Microsoft Confirms Windows 11 Updates KB5083769 and KB5082052 Cause BitLocker Recovery Prompts

Microsoft has confirmed that its April 2026 Patch Tuesday updates are triggering unexpected BitLocker recovery key requests on certain Windows 11, Windows 10, and Windows Server systems. The affected updates include KB5083769 and KB5082052 for Windows 11, KB5082200 for Windows 10, and equivalent cumulative updates for Windows Server 2022 and Windows Server 2025.

Initially released without documented known issues, these updates have since been found to incorrectly force a BitLocker recovery screen on devices meeting a specific set of criteria. Microsoft attributes the problem to an unsupported BitLocker Group Policy configuration that disrupts TPM validation and triggers the recovery prompt unexpectedly.

Which Systems Are Affected?

According to Microsoft, only devices that meet all of the following conditions are impacted by this issue:

• BitLocker is enabled on the operating system drive.
• The Group Policy setting “Configure TPM platform validation profile for native UEFI firmware configurations” is active, with PCR7 included in the validation profile (or the corresponding registry value is manually configured).
• Secure Boot State PCR7 Binding shows as “Not Possible” in System Information (msinfo32.exe).
• The Windows UEFI CA 2023 certificate is present in the device’s Secure Boot Signature Database (DB).
• The device is not already running the 2023-signed Windows Boot Manager.

Microsoft emphasizes that this configuration is uncommon on personal devices and is primarily found in managed enterprise environments where IT departments have standardized BitLocker policies for security compliance. As such, the issue mostly affects business estates, staged rollouts, imaging workflows, and systems undergoing deployment or re-imaging processes.

Impact and User Experience

While the BitLocker recovery prompt can be alarming, Microsoft confirms that the impact is limited to a small subset of systems. Importantly, users only need to enter their BitLocker recovery key once to restore full access to their device. After providing the key, the system will boot normally and will not prompt for recovery again on subsequent reboots.

The company describes the prompt as a “one-time event” and notes that a permanent fix is already in development. Yet, because affected systems are often managed endpoints in enterprise environments, the operational impact can be disproportionate to the number of devices involved — particularly if the issue arises during large-scale deployment or update cycles.

Recommended Workarounds and Solutions

Microsoft has provided two supported methods to resolve the issue, either before or after installing the updates. The recommended solution involves adjusting the problematic Group Policy settings:

1. Open the Local Group Policy Editor (gpedit.msc) or Group Policy Management Console.
2. Navigate to Computer Configuration > Administrative Templates > System > Trusted Platform Module Services.
3. Locate the policy “Configure TPM platform validation profile for native UEFI firmware configurations.”
4. Set it to “Not Configured” or disable it.
5. Alternatively, if the setting is configured via registry, remove the corresponding value that includes PCR7 in the validation profile.

Microsoft advises enterprises to apply this change prior to deploying the April 2026 updates to prevent the recovery prompt from occurring. For systems already affected, users can proceed with the recovery key entry once, then apply the Group Policy change to avoid future occurrences.

Official Statement and Ongoing Response

Microsoft has acknowledged the issue through official channels and is actively working on a permanent fix. The company advises IT administrators to review their BitLocker and TPM-related Group Policy configurations, especially in environments using standardized imaging or deployment scripts that may include the problematic PCR7 setting.

While the update was intended to improve security and system stability — including Remote Desktop-related changes — the unintended interaction with specific firmware trust chains and Secure Boot states highlights the increasing complexity of modern Windows servicing in heterogeneous hardware environments.

Users are encouraged to keep their systems updated but to verify compatibility with their specific configurations, particularly in managed enterprise settings. For further guidance, Microsoft recommends consulting official support documentation and engaging with Windows deployment teams to assess risk prior to broad rollout.

Frequently Asked Questions

Will I lose access to my data if I see a BitLocker recovery prompt?

No. The BitLocker recovery prompt is a security feature designed to protect your data. You will need to enter your recovery key to unlock the drive, but your data remains intact and accessible once authenticated.

How do I find my BitLocker recovery key?

Your recovery key may be stored in your Microsoft account (if device encryption is enabled), in Active Directory (for domain-joined devices), or saved as a file or printed copy during initial setup. Check account.microsoft.com/devices/recoverykey if you signed in with a Microsoft account.

Is this issue widespread among home users?

No. Microsoft states that the affected configuration is “unlikely to be found on personal devices not managed by IT departments.” The issue primarily impacts enterprise systems with specific Group Policies related to TPM validation and Secure Boot.

Should I delay installing the April 2026 Windows updates?

Microsoft does not recommend delaying security updates. Instead, administrators should verify their Group Policy configurations and apply the recommended workaround before deployment. Home users are unlikely to be affected and can proceed with updates as normal.

Is a fix in development?

Yes. Microsoft confirms that a permanent fix is already in development and will be released in a future update. In the meantime, the one-time recovery key entry and Group Policy adjustment remain the supported resolution paths.