Encrypted vhdx moved to new host, boots without pin or recovery key

Hello benlewis12,

What you observed is expected behaviour and not a flaw.

When BitLocker is enabled on a VM without vTPM present at provisioning time, the OS drive is typically protected with a clear key protector. That means the volume is encrypted but automatically unlocked at boot without TPM validation. In that state, copying the VHDX to another host will not trigger recovery because no TPM bound protector exists.

When you create the VM with vTPM enabled before installing the OS, BitLocker detects a TPM during provisioning and seals the Volume Master Key to that vTPM. The protector becomes TPM based. If you then move the VHDX to another host and attach it to a new VM with a different vTPM identity, PCR measurements change and BitLocker correctly enters recovery mode.

Key points:

BitLocker security depends on the active key protectors, not on the mere presence of encryption.

If you enable vTPM after BitLocker was already configured, the existing protector set does not automatically convert to TPM only protection.

You must verify with:

• manage bde status
• manage bde protectors get C:
  
  

If you see a Clear Key or no TPM protector, suspend and re enable BitLocker so that the VM reseals the key against the vTPM.

So vTPM does not only work during fresh install. It works whenever BitLocker is configured to use a TPM based protector. The difference you saw comes from how BitLocker was originally provisioned, not from a Hyper V bug.