This guide is for the person who looks after a small office's computers, say a 34-year-old IT admin with about 20 PCs and one shared spreadsheet of passwords. After an April update a few of your machines stopped at a blue BitLocker screen asking for a recovery key. You will learn what triggered it, what Microsoft fixed in May, how to check your own PCs in a few minutes, and what to do about the ones that are still locked.
Why did BitLocker ask for a recovery key after the Windows update?
Short answer: The Windows update KB5083769, released on 14 April 2026, could force BitLocker (Windows' built-in drive lock) into recovery on PCs that had one specific Group Policy turned on. The policy is named Configure TPM platform validation profile for native UEFI firmware configurations, and it sets an invalid PCR7 value. Microsoft fixed it for Windows 11 25H2 on 13 May 2026.
What exactly went wrong?
BitLocker stores a secret inside the TPM (a small security chip on the motherboard) and releases it only if the start-up chain looks unchanged. Group Policy (a set of rules an administrator pushes to many PCs) can tell BitLocker which parts of that chain to watch. On PCs with the policy above, the April update left BitLocker seeing a mismatch, so it stopped at the recovery screen and asked for the 48-digit recovery key.
Microsoft said consumer devices were unlikely to be affected, because the policy is normally set by an administrator in a managed office or school setup. A home laptop that was never joined to a company or school is a very unlikely case. You can read the details in this report on the Microsoft fix.
What did Microsoft fix, and for which Windows?
If you also manage Windows 10 machines, note that Microsoft described their permanent fix only as planned for a future update, so check Microsoft's current notes for those. This post stays with Windows 11.
How do I check my own PCs?
Step 1: See whether the update is installed
- Open Settings, then Windows Update, then Update history.
- Look for KB5089549 in the list. The wording can differ slightly between versions.
- If it is missing, run Check for updates with the charger connected.
Step 2: See whether the policy is set
On Windows Pro, press the Windows key and R, type gpedit.msc and open Computer Configuration, Administrative Templates, Windows Components, BitLocker Drive Encryption, Operating System Drives. Look for the policy named above. If it says Not configured, your PC is not in the affected group. Windows Home has no gpedit, which fits Microsoft's remark that home PCs were unlikely to be hit.
Step 3: Save the keys before the next update
Do not install further updates on a locked-out office PC until you have its recovery key in hand. Keys are often saved to the Microsoft account or the company directory, so look there first. Our guide on BitLocker drive recovery shows where else a key may be.
A PC is stuck on the recovery screen. What now?
- Type the 48-digit key from the account or printout. The PC should then start normally.
- Once Windows is open, install the May update and restart. Do not switch BitLocker off just to stop the prompt.
- Do not reset the PC or reinstall Windows to get past the screen; that erases the files the lock was protecting.
- If the key cannot be found, stop. Read our note on drives without a key and ask before trying anything.
Power cuts, mixed PCs and office updates
Small offices often run a mix of PCs bought at different times, so the Windows versions differ and one policy change reaches only some of them. Power cuts add their own risk: an update that is cut off by a voltage dip can leave a machine needing repair for a different reason. Keep a UPS (a battery backup) on the desk PCs, and do the update in the evening rather than during billing hours. A key written on a page and kept in a locked drawer works just as well as one stored online, as long as you can find it on the day.
When to get help
- A PC shows the recovery screen and nobody can find its key.
- The key is accepted but the screen returns after every restart.
- Several PCs in the office show the screen on the same morning.
- An update stopped halfway and the PC will not reach Windows.
Our Windows installation and repair service can look at these machines, and laptops can reach us by courier from anywhere in India. The visit charge for our Hyderabad doorstep service is ₹149 doorstep visit fee, waived when you approve laptop repair with us. The exact repair quote comes after diagnosis and is shared for your approval before any work.
A note from the LRW Engineer Team
Before any update day, make a simple sheet with each PC's name, its Windows version and where its recovery key is saved. Test one key by looking it up, not by hoping. If you ever need to change a policy across the office, try it on one spare PC first and wait a day before the rest.