BitLocker suspended: what it means and how to resume protection

Applies to: Windows 11 and Windows 10 Pro, Enterprise and Education with BitLocker, and Windows Home PCs that use Device encryption.

What “BitLocker suspended” means

When BitLocker is on, the PC’s TPM chip checks the firmware and startup files before releasing the key that unlocks the drive. If anything important has changed, you get the blue recovery screen asking for your recovery key.

Suspending BitLocker (Microsoft also calls it disabling the key protectors) keeps your data encrypted but puts a clear key on the drive, so the PC starts without that check. That lets firmware, BIOS and some Windows updates change startup components without triggering the recovery screen. The catch is that while it’s suspended, anyone who has the drive can read it, so it should only stay that way for a short time.

You’ll see the state in a few places: Manage BitLocker in Control Panel shows BitLocker suspended or Protection suspended, File Explorer may show a warning icon on the drive, and manage-bde -status shows Protection Off while Conversion Status still says the drive is encrypted.

Why BitLocker gets suspended

• Windows updates: some updates, especially those that touch boot files, suspend BitLocker for one restart and then resume it automatically.
• BIOS or firmware updates: PC maker tools (for example from Dell, HP or Lenovo) often suspend BitLocker before flashing the BIOS. If the update was interrupted or needed several restarts, protection can be left off.
• Manual suspension: you, your IT team or a tool suspended BitLocker with no restart limit, for example from the command line with a reboot count of 0.
• A TPM or Secure Boot problem: if Windows can’t seal the key to the TPM, protection can’t resume until that’s fixed. This often follows a TPM reset or a motherboard or CPU change; see new CPU installed: fTPM NV corrupted.

If you just installed updates, restart once or twice and check again. In most cases protection comes back by itself.

How to resume BitLocker protection

1. Press Windows, type Manage BitLocker and press Enter. (It’s also in Control Panel > System and Security > BitLocker Drive Encryption.)
2. Next to the drive that shows BitLocker suspended, select Resume protection.
3. Approve the administrator prompt. The status changes to BitLocker on straight away; there’s no re-encryption wait.

On Windows 11 or 10 Home with Device encryption, open Settings > Privacy & security > Device encryption (Windows 10: Settings > Update & Security > Device encryption). If it’s off, turn it on. If it says it’s waiting for activation, sign in with a Microsoft account so the recovery key can be backed up, then turn it on.

Before you rely on it: make sure you know where your recovery key is. Our guide on finding your BitLocker recovery key shows where it’s usually saved, including your Microsoft account.

Resume or check it from the command line

Open Command Prompt as administrator (search for cmd, right-click it and choose Run as administrator). Check the current state:

manage-bde -status C:

If Protection Status says Protection Off but the drive is encrypted, turn the protectors back on:

manage-bde -protectors -enable C:

In PowerShell (run as administrator), the equivalent is:

Resume-BitLocker -MountPoint "C:"

Replace C: with the letter of another drive if needed. Run manage-bde -status again afterwards to confirm it now shows Protection On.

If protection won’t resume

• Run tpm.msc and check the status says The TPM is ready for use. If it says the TPM can’t be found or isn’t ready, turn the TPM (often called fTPM, PTT or Security Device) back on in the BIOS/UEFI settings.
• Check that Secure Boot hasn’t been turned off in the BIOS since BitLocker was set up. Run msinfo32 and look at Secure Boot State.
• Finish any pending BIOS or Windows update and restart, then try again.
• On a work PC, BitLocker may be controlled by your IT team’s policy, which can keep it suspended; ask them before changing anything.

If the PC asks for the recovery key at startup after one of these changes, enter it once and Windows will start; then resume protection as above. If startup fails completely, see your PC couldn’t start properly.

How to suspend BitLocker on purpose

Suspend BitLocker before you update the BIOS, change firmware settings such as Secure Boot or the TPM, or install a tool that changes the boot files. That way the PC won’t ask for the recovery key afterwards.

1. In Manage BitLocker, select Suspend protection next to the system drive and confirm. Depending on the Windows version, this either resumes after the next restart or stays suspended until you resume it, so check afterwards.
2. Or, in an administrator Command Prompt, suspend it for exactly one restart:

manage-bde -protectors -disable C: -RebootCount 1

In PowerShell, Suspend-BitLocker -MountPoint "C:" -RebootCount 1 does the same. A reboot count of 0 suspends it until you resume it yourself. After the update, check that Manage BitLocker shows BitLocker on again, and resume it manually if not.

Related guides

• How to find your BitLocker recovery key
• New CPU installed: fTPM/PSP NV corrupted
• Your PC couldn’t start properly: 7 fixes for the Automatic Repair screen
• Windows Security not opening in Windows 11: how to fix it

Official sources: for more detail, see these Microsoft pages:

• Microsoft Learn: BitLocker operations guide
• Microsoft Learn: manage-bde protectors
• Microsoft Learn: Suspend BitLocker protection for non-Microsoft software updates

Frequently asked questions

Is my data still encrypted when BitLocker is suspended?

Yes. The data on the drive stays encrypted, but the key is stored unprotected on the drive while it’s suspended, so the encryption doesn’t stop someone who has the PC or the drive. Resume protection as soon as the update or change is done.

Does resuming BitLocker take a long time?

No. Resuming only turns the key protectors back on; the drive doesn’t need to be encrypted again, so it takes a moment.

Will suspending BitLocker delete my files?

No. Suspending, resuming and even turning BitLocker off don’t delete files. Turning it off decrypts the drive, which takes much longer than suspending.

Why does BitLocker suspend itself after updates?

Updates that change boot or firmware components would otherwise trigger the recovery screen on the next start. Windows suspends protection for that restart and resumes it automatically afterwards.