We use TPM and PIN on our Windows laptops and suspend BitLocker for one reboot when installing updates. One user consistently gets a protection suspended notification, but we haven't seen it on other machines. Where should I start looking?
Why does only one user get a BitLocker protection suspended notification?
Answers
First check whether protection is actually suspended when the notification appears. Get-BitLockerVolume for C: will show the protection status, which helps distinguish a real suspension from a stale notification.
Then check the BitLocker-API Management and Operational logs in Event Viewer around the update and reboot. Also check when the update process runs Suspend-BitLocker and whether another task might be suspending it again. A reboot count of one is meant to resume protection after the next reboot, so the timing matters.
Reply to this answer
Check for pending firmware updates on that laptop. A restart may be needed to finish an update, and some firmware changes may need a full shutdown and cold boot instead. Check the update status and BitLocker protection again afterward.
Reply to this answer
Open TPM management and see whether the TPM reports reduced functionality. That can happen after a firmware update, so compare its status with a working laptop and check the Windows System log for TPM-related events.
Reply to this answer
Check the firmware settings too, especially whether Secure Boot is enabled. Secure Boot problems can affect BitLocker, although that alone wouldn't establish why this notification is appearing. Compare the affected laptop's settings and event logs with a working one.
Reply to this answer
Decrypting the drive and enabling BitLocker again is an option, but I'd leave that until you've checked the status, logs, TPM and firmware. It's a much more disruptive step and may not address the cause.
Reply to this answer
Add your answer
Answers are reviewed before publication.
b.249!plughole:
Get-Tpm is worth checking alongside that. The BitLocker status tells you about the volume, while TPM status may point to a separate issue.