Suspend BitLocker Before a BIOS or Firmware Update (So It Doesn't Lock You Out)

You’re about to update your BIOS, UEFI, or TPM firmware and want to avoid being dropped to the BitLocker recovery screen afterward.

Why: BitLocker measures early-boot components — including firmware and Secure Boot settings — and seals its key to them through the TPM. A firmware update changes those measurements, so on the next restart BitLocker no longer recognizes the boot state and demands your 48-digit recovery key. Microsoft’s guidance is to temporarily suspend BitLocker before the update. Suspending leaves the drive fully encrypted but lets it boot without the recovery key, and resuming reseals the key to the new firmware — no recovery prompt.

Fix 1: Suspend with PowerShell (cleanest)

1. Open Windows PowerShell as administrator (Start, type PowerShell, right-click, Run as administrator).

2. Suspend protection on the OS drive, set to auto-resume after one restart:

   Suspend-BitLocker -MountPoint "C:" -RebootCount 1

   -RebootCount controls how many restarts before BitLocker turns itself back on (0–15). Use 1 for a single-reboot firmware update; use 0 to keep it suspended until you resume manually (useful if the update needs several reboots).

3. Run the firmware update and let the PC restart. With -RebootCount 1, BitLocker resumes automatically and reseals to the new firmware.

4. Confirm it’s protecting again:

   Get-BitLockerVolume -MountPoint "C:"

   Protection Status should read On.

Fix 2: Suspend with manage-bde (Command Prompt)

Same idea using the classic tool, in an elevated Command Prompt:

manage-bde -protectors -disable C: -rebootcount 1

-protectors -disable suspends protection (no key protectors are removed; the drive stays encrypted). Set -rebootcount 0 to suspend indefinitely. To resume manually afterward:

manage-bde -protectors -enable C:

Check state any time with manage-bde -status.

Fix 3: Suspend from the Control Panel (no commands)

1. Open Control Panel → System and Security → BitLocker Drive Encryption.
2. Next to the OS drive, click Suspend protection, then Yes.
3. Do the firmware update.
4. Return to the same screen and click Resume protection → Yes.

Note: suspending from the Control Panel resumes after the next restart; if your update reboots several times, prefer Fix 1 or 2 with -RebootCount 0 and resume manually when finished.

FAQ

Is suspend the same as turning BitLocker off? No. Suspend leaves the drive fully encrypted and keeps all key protectors — it just makes the key available so the drive boots without the recovery key. Turning BitLocker off decrypts the whole drive, which takes a long time.

I forgot to suspend and now it wants my recovery key. Enter your 48-digit key once (find it at aka.ms/myrecoverykey). Back in Windows, run Suspend-BitLocker -MountPoint "C:" -RebootCount 1 then Resume-BitLocker -MountPoint "C:" to reseal and stop it recurring.

Does suspending leave my data exposed? Briefly the key is available unsecured so the drive can boot, which is why you resume immediately after the update. For a planned, attended firmware update this is the supported approach.

Sources: Microsoft Learn — Suspend BitLocker protection for non-Microsoft software updates, Microsoft Learn — manage-bde protectors, Microsoft Learn — BitLocker recovery overview