April Windows Server Update Can Trigger BitLocker Recovery on Some Devices
Summary
Microsoft says April 2026 update KB5082063 can trigger a one-time BitLocker recovery prompt on some Windows Server 2025 devices with a specific PCR7 policy configuration. Administrators can remove the policy or apply a Known Issue Rollback.
Key points
- Microsoft says installing KB5082063 can trigger a BitLocker recovery prompt on the first restart for some Windows Server 2025 devices.
- The issue requires a specific configuration involving BitLocker, PCR7 in the TPM validation profile, Secure Boot reporting PCR7 Binding as “Not Possible,” and the Windows UEFI CA 2023 certificate.
- The recovery key should only need to be entered once if the Group Policy configuration remains unchanged.
- Microsoft advises administrators to remove the PCR7 Group Policy before deploying the update or apply a Known Issue Rollback if they cannot remove it.
- Microsoft says affected configurations are typically found on enterprise-managed systems and that it is working on a permanent solution.
Article Details
- Event Type
- Windows Server 2025 update-related BitLocker recovery issue
- Impact
- Installing the April 2026 KB5082063 security update can trigger a one-time BitLocker recovery prompt on Windows Server 2025 devices with a specific PCR7-based TPM and Secure Boot configuration and an unrecommended Group Policy setting. The recovery key is needed only once if the policy remains unchanged. Microsoft recommends removing the Group Policy before installation or applying a Known Issue Rollback; it is developing a permanent fix.
Vendors
Products
BitLockerinstalling the April 2026 KB5082063 security update can force some Windows Server 2025 devices into BitLocker recovery on first restart when an unrecommended BitLocker Group Policy configuration is present.KB5082063Microsoft confirmed that installing the April 2026 KB5082063 security update can force some Windows Server 2025 devices into BitLocker recovery on first restart when an unrecommended BitLocker Group Policy configurationWindows Server 2025Microsoft confirmed that installing the April 2026 KB5082063 security update can force some Windows Server 2025 devices into BitLocker recovery on first restart when an unrecommended BitLocker Group Policy configuration