Bitlocker is "Suspended" during Windows Updates, Why?

Question

In our environment we use a mixture of Windows 10 LTSB and LTSC Windows 10 machines.

All our assets have Bitlocker enabled.

Updates are applied VIA SCCM (Microsoft Endpoint Configuration Manager) 2012 R2

When Windows 10 updates apply to those assets after a Patch Tuesday Update, Bitlocker is Suspended and the machines are shutdown as the updates normally apply when the machines are shutting down and the user goes home.

When the machine is next switched on, the Bitlocker screen does not appear (Bitlocker Suspended) and you are immediately presented with a Windows logon screen. After another reboot the machine re-enables the Bitlocker but this leaves the machine vulnerable until it is rebooted an additional time.

My questions are:

1. Why is Microsoft Suspending Bitlocker for the updates to take place and not re-enabling it before the machine shutsdown which leaves our machines vulnerable?
2. Is there way to ensure Bitlocker is enabled after the Windows Update (even if part way through and requires a reboot after a shutdown)?

Thank you.

Answer 1

Hi, @Skipper Of Odyssey
Thank you for posting in Microsoft Q&A forum.
Since you are using SCCM to deploy the windows updates, so check your client setting to see if the Suspend BitLocker PIN entry on restart is set to "Always"? If so, we may change it to "Never".

By the way, for SCCM update related issue, we may use the tag mem-cm-updates.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

I remember that if any of the updates includes update for BIOS (only if your device is from Microsoft, say WinPhone or Surface families) or BitLocker itself, it will temporarily suspend BitLocker in order to export the key on boot drive. Then on the next reboot it can update the metadata to the new version.

If that's the case, I don't know the reason why it won't resume automatically after booted. You may want to check Event Viewer and see if there's any hint.

Answer 3

Quality updates never suspend BitLocker although ConfigMgr Current Branch has the ability to do this when ConfigMgr initiates a restart (for whatever reason) -- see the screenshot from @AllenLiu-MSFT (this is not present in ConfigMgr 2012). However, this won't leave BitLocker in a suspended state after the reboot has completed. Thus, there's something else going on here and as @Cheong00 noted, the first step here is to review the event log to discover the source.

Also, as a note to the OP, ConfigMgr 2012 is only supported for managing Win 10 LTSB 2015 (and maybe 2016 LTSC -- I don't remember specifically). You really should upgrade to ConfigMgr CB soon.