We've got over a dozen Dell computers freezing after a recent update. We had to pause our rollout for April, but it's strange because many of the affected machines aren't appearing in Intune as needing the update. Some devices required BitLocker keys to reboot, and Fresh Start isn't working properly, likely due to hotpatch problems. Since we operate remotely, we don't have the malfunctioning devices physically on hand to troubleshoot. I've checked a few, and there aren't any events showing up in the DeviceEvents table in Log Analytics. Has anyone else encountered similar issues?
4 Answers
I've been hearing the same from others today; it looks like the April hotpatch is a real headache across Dell fleets. Those BitLocker prompts during the reboot definitely indicate some issues with the TPM measurement changes triggered by the update. If you can, pull the CBS.log from those affected machines since it’ll provide more insight than what you’re seeing in Intune. Also, make sure the devices are Hotpatch-eligible (Arc + MDE enrolled) because Fresh Start can fail with certain hotpatch scenarios. As for the machines you can’t physically access, I suggest suspending BitLocker before the next reboot if you can push a script through Intune to avoid the key scramble.
I’ve heard this is a known issue. After patching and rebooting, sometimes the certificate gets updated too slowly, leaving the OS with outdated info that doesn’t sync with BitLocker properly. Usually, a second reboot resolves this and lets the system boot correctly.
We can get the systems to boot, but they become unresponsive after logging in, requiring a forced power-off.
Seriously, people are trusting Microsoft enough to enable hotpatching? Sounds risky to me.
It does seem like your systems updated for Secure Boot certificates; could be causing some of the issues you're facing.
Thanks for the tip! The BitLocker part isn’t what worries me the most; it’s the freezing after about 10 minutes that’s rendering these computers unusable.