Event ID 854WinRE is not configured

What to check

Check disk partitions, run reagentc /info and reagentc /enable, and check the Windows Boot Loader configuration.

Find it with PowerShell

Run on the machine that logs it.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-BitLocker/BitLocker Management'; Id = 854 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-BitLocker/BitLocker Management log to your workspace, where it lands in the Event table.

1
2
3
4
5Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-BitLocker/BitLocker Management" and EventID == 854
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related BitLocker events

• Event ID 853: Compatible TPM not found, or bootable media detected
• Event ID 851: Failed to enable silent encryption
• Event ID 846: Failed to back up recovery information to Entra ID
• Event ID 778: Volume reverted to an unprotected state
• Event ID 796: Normal BitLocker operation event
• Event ID 845: Normal BitLocker operation event

Search all 123 event IDs →