BitLocker Drive Encryption is an integral security feature that provides considerable protection for the operating system on your computer and data stored on the operating system volume. BitLocker ensures that data stored on a computer remains encrypted even if the computer is tampered with when the operating system is not running. This helps protect against "offline attacks", attacks made by disabling or circumventing the installed operating system, or made by physically removing the hard drive to attack the data separately.
BitLocker uses the Trusted Platform Module (TPM) to provide enhanced protection for your data and to assure early boot component integrity. This helps protect your data from theft or unauthorized viewing by encrypting the disk volumes.
When installing firmware- or BIOS updates, hardware drivers or when updating the operating system, it is recommended to suspend Bitlocker protection.
In case Bitlocker protection is not suspended before, Bitlocker protection might request a Recovery Key on next boot of the operating system. Root cause is a not validated system integrity at start up.
Suspension of BitLocker encryption allow users to access encrypted data on a volume that uses BitLocker Drive Encryption. Suspension of BitLocker does not mean that BitLocker decrypts data on the volume. Instead, suspension makes key used to decrypt the data available to everyone in the clear. New data written to the disk is still encrypted.
While suspended, BitLocker does not validate system integrity at start up. You might suspend BitLocker protection for firmware upgrades or system updates.
For details about how to suspend or turn off BitLocker, please refer to the resolution detailed section below.
HOW TO SUSPEND BITLOCKER DRIVE ENCRYPTION AND- / OR DECRYPTING THE VOLUME
The procedure is the same for all BitLocker Drive Encryption configurations on TPM-equipped computers and computers without a compatible TPM.
When you suspend BitLocker (first procedure described below), you can choose either to temporarily turn-off BitLocker (= suspend), or to decrypt the drive. Disabling BitLocker allows TPM changes and operating system upgrades. Decrypting (second procedure described below), the drive means that the volume will once again be readable, and that all the keys are discarded. Once a volume is decrypted, you must generate new keys by going through the encryption process again.
BEFORE YOU START
[ TURN OFF BITLOCKER | DECRYPT ]
Procedure to turn off BitLocker Drive Encryption
USING "SUSPEND-BITLOCKER" CMDLET TO SUSPEND BITLOCKER ENCRYPTION
Please see below document from Microsoft, describing the suspension of BitLocker encryption using the "Suspend-BitLocker" cmdlet:
Dynabook provides this information "as is" without warranty of any kind, either express or implied, including, but not limited to, the implied warranties of merchantability or fitness for a particular purpose. Dynabook shall not be responsible for the topicality, correctness, completeness or quality of the information or software provided. Dynabook is not liable for any damage caused by the use of any information or software provided, including information that is incomplete or incorrect. Any trademarks used herein belong to their respective owners.
Copyright Dynabook Europe GmbH. All rights reserved.