Event ID 778Volume reverted to an unprotected state

What to check

Fix the underlying failure in 846 or 851, then let the policy reapply.

Find it with PowerShell

Run on the machine that logs it.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-BitLocker/BitLocker Management'; Id = 778 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-BitLocker/BitLocker Management log to your workspace, where it lands in the Event table.

1
2
3
4
5Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-BitLocker/BitLocker Management" and EventID == 778
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related BitLocker events

• Event ID 853: Compatible TPM not found, or bootable media detected
• Event ID 854: WinRE is not configured
• Event ID 851: Failed to enable silent encryption
• Event ID 846: Failed to back up recovery information to Entra ID
• Event ID 796: Normal BitLocker operation event
• Event ID 845: Normal BitLocker operation event

Search all 123 event IDs →