“BitLocker recovery” can appear after a Windows update changes Secure Boot, TPM, or EFI system partition data. That 48-digit prompt is a rotten surprise, but suspending BitLocker before the update usually prevents it.
What Is BitLocker Drive Encryption?
BitLocker encrypts your Windows drive. It blocks access to your files if someone removes the drive or starts your PC from another device. Full BitLocker comes with Windows 10 and Windows 11 Pro, Enterprise, and Education. Some Home devices have the simpler Device Encryption feature.
BitLocker also checks parts of the startup process. A firmware or Windows update can change those checks. BitLocker may see the change as tampering and ask for the recovery key at startup.
Suspending BitLocker pauses these startup checks without decrypting the drive. Don’t choose Turn off BitLocker. That option decrypts the whole drive and can take a long time.
Prerequisites
Make sure you have:
- A Windows 10 or Windows 11 PC
- An administrator account
- BitLocker or Device Encryption support
- Power connected to the PC
- Enough free space for the Windows update
- A backup of important files
- Your BitLocker recovery key stored somewhere outside the encrypted PC
- Approval from IT if the computer is managed by work or school
| Requirement | Details |
|---|---|
| Supported editions | Windows 10/11 Pro, Enterprise, or Education for full BitLocker |
| Home edition | Device Encryption may be available on supported hardware |
| System drive | Usually C: |
| Recovery key | A 48-digit key saved to a Microsoft account, file, printout, USB drive, or organization |
| Administrator access | Required to enable, suspend, or resume protection |
That recovery-key backup matters. If the update still triggers recovery, you’ll need a copy that isn’t stored on the locked PC.
Step-by-Step Guide
Fix #1: Check Whether BitLocker Is Already On
Check the current status before changing anything.
- Press
Windows + R.
- Enter the following command and select OK:
control /name Microsoft.BitLockerDriveEncryption
- Find Operating system drive and check the status beside
C:.
- Continue based on the result:
– BitLocker on or Protection on: Go to Fix #3. – BitLocker off: Complete Fix #2 if you want to encrypt the drive. – Protection suspended: Leave it suspended until the update finishes, then go to Fix #6. – No BitLocker options: Open Settings > System > About. Check your edition under Windows specifications.
Expected result: You know whether the system drive is encrypted and its protection is active.
Fix #2: Enable and Set Up BitLocker
Skip this fix if BitLocker is already enabled. You don’t need to enable encryption just to install an update.
- Open Control Panel > System and Security > BitLocker Drive Encryption.
- Select Turn on BitLocker beside the
C:drive.
- Wait while Windows checks whether the PC supports BitLocker.
- Choose where to save the recovery key. A Microsoft account is handy, but keep another copy. You can use a USB drive, a printout, or an approved password manager.
Warning: Do not save the only recovery-key copy on the encrypted drive. You won’t be able to open that file if BitLocker locks the drive.
- Confirm that you can open the saved key before continuing. Check its saved location; don’t trust your memory here.
- Choose Encrypt used disk space only for a new or mostly empty PC. Choose Encrypt entire drive if the PC has stored personal files.
- Select New encryption mode for a fixed drive that will stay in this Windows 10 or Windows 11 PC.
- Select Run BitLocker system check.
- Select Continue, then restart the PC when prompted.
- Sign in and reopen Control Panel > System and Security > BitLocker Drive Encryption.
- Wait for encryption to finish. You can use the PC during this process, but keep it connected to power.
Expected result: The C: drive reports BitLocker on, and you can access your recovery-key backup.
Fix #3: Suspend BitLocker Before the Update
Don’t click Turn off BitLocker. You only need to suspend it. Turning it off starts full decryption.
Windows 11 Settings Path
- Open Settings > Privacy & security > Device encryption.
- Select BitLocker drive encryption or Related BitLocker settings if the link appears.
- Find the
C:drive and select Suspend protection.
- Select Yes in the confirmation dialog.
Windows 10 Settings Path
- Open Settings > Update & Security > Device encryption.
- Select BitLocker settings if it appears.
- Select Suspend protection beside the
C:drive.
- Select Yes to confirm.
Control Panel Path
Use this method if Settings only has an on/off Device Encryption switch or doesn’t offer suspension. The classic page is often clearer.
- Open Control Panel > System and Security > BitLocker Drive Encryption.
- Select Suspend protection beside the operating-system drive.
- Select Yes.
- Confirm that the page shows Protection suspended and offers Resume protection.
Expected result: The drive stays encrypted, but BitLocker’s startup checks are paused.
Fix #4: Install the Windows Update Safely
Install the update while protection is suspended. Avoid making other firmware or security changes at the same time.
- Save your work and close open apps.
- In Windows 11, open Settings > Windows Update. In Windows 10, open Settings > Update & Security > Windows Update.
- Select Check for updates.
- Select Download & install if Windows lists the update as optional.
- Keep the PC connected to power while Windows downloads and installs the update.
- Select Restart now when prompted.
- Let every install stage and restart finish. Don’t force the PC off unless it stays unresponsive for a long time.
A long pause at one percentage can look grim. Give Windows time. Interrupting the update can cause a harder problem.
Expected result: Windows reaches the sign-in screen and desktop without asking for the BitLocker recovery key.
Fix #5: Confirm the Update Installed Successfully
Reaching the desktop isn’t enough. Check the result before restoring BitLocker’s startup checks.
- Open Settings > Windows Update > Update history. On Windows 10, use Settings > Update & Security > Windows Update > View update history.
- Expand Quality Updates, Security Updates, or the matching update category.
- Find the update and confirm it says Successfully installed.
- Press
Windows + R, enterwinver, and select OK if you need to check the Windows build number.
- Make sure Windows starts normally. Check the network and open your usual apps before resuming BitLocker.
Expected result: Update History lists the update as successfully installed, and Windows works normally.
Fix #6: Resume BitLocker Protection
Don’t leave protection suspended after checking the update. This step takes less than a minute.
- Open Control Panel > System and Security > BitLocker Drive Encryption.
- Find the
C:drive.
- Select Resume protection.
- Approve the administrator prompt if Windows displays one.
- Confirm that the status changes from Protection suspended to Protection on.
- Restart the PC once more.
- Return to the BitLocker page and confirm protection remains on.
Expected result: BitLocker is active and linked to the updated startup setup. A normal restart should no longer trigger recovery.
Fix #7: Use PowerShell for an Advanced Suspend-Update-Resume Workflow
The graphical method is better for one PC. Use PowerShell if the interface is unavailable or you want to set automatic resumption.
- Right-click Start and select Terminal (Admin) or Windows PowerShell (Admin).
- Check the current status:
Get-BitLockerVolume -MountPoint "C:"- Suspend protection for two restarts:
Suspend-BitLocker -MountPoint "C:" -RebootCount 2- Confirm that
ProtectionStatusreportsOffwhileVolumeStatusstill shows the drive as encrypted:
Get-BitLockerVolume -MountPoint "C:"ProtectionStatus: Off sounds worse than it is. Here, it means the protectors are suspended. VolumeStatus confirms that the drive remains encrypted.
- Install and verify the Windows update using Fixes #4 and #5.
- Resume protection manually:
Resume-BitLocker -MountPoint "C:"- Verify the final status:
Get-BitLockerVolume -MountPoint "C:"Expected result: ProtectionStatus returns to On without decrypting or re-encrypting the drive.
Configuration
Recovery-Key Storage
Keep the recovery key somewhere you can reach from another device. Good choices include your Microsoft account, a printed copy, or a USB drive stored elsewhere. Work devices may store it in your organization’s Microsoft Entra ID account.
You normally don’t need the key to suspend or resume BitLocker from an administrator account. Still, it can get you back in if the update causes an unexpected recovery screen.
Automatic Resumption
A suspension made through the graphical interface often lasts until a restart. The result can depend on your Windows version, update steps, and work policy. Don’t assume protection resumed. Check its status after the update.
PowerShell’s -RebootCount parameter sets how many restarts BitLocker allows before it resumes. A value of 0 keeps protection suspended until you resume it yourself. I’d avoid that value unless you’re watching the PC.
Windows Home Device Encryption
Windows Home doesn’t show the full BitLocker Control Panel tools on every device. If Settings > Privacy & security > Device encryption has only an on/off switch, don’t turn it off for an update. That starts decryption.
Search Start for Manage BitLocker. If it isn’t available, check the update’s known issues on Microsoft’s release-health page. You can also ask the PC maker or Microsoft Support which process to use.
iOS
You can’t install, suspend, or resume BitLocker on iOS. An iPhone or iPad can still retrieve a recovery key saved to your Microsoft account if the Windows PC is locked.
macOS
BitLocker is a Windows feature and can’t manage a Mac startup disk. macOS uses FileVault. Windows Update doesn’t affect FileVault’s startup checks.
You can use a Mac to retrieve a BitLocker recovery key from your Microsoft account or organization portal.
Tips and Troubleshooting
Already Stuck on the BitLocker Recovery Screen?
Don’t clear the TPM, change Secure Boot settings, format the drive, or reinstall Windows. Those actions can turn a fixable lockout into lost data.
Write down the Recovery key ID from the blue screen. Then use another device to follow Help Desk Geek’s existing How to Find Your BitLocker Recovery Key article. Microsoft also has an official BitLocker recovery-key lookup guide.
Enter the matching 48-digit key and confirm that the update finished. Then resume BitLocker so its checks match the new boot setup.
Why Can a Windows Update Trigger Recovery?
BitLocker uses the TPM to check Secure Boot, firmware, the boot manager, and other startup data. An update can change the EFI system partition or Secure Boot data. Those changes may produce different results during the next startup check.
If protection stayed active during the change, BitLocker may ask for the recovery key. Entering the key proves that an approved person is starting the PC.
Which 2026 Updates Are Affected?
The editorial issue information links April 2026 update KB5082063 and June 2026 update KB5094126 to BitLocker recovery behavior. Check both IDs on the current Windows release health dashboard before publication or installation. Microsoft can change KB pages, affected-version lists, and fixes.
To check your PC, open Settings > Windows Update > Update history and search for the KB number. You can also run:
Get-HotFix -Id KB5082063,KB5094126 -ErrorAction SilentlyContinueNo output means Windows didn’t find those IDs in the installed hotfix list. Some servicing updates don’t appear in Get-HotFix, so Update History is still the main check.
“Suspend Protection” Is Missing or Grayed Out
- Confirm you’re signed in with an administrator account.
- Check that BitLocker is on for
C:.
- Open the classic Control Panel page instead of using the Device Encryption switch.
- If the PC shows an organization-management notice, stop and contact IT.
A workplace can block local suspension through Group Policy or Microsoft Intune. IT may need to approve the update or suspend protection for you. It may also give you the recovery-key steps. I’d skip policy workarounds on a managed PC.
The Update Still Fails
BitLocker suspension only keeps startup checks from stopping the update. It won’t fix low disk space, broken Windows Update files, driver conflicts, or a pending restart.
On Windows 11, run Settings > System > Troubleshoot > Other troubleshooters > Windows Update. On Windows 10, use Settings > Update & Security > Troubleshoot > Additional troubleshooters > Windows Update.
Frequently Asked Questions
Is it safe to suspend BitLocker temporarily?
Yes, during a controlled update while the PC stays with you. The drive remains encrypted, but Windows can release the startup key without its normal check. Resume protection after you’ve verified the update.
Is suspension the same as turning BitLocker off?
No. Suspension pauses the protectors without decrypting stored data. Turning BitLocker off decrypts the whole drive and removes its protection.
How long does a BitLocker suspension last?
A suspension made through the graphical interface often resumes after a restart. Updates may need several restarts, and work policies can change that behavior. Always check the final status yourself. PowerShell can set an exact restart count.
Do I need the recovery key to suspend BitLocker?
Usually, no. You need administrator access. Back up the recovery key first in case the firmware, hardware, or update still triggers recovery.
How do I turn BitLocker back on after the update?
Open Control Panel > System and Security > BitLocker Drive Encryption. Select Resume protection beside C:. Choose Turn on BitLocker only if the drive is fully decrypted and BitLocker is off.
Can I do this on a managed work PC?
Only if your organization’s policy allows it. Contact IT before changing BitLocker on a work or school device. Microsoft Intune, Group Policy, or Microsoft Entra ID may control the recovery key and suspension options.
Wrapping Up
| Step | Action | Applies To |
|---|---|---|
| 1 | Verify BitLocker and back up the recovery key | All encrypted Windows PCs |
| 2 | Suspend protection without decrypting | PCs installing a flagged update |
| 3 | Install and restart | Windows 10 and Windows 11 |
| 4 | Confirm the update succeeded | All updated PCs |
| 5 | Resume and verify protection | All suspended drives |
For one PC, the Control Panel method is my pick. Suspend protection, install the update, check Update History, and resume protection. It avoids full decryption and is hard to get wrong.
If recovery prompts continue, stop repeating the update. Unstable firmware, TPM trouble, unwanted boot changes, or malware may be the cause. Contact the PC maker or your IT team.
