BitLocker Bug: Fix Only for Windows 11. Still No Solution for Windows 10 and Server

Microsoft has finally started to untangle the issues related to BitLocker malfunctions, although the solution is not yet universal. The problem, which emerged forcefully after the release of April 2026 security updates, forced several systems to restart directly into the encryption recovery screen, blocking access to data without the manual unlock key.

With the release of the cumulative KB5089549 update, the Redmond company corrected the anomaly, but limited the intervention to Windows 11 25H2 systems only. The bug primarily manifested on machines with Group Policy configurations defined as not recommended, particularly those related to validating the TPM (Trusted Platform Module) profile. The crux of the matter involves the PCR7 (Platform Configuration Register 7) logs and the settings of the native UEFI firmware. When the April update (identified by the code KB5083769) altered the boot files, the system detected an unauthorized change in the trust chain, triggering the BitLocker lock for safety.

Windows 10 and Server Still Awaiting Final Fix

Although Microsoft's telemetry indicates that consumer devices are less prone to this risk, the enterprise world has paid the highest price due to the complexity of security policies managed by IT teams. While users of the latest version of Windows 11 can breathe a sigh of relief, the same cannot be said for those managing Windows 10 or Windows Server machines. For these platforms, the problem persists, and a permanent resolution will only be integrated into a forthcoming unspecified update. During this transitional phase, system administrators must rely on a manual workaround (officially recommended in the support documentation) that involves removing the policy 'Configure TPM platform validation profile for native UEFI firmware configurations' before proceeding with the installation of the problematic patches.

This is not the first time BitLocker has come under scrutiny for similar reasons. Microsoft's release history is dotted with similar incidents, such as in 2022 with the KB5012170 package, or more recently in 2024 and 2025, when out-of-band updates were necessary to unlock Windows 10 PCs stuck in loops demanding the encryption key.

The current corrective action occurred within the broader context of May 2026 Patch Tuesday, a particularly dense round of updates that addressed as many as 120 vulnerabilities. Among these, 17 flaws were classified as critical, making the installation of the new packages almost mandatory for the security of the infrastructure.