Windows 10 Secure Boot update triggers BitLocker key recovery

Microsoft has acknowledged an issue affecting Windows 10 customers who have installed the KB4535680 security update that addresses a security feature bypass vulnerability in Secure Boot.

Secure Boot is a security feature that blocks untrusted operating systems bootloaders on computers with Unified Extensible Firmware Interface (UEFI) firmware and a Trusted Platform Module (TPM) chip to prevent rootkits from loading during the OS startup process.

Windows versions affected by this vulnerability include multiple Windows 10 releases (from v1607 to v1909), Windows 8.1, Windows Server 2012 R2, and Windows Server 2012.

Security update triggers BitLocker recovery mode

However, installing the KB4535680 security update on systems running affected Windows versions might lead to the BitLocker recovery key being requested after rebooting, according to a known issue recently acknowledged by Microsoft.

"If BitLocker Group Policy Configure TPM platform validation profile for native UEFI firmware configurations is enabled and PCR7 is selected by policy, it may result in the BitLocker recovery key being required on some devices where PCR7 binding is not possible," Microsoft explains.

"To view the PCR7 binding status, run the Microsoft System Information (Msinfo32.exe) tool with administrative permissions."

BitLocker is Microsoft's full volume encryption feature that ships with all Windows versions since Windows Vista and uses the XTS-AES encryption algorithm to encrypt computer hard drives or removable drives to prevent data theft or exposure.

Users experiencing BitLocker recovery issues can use the information provided by Microsoft here to locate their recovery key.

Wow, the #Windows10 security update KB4535680 causes many BitLocker recovery. Does anyone else have this problem? How to workaround this in real world with many thousand devices? Thanks in advance!

— Dietmar Haimann (@DHaimann) February 15, 2021

Workaround available

Depending on the device's Credential Gard configuration, Microsoft recommends suspending BitLocker for one reboot cycle if Credential Gard is toggled on using the Manage-bde –Protectors –Disable C: -RebootCount 1 or for three reboot cycles using Manage-bde –Protectors –Disable C: -RebootCount 3.

In both cases, temporarily pausing BitLocker before installing the KB4535680 acts as a workaround for the BitLocker recovery issue.

Once you've installed the security update and the system has restarted (three times in a row if Credential Guard is enabled), you will have to reboot once again to resume BitLocker protection.

Admins who don't want to apply this workaround or who can't script the update to roll out in environments with hundreds or thousands of endpoints are advised to stop the KB4535680 update going out from the Endpoint Manager Configuration Manager (formerly System Center Configuration Manager).

Additional mitigation info and further details on this known issue are available in this KB4535680 support document.

H/T Günter Born