Summary created by Smart Answers AI
In summary:
- Microsoft’s May 2024 update (KB5089549) resolves the Windows 11 BitLocker lockout issue that prevented users from accessing their PCs without recovery keys.
- PCWorld reports the problem originated from April’s update (KB5083769), which affected devices with specific BitLocker Group Policy and TPM configurations, primarily impacting corporate systems.
- Users should install the latest Windows 11 update to fix the BitLocker recovery prompt issue and restore normal system access.
Updated on May 15th, 2026: With Windows 11’s May update KB5089549, Microsoft has addressed the forced BitLocker recovery key prompt issue described below. “This update addresses an issue where some devices might enter BitLocker Recovery after updating boot files on systems with certain Trusted Platform Module (TPM) validation settings … after installing the April 2026 security update (KB5083769).” Install the latest update via Windows Update as soon as you can.
Original story from April 16th, 2026: Not long after Microsoft released April’s Patch Tuesday for Windows 11 did some users start complaining of serious problems. The latest Windows 11 update, KB5083769, can lock users out of their PCs as Windows requires them to enter their BitLocker recovery key. Anyone who doesn’t have their key can’t use their PC.
Microsoft has acknowledged the issue:
Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update.
This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments:
1. BitLocker is enabled on the OS drive.
2. The Group Policy “Configure TPM platform validation profile for native UEFI firmware configurations” is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually).
3. System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as “Not Possible“.
4. The Windows UEFI CA 2023 certificate is present in the device’s Secure Boot Signature Database (DB), making the device eligible for the 2023‑signed Windows Boot Manager to be made the default.
5. The device is not already running the 2023-signed Windows Boot Manager.
In other words: The issue is likely to affect only a small number of users who meet the criteria above, and the issue is most likely to occur on computers in corporate environments. The solution for affected users is to enter the BitLocker recovery key. If you don’t know your key, you must request it from your IT support team. On the page, Microsoft also explains how IT departments can resolve the issue.
If necessary, you or your IT department can perform a Windows update rollback (known as a Known Issue Rollback) to remove problematic updates KB5083769 or KB5082052 from your Windows PC. Note, however, that you’ll be made vulnerable once more to the security flaws that were patched by these updates.
By the way: If you’re using Windows 11 Home, you’re missing out on the many benefits of Windows 11 Pro. To learn more, see our comparison of Windows 11 Home and Pro. If you want to upgrade, snag it for cheap in the PCWorld Software Store: now just $59 instead of $99.
This article originally appeared on our sister publication PC-WELT and was translated and localized from German.