Bitlocker Pin and Software Patching
In the last number of years many businesses have started rolling out Full Disk Encryption software throughout their IT Environment’s enabling piece of mind and security to prevent Data Loss / Theft, but this introduced many different issues for IT Administrators in general. Later iterations of Encryption products allowed “Maintenance” windows to be implemented as apart of policies so pc’s could have software updates installed and rebooted to complete.
Its the reboot aspect that causes the most issues especially if you have a startup Pin/Password, i encountered this recently in an environment i was managing. The issue was that after software updates were installed PC’s would simply staff offline because they would be stuck at the password/pin prompt screen for bitlocker. Hmmm well thats thrown a spanner in the works!
Its actually something microsoft have documented well quiet well here
For your convenience ive listed them here:
| Type of update | Action |
|---|---|
|
Windows Anytime Upgrade |
Decrypt |
|
Upgrade from Windows 7 to Windows 8 |
Suspend |
|
Non-Microsoft software updates, such as:
|
Suspend |
What this doesn’t say however is what to do if you have a startup pin ? In a way it actually does but you have to read between the lines on this one, if you suspend the bitlocker protectors on the OS drive it will temporarily stop the startup PIN/Password from prompting.
You can accomplish this by running the following command before every reboot:
manage-bde –protectors –disable c:
If you run this command on your machine you will see your Hard disk icon change:
To This
A quick restart later and your all patched up! Simples!