in an elevated command prompt on the affected machine:

gpresult /H C:\Temp\gpreport.html /F

Open the report in a browser and search for BitLocker. You will see each GPO that applied a BitLocker setting, its source OU, and the winning value. Look for two GPOs setting the same sub-key to opposing values.

For a faster command-line summary without an HTML file:

gpresult /SCOPE COMPUTER /V 2>&1 | findstr /i "bitlocker startup pin key"

You can also check the registry directly to see the merged policy result:

# View all BitLocker OS drive policy values currently applied Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\FVE"

Pay attention to these registry values and their combinations:

Registry Value012
UseTPMPINDo not allowAllowRequire
UseTPMKeyPINDo not allowAllowRequire
UseTPMKeyDo not allowAllowRequire
UseAdvancedStartupDisabledEnabled—

A conflict occurs when, for example, UseTPMPIN is set to 2 (Require) by one GPO but another GPO sets UseTPMKey to 2 (Require) as well — BitLocker cannot simultaneously require both a PIN and a USB startup key (unless you specifically configure key+PIN mode).

Resolving the Conflict

The correct fix depends on your intended authentication mode. Choose one of the following and ensure all GPOs align to it:

Option A — TPM only (silent, no user interaction). Set Require additional authentication at startup to Enabled, then set all sub-options (TPM startup PIN, TPM startup key, TPM startup key and PIN) to Do not allow. This is the typical configuration for Autopilot / Intune managed devices.

Option B — TPM + PIN (recommended for sensitive environments). Set Require additional authentication at startup to Enabled. Set Configure TPM startup PIN to Require startup PIN with TPM. Set all other sub-options to Do not allow.

Option C — TPM + USB startup key. Set Require additional authentication at startup to Enabled. Set Configure TPM startup key to Require startup key with TPM. Set all other sub-options to Do not allow.

⚠️In hybrid Azure AD join environments, disable BitLocker configuration in either the Intune policy or the on-premises GPO — never both simultaneously. Intune configuration profiles and GPO both write to the same registry keys, and the last writer wins in an unpredictable way.

After Resolving — Verify with manage-bde

After updating GPOs and running gpupdate /force, verify that BitLocker can now apply cleanly:

# Check current BitLocker status and protectors manage-bde -status C: # View protection method in detail manage-bde -protectors -get C:

If BitLocker was previously blocked mid-encryption, re-initiate it:

manage-bde -on C: -RecoveryPassword -SkipHardwareTest

After enabling, confirm the protectors match your intended policy — you should see only the protector types your GPO specifies (e.g., TPM + PIN, not TPM + PIN + recovery key USB simultaneously).

ℹ️If you manage BitLocker via Intune, check the Encryption report under Devices > Monitor > Encryption report. Devices with policy conflicts appear with a "Not encrypted" status and a reason code — this is often faster than running gpresult on each machine individually.