Event ID 853Compatible TPM not found, or bootable media detected

What to check

Check the TPM is present and enabled in firmware (tpm.msc), or remove the bootable media and restart.

Find it with PowerShell

Run on the machine that logs it.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-BitLocker/BitLocker Management'; Id = 853 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-BitLocker/BitLocker Management log to your workspace, where it lands in the Event table.

1
2
3
4
5Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-BitLocker/BitLocker Management" and EventID == 853
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related BitLocker events

• Event ID 854: WinRE is not configured
• Event ID 851: Failed to enable silent encryption
• Event ID 846: Failed to back up recovery information to Entra ID
• Event ID 778: Volume reverted to an unprotected state
• Event ID 796: Normal BitLocker operation event
• Event ID 845: Normal BitLocker operation event

Search all 123 event IDs →