Event ID 851Failed to enable silent encryption

What to check

Check BIOS Mode is UEFI in msinfo32. For 0x80072f9a on Windows 10 1809, install the May 2019 update.

Codes you'll see in this event

Find it with PowerShell

Run on the machine that logs it.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-BitLocker/BitLocker Management'; Id = 851 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-BitLocker/BitLocker Management log to your workspace, where it lands in the Event table.

1
2
3
4
5Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-BitLocker/BitLocker Management" and EventID == 851
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related BitLocker events

• Event ID 853: Compatible TPM not found, or bootable media detected
• Event ID 854: WinRE is not configured
• Event ID 846: Failed to back up recovery information to Entra ID
• Event ID 778: Volume reverted to an unprotected state
• Event ID 796: Normal BitLocker operation event
• Event ID 845: Normal BitLocker operation event

Search all 123 event IDs →