BitLocker Drive Encryption is an integral security feature that provides considerable protection for the operating system on your computer and data stored on the operating system volume. BitLocker ensures that data stored on a computer remains encrypted even if the computer is tampered with when the operating system is not running. This helps protect against "offline attacks", attacks made by disabling or circumventing the installed operating system, or made by physically removing the hard drive to attack the data separately.

BitLocker uses the Trusted Platform Module (TPM) to provide enhanced protection for your data and to assure early boot component integrity. This helps protect your data from theft or unauthorized viewing by encrypting the disk volumes.

When installing firmware- or BIOS updates, hardware drivers or when updating the operating system, it is recommended to suspend Bitlocker protection.

In case Bitlocker protection is not suspended before, Bitlocker protection might request a Recovery Key on next boot of the operating system. Root cause is a not validated system integrity at start up.

For details about how to suspend or turn off BitLocker, please refer to the resolution detailed section below.

HOW TO SUSPEND BITLOCKER DRIVE ENCRYPTION AND- / OR DECRYPTING THE VOLUME

The procedure is the same for all BitLocker Drive Encryption configurations on TPM-equipped computers and computers without a compatible TPM.

When you suspend BitLocker (first procedure described below), you can choose either to temporarily turn-off BitLocker (= suspend), or to decrypt the drive. Disabling BitLocker allows TPM changes and operating system upgrades. Decrypting (second procedure described below), the drive means that the volume will once again be readable, and that all the keys are discarded. Once a volume is decrypted, you must generate new keys by going through the encryption process again.

    BEFORE YOU START

• You must be logged on as an administrator
• The drive must be encrypted (Bitlocker disc encryption active)

1. [ SUSPEND BITLOCKER ]
   Procedure to suspend BitLocker Drive Encryption on an operating system drive
   
1. Click Start, click Control Panel, click System and Security, and then click BitLocker Drive Encryption.
2. Click Suspend Protection for the operating system drive.
3. A message is displayed, informing you that your data will not be protected while BitLocker is suspended and asking if you want to suspend BitLocker Drive Encryption. Click Yes to continue and suspend BitLocker on the drive.
   
   By completing this procedure, you have suspended BitLocker protection on the drive by changing the decryption key to a clear key. To read data from the drive, the clear key is used to access the files. When BitLocker is suspended, TPM validation does not occur and other authentication methods, such as the use of a PIN or USB key to unlock the operating system drive, are not enforced. This allows you to make system changes such as updating the BIOS or replacing a data drive. When you are finished making changes to the computer, click Resume Protection from the BitLocker Drive Encryption Control Panel item to start using BitLocker Drive Encryption again.
   
   

2. [ TURN OFF BITLOCKER | DECRYPT ] 
   Procedure to turn off BitLocker Drive Encryption

USING "SUSPEND-BITLOCKER" CMDLET TO SUSPEND BITLOCKER ENCRYPTION

Please see below document from Microsoft, describing the suspension of BitLocker encryption using the "Suspend-BitLocker" cmdlet:

• https://docs.microsoft.com/en-us/powershell/module/bitlocker/suspend-bitlocker?view=windowsserver2019-ps