Dual Window/Ubuntu boot wants windows recovery key (bitlocker key)

[1fallen2]

BitLocker stores a key in the system's TPM, which will fail to verify if it detects tampering (this includes BIOS setting changes, and other changes to software and hardware).

If it is the Home edition, please right-click Start->Setting->Privacy and security->Device encryption. Turn "Device encryption" off, and wait for the decryption to complete.

If the option is still available after decrypting, you can turn it on again if you still need to encrypt the computer. Please note that it may create another recovery key and upload it to the Microsoft account, so please check whether there is another key saved on the account. You can also check the currently used recovery key locally by right-clicking Start->Terminal/PowerShell/Command prompt, and enter the following command:

manage-bde.exe -protectors -get C:

The recovery key is listed under "numeric password".

This Advice was offered to me by "Johann - MSFT | Microsoft Community Support Specialist" (Note this was virgin Ubuntu install and not a upgrade)

And it worked for Win11 Pro as well, I did it for a friend, as I'm not A MS customer...

[tea for one]

BitLocker stores a key in the system's TPM

Yes, if TPM is enabled (Windows 11 pro)
With TPM enabled, you can also change How the drive is unlocked at startup
If you always boot via Grub then the change (Pin or USB Flashdrive) will stick
If you decide to boot Windows 11 via the UEFI menu, you'll have to go through the laborious process of entering the 48 digit recovery key.
Then, if you change your mind again and boot via Grub, more onerous 48 digit recovery procedure.

However, you can also use BitLocker encryption with both TPM and Secure Boot disabled.
Choose to enable BitLocker with either a password or USB key and Grub can be used to boot Windows 11.
Grub will require the password or have the USB key attached.

I don't know where the key is stored but, because TPM chip is not involved, Grub manages to boot Windows 11.

[1fallen2]

Do you have TPM and Secure Boot enabled in your UEFI settings?

One good way to check is:

[ -d $(ls -d /sys/kernel/security/tpm* 2>/dev/null | head -1) ] && \
    echo "TPM available" || echo "TPM missing"

Mine shows it "TPM available"

I don't know where the key is stored but, because TPM chip is not involved, Grub manages to boot Windows 11.

this might help us or you

sudo cat /proc/keys

BTW Why dual boot?? If you really need windows and ubuntu, then a second drive would be Ideal, Or a virtual install from Windows to Ubuntru, or Ubuntu host with Windows as a Guest.

Dual Booting is at best a hit or miss>>>>YUCK not for me anymore....

Any-who Good Luck to the OP

[tea for one]

[ -d $(ls -d /sys/kernel/security/tpm* 2>/dev/null | head -1) ] && \
    echo "TPM available" || echo "TPM missing"

Mine shows it "TPM available"

Mine too, but it does not indicate enabled or disabled.
My TPM is disabled

this might help us or you

sudo cat /proc/keys

I doubt if a BitLocker key is stored in an Ubuntu folder

BTW Why dual boot?? If you really need windows and ubuntu, then a second drive would be Ideal, Or a virtual install from Windows to Ubuntru, or Ubuntu host with Windows as a Guest.
Dual Booting is at best a hit or miss>>>>YUCK not for me anymore....

Yes, dual booting adds an undesireable complexity.
The following truncated text is good advice.

If you can possibly manage it, have one OS per computer.
If you absolutely must have more than one OS per computer, at least have one OS per disk.
If you absolutely insist on having more than one OS per disk, understand everything written on this page

From Recommendations here https://www.happyassassin.net/posts/...lly-work-then/

[1fallen2]

Mine too, but it does not indicate enabled or disabled.
My TPM is disabled

It will in the Bios under Patform

I doubt if a BitLocker key is stored in an Ubuntu folder

True but you can see them from a Linux Machine:Or, You can access the BitLocker partition under Linux using Dislocker, an open-source driver that is using FUSE (or not).

Note: You need the file on a USB key (the one with the .bek extension) or the recovery password.

More on Dislocker:

dislocker
dislocker by Romain Coltel, v0.7.2 (compiled for Linux/x86_64)
Compiled version: master:8d42bdd

Usage: dislocker [-hqrsv] [-l LOG_FILE] [-O OFFSET] [-V VOLUME DECRYPTMETHOD -F[N]] [-- ARGS...]
    with DECRYPTMETHOD = -p[RECOVERY_PASSWORD]|-f BEK_FILE|-u[USER_PASSWORD]|-k FVEK_FILE|-K VMK_FILE|-c

Options:
    -c, --clearkey        decrypt volume using a clear key (default)
    -f, --bekfile BEKFILE
                          decrypt volume using the bek file (on USB key)
    -F, --force-block=[N] force use of metadata block number N (1, 2 or 3)
    -h, --help            print this help and exit
    -k, --fvek FVEK_FILE  decrypt volume using the FVEK directly
    -K, --vmk VMK_FILE    decrypt volume using the VMK directly
    -l, --logfile LOG_FILE
                          put messages into this file (stdout by default)
    -O, --offset OFFSET   BitLocker partition offset, in bytes (default is 0)
    -p, --recovery-password=[RECOVERY_PASSWORD]
                          decrypt volume using the recovery password method
    -q, --quiet           do NOT display anything
    -r, --readonly        do not allow to write on the BitLocker volume
    -s, --stateok         do not check the volume's state, assume it's ok to mount it
    -u, --user-password=[USER_PASSWORD]
                          decrypt volume using the user password method
    -v, --verbosity       increase verbosity (CRITICAL errors are displayed by default)
    -V, --volume VOLUME   volume to get metadata and keys from

    --                    end of program options, beginning of FUSE's ones

  ARGS are any arguments you want to pass to FUSE. You need to pass at least
the mount-point.

Or the Man Page:

DISLOCKER-FUSE(1)                          DISLOCKER-FUSE                         DISLOCKER-FUSE(1)

NAME
       Dislocker fuse - Read/write BitLocker encrypted volumes under Linux, OSX and FreeBSD.

SYNOPSIS
       dislocker-fuse  [-hqrsv]  [-l  LOG_FILE]  [-O  OFFSET]  [-V  VOLUME DECRYPTMETHOD -F[N]] [--
       ARGS...]

       Where DECRYPTMETHOD  =  {-p[RECOVERY_PASSWORD]  |  -f  BEK_FILE  |  -u[USER_PASSWORD]  |  -k
       FVEK_FILE | -K VMK_FILE | -c}

DESCRIPTION
       Given  a  decryption mean, the program is used to read or write BitLocker encrypted volumes.
       Technically, the program will create a virtual NTFS partition that  you  can  mount  as  any
       other NTFS partition.

       The  virtual  partition  is  linked to the underlying BitLocker volume, so any write to this
       volume is put on the BitLocker volume as well. However, you can use dd(1) to get rid of this
       limitation -- if it's a limitation for you. An example is provided in the  EXAMPLES  section
       of this man page.

OPTIONS
       Program's options are described below:

       -c, --clearkey
              decrypt volume using a clear key which is searched on the volume (default)

       -f, --bekfile BEK_FILE
              decrypt volume using the bek file (present on a USB key)

       -F, --force-block=[N]
              force  use  of  metadata  block  number N (1, 2 or 3).  Without N, the first block is
              forced.  Without this option, the program will try each block until a  valid  one  is
              found

       -h     print the help and exit

       -k, --fvek FVEK_FILE
              decrypt  volume  using  the FVEK directly.  See the FVEK FILE section below to under‐
              stand what is to be put into this FVEK_FILE

       -K, --vmk VMK_FILE
              decrypt volume using the VMK directly.  See the VMK FILE section below to  understand
              what is to be put into this VMK_FILE

       -l, --logfile LOG_FILE
              put messages into this file (stdout by default)

       -O, --offset OFFSET
              BitLocker  partition  offset,  in  bytes, in base 10 (default is 0).  Protip: in your
              shell, you probably can pass -O $((0xdeadbeef)) if you have a 16-based number and are
              too lazy to convert it in another way.

       -p, --recovery-password=[RECOVERY_PASSWORD]
              decrypt volume using the recovery password method.  If no recovery-password  is  pro‐
              vided, it will be asked afterward; this has the advantage that the program will vali‐
              date  each  block one by one, on the fly, as you type it and not to leak the password
              on the commandline

       -q, --quiet
              do NOT display any information.  This option has priority on any previous  ‘-v'.  One
              probably wants to check the return value of the program when using this option

       -r, --readonly
              do not allow to write on the BitLocker volume (read only mode)

       -s, --stateok
              do  not check the volume's state, assume it's ok to mount it.  Do not use this if you
              don't know what you're doing

       -u, --user-password=[USER_PASSWORD]
              decrypt the volume using the user password method.  If no user-password is  provided,
              it  will  be  asked afterward; this has the advantage not to leak the password on the
              commandline

       -v, --verbosity
              increase verbosity (CRITICAL level by default), see also ‘-q'

       -V, --volume VOLUME
              volume to get metadata and encrypted keys from

       --     mark the end of program's options and the beginning of FUSE's  ones  (useful  if  you
              want to pass something like -d to FUSE)

       ARGS  are  any  arguments  you want to pass to FUSE. Note that you need to pass at least the
       mount-point.

FVEK FILE
       The FVEK file option expects a specific format from the file. The file is split into two ma‐
       jor parts:
              - 2 bytes describing the encryption in use, from 0x8000 to 0x8003 for AES 128 or  256
              bits, with or without diffuser.

              - 64 bytes (512 bits) which are the FVEK as in the FVEK key protector once decrypted.

       The file is therefore 66 bytes long, not more nor less.  Note that you may have to deal with
       endianness.

EXAMPLES
       These are examples you can run directly.  First, you may want to copy the BitLocker volume:

              % dd if=/dev/sda2 of=encrypted.bitlocker

              This  will  copy  the  entire  volume  located into /dev/sda2 to encrypted.bitlocker.
              You're not forced to do this step, but this will ensure no write whatsoever  is  per‐
              formed on the BitLocker volume.

       Then dislock it:

              % dislocker -V encrypted.bitlocker -f /path/to/usb/file.BEK -- /mnt/ntfs

              This will create a file into /mnt/ntfs named dislocker-file.

       To mount partitions once decrypted, use this sort of line:
              % mount -o loop /mnt/ntfs/dislocker-file /mnt/clear

       --

       It seems that you have to unmount the NTFS partition and the dislocker one before halting
       the system, or you will run into unexpected behaviour. In order to do so, you may run these
       commands (replacing your mount points):
              % umount /mnt/clear && umount /mnt/ntfs/dislocker-file

       --

       Note  that  these  are examples and, as such, may need to be modified. For instance, you may
       want to change the decryption method used in them.

AUTHOR
       This tool is developed by Romain Coltel on behalf of HSC (http://www.hsc.fr/)

       Feel free to send bugs report to <dislocker __AT__ hsc __DOT__ fr>

Linux                                        2011-09-07                           DISLOCKER-FUSE(1)

Please Note:

It seems that you have to unmount the NTFS partition and the dislocker one before halting
       the system, or you will run into unexpected behaviour. In order to do so, you may run these
       commands (replacing your mount points):
              % umount /mnt/clear && umount /mnt/ntfs/dislocker-file

Yes, dual booting adds an undesireable complexity.
The following truncated text is good advice.

From Recommendations here https://www.happyassassin.net/posts/...lly-work-then/

+1 To all the above

[willabeer]

tea for one: Secure Boot was disabled before I started this. I started trying yancek's solution which required turning off Bitlocker, which I did. Before proceding further, I did a Ubuntu Boot-Repair to see if that would repair problem. I then went back to Windows and turned on bitlocker, which then bitlocker wouldn't do auto-unlock nor encrypt. This seems to be the problem pspathis2 has. I then turned on secure boot which allowed bitlocker to work. I wonder if the simplest solution would be to uninstall Ubuntu and reload a dual boot or just rely on the booter to select the OS. Are there any good instruction on how someone would do this? I'm fairly new a Ubuntu and need some hand holding.

[willabeer]

tea for one: Do you mean one OS per disk, or is it one OS per partition?

[tea for one]

Clearly, you want to use two systems and learn about Ubuntu.
Also, I get the impression that Windows is your principal system.

The best solution is:-
Each OS on a separate disk
Each OS installed in UEFI mode with GPT and its own ESP
Encryption is available for each disk - user choice?
Boot via PC UEFI boot menu
Possible third disk for data sharing (ntfs)

The distinct advantage is that corruption on one OS will not affect the other OS
Boot problems can be fixed by the correct tools for each system
e.g. Ubuntu utilities for Ubuntu and Windows tools for Windows

What do you think?

[willabeer]

tea for one:

Your impression that Windows is my principal system is correct and I am a Ubuntu Newbie. However, I find that I like Linux because is seems so down to earth, and not oriented toward the next great idea.

I like your solution and I will be moving to implement your solution. I find that trying to fix my issue is not straight forward.

ONE MORE QUESTION:
You stated-
Can the Ubuntu and Windows systems share a encrypted data drive, or does the drive need to be unencrypted?

[1fallen2]

I "think" tea for one and i both Agree this is the safest:

The best solution is:-
Each OS on a separate disk
Each OS installed in UEFI mode with GPT and its own ESP

And "share a encrypted data drive," is doable but with a lot of learning.

LUKS (Linux Unified Key Setup) and BitLocker: LUKS is the standard encryption method for Ubuntu, while BitLocker is used in Windows. While both systems can encrypt drives, they use different formats and key management systems. This might lead to compatibility issues when trying to access the encrypted drive from both operating systems.

LUKS is superior in my humble opinion.