# Troubleshooting BitLocker Activation Issues on Windows 11 Post-Imaging

## **Overview**

Use this targeted repair when BitLocker fails after Windows 11 imaging with the Boot Configuration Data (BCD) path error shown below. The commands correct the `device`, `osdevice`, and memory diagnostic device values on systems that match the documented partition layout.

## **Issue Description**

After deploying a Windows 11 image to devices, attempts to enable BitLocker fail with the following error:

<p class="callout warning">**"The path specified in the Boot Configuration Data (BCD) for a BitLocker Drive Encryption integrity-protected application is incorrect. Please verify and correct your BCD settings and try again."**</p>

The issue was observed on multiple devices after the same FileWave imaging workflow. Confirm the current BCD values on an affected test device before treating this as the cause.

## **Initial Troubleshooting Attempts**

### **Unattend File Adjustments**

One of the first suspected causes was the Windows **unattend.xml** file used during deployment. Specifically, we considered that the partitioning and wiping directives in the answer file conflicted with FileWave’s imaging and partitioning steps.

To test this theory:

- Removed the entire partitioning section from the unattend file.
- Re-imaged devices using the updated unattend configuration.

**Result:** This change did **not** resolve the BitLocker error.

### **Manual BCD Edits**

We experimented with manual edits to the BCD store using bcdedit, in an attempt to update or repair paths that might be misconfigured post-image. However, these attempts did not lead to a consistent fix.

## **Resolution**

The tested workaround below came from a community report on Reddit ([source](https://www.reddit.com/r/sysadmin/comments/1hh4d4s/comment/m6di6vq/?rdt=42301)) and was then validated on multiple affected devices.

The issue appears to be related to incorrect `device` and `osdevice` settings within the BCD store. BitLocker can initialize successfully by explicitly setting these values to point to the system partition.

### **Required Commands**

<p class="callout warning">**Check the partition mapping first.** BCDEdit changes can make Windows unbootable. Run `bcdedit /enum` from an elevated Command Prompt and verify that Windows is on `C:` and memory diagnostics uses `\Device\HarddiskVolume1` before applying this example. Pilot the change on representative hardware before wider deployment.</p>

Run these commands in an **elevated Command Prompt** only after the values match:

```
bcdedit /set {current} osdevice partition=C:
bcdedit /set {current} device partition=C:
bcdedit /set {memdiag} device partition=\Device\HarddiskVolume1
```

### **Optional: Batch File Version**

You may also save the above commands to a `.bat` file for repeated use. Below is the complete content of the file:

```
@echo off
bcdedit /set {current} osdevice partition=C:
bcdedit /set {current} device partition=C:
bcdedit /set {memdiag} device partition=\Device\HarddiskVolume1
echo Edit complete.
pause
```

## **Post-Fix Behavior**

After running the commands (or executing the batch script) and rebooting the device:

- BitLocker can be successfully enabled.
- Verify that the recovery key is escrowed in the directory service configured by your organization.

This workaround resolved the error on multiple test devices in the original report. Treat it as a targeted repair, not a universal post-imaging step. The PowerShell example below applies the same values.

```
##
##.SYNOPSIS Fixes BCD configuration to resolve BitLocker activation issues on Windows 11.
##
##.DESCRIPTION
##  This script sets the correct BCD partition values for osdevice, device, and memdiag using bcdedit.
## Intended for deployment through FileWave as a Fileset or custom script.
##

# Requires elevation
if (-not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(`
    [Security.Principal.WindowsBuiltInRole] "Administrator")) {
    Write-Host "This script must be run as Administrator."
    exit 1
}

# Define target values
$osDevice = "partition=C:"
$device = "partition=C:"
$memdiagDevice = "\Device\HarddiskVolume1"

try {
    Write-Host "Applying BCD changes..."

    # Set the current OS device and boot device
    bcdedit /set "{current}" osdevice $osDevice
    bcdedit /set "{current}" device $device
    bcdedit /set "{memdiag}" device $memdiagDevice

    Write-Host "BCD changes applied successfully."

    # Optional: Trigger reboot after applying fix
    # Restart-Computer -Force

} catch {
    Write-Error "An error occurred while editing BCD: $_"
    exit 2
}

exit 0
```

Optional verification/detection script:

```
$bcdOutput = bcdedit /enum {current}
if ($bcdOutput -match "osdevice.*partition=C:" -and $bcdOutput -match "device.*partition=C:") {
    Write-Host "BCD is already configured correctly."
    exit 0
} else {
    Write-Host "BCD configuration needs to be fixed."
    exit 1
}
```

## **Conclusion**

In the reported cases, incorrect `device` and `osdevice` values blocked BitLocker activation. If the error text or partition mapping differs, investigate the image, storage layout, and unattended setup instead of forcing these values.

After a successful pilot, you can deploy the repair as a FileWave Fileset or script to devices that report the same BCD error and partition layout.

---

## **References**

- Reddit thread with the original solution: [https://www.reddit.com/r/sysadmin/comments/1hh4d4s/comment/m6di6vq/?rdt=42301](https://www.reddit.com/r/sysadmin/comments/1hh4d4s/comment/m6di6vq/?rdt=42301)
- [Microsoft: BCDEdit /set](https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set)