Suspend BitLocker Before BIOS Update with manage-bde
Two commands, thirty seconds, zero drama. Suspending BitLocker before a BIOS or firmware update lets the PC restart through the update without ever showing the blue recovery key screen.
✍️ Technical Anshu🪟 Windows 10 / 11⏱️ 5 minute guide
🎥 Watch the full process in the video — finding the recovery key and unlocking the drive, shown live step by step
A BIOS update changes the boot measurements your TPM chip checks at startup. If BitLocker protection is active, the TPM refuses to release the drive key and you get the recovery screen — and then you are hunting for a 48 digit key at the worst possible moment. Suspending protection tells BitLocker to keep the key available in the clear for reboots until you resume it. The drive stays encrypted the whole time; only the startup check is paused. Do it in this order: suspend, update, resume.
Command Prompt as Administrator — manage-bde Status
The status view before you start. Protection Status is the line that changes to Suspended after the command in Fix 2.
1
Confirm BitLocker Is On and the Key Is Backed Up
Never suspend anything until you know the recovery key is safely stored — suspending itself is safe, but this is the one moment to verify your backup.
Open Command Prompt as administrator and run manage-bde -status C:
Confirm Protection Status reads On and a Numerical Password protector exists
Check the key exists in your Microsoft account at https://aka.ms/myrecoverykey, or print it from the same status command with manage-bde -protectors -get C:
2
Suspend Protection with manage-bde ⭐
One command pauses the protectors for the Windows drive. Unlike turning BitLocker off, nothing is decrypted and no progress bar runs for hours.
In the same administrator Command Prompt, run manage-bde -protectors -disable C:
Run manage-bde -status C: again and confirm Protection Status now reads Suspended
Prefer clicking? The same action exists in Control Panel under BitLocker Drive Encryption — Suspend protection
With the command line method, protection stays suspended across as many reboots as the update needs, until you resume it manually — exactly what a multi-restart BIOS update requires.
3
Run the BIOS or Firmware Update Now
Keep the laptop on charger power for the whole update — a power cut mid-flash is a far bigger problem than BitLocker
Run the manufacturer's BIOS update tool and let the PC restart as many times as it asks
The PC will boot straight into Windows each time, with no recovery screen
Finish any follow up firmware or driver installers the update package includes
4
Resume Protection and Verify
This is the step people forget — and a suspended drive is an unprotected drive at startup, for as long as you leave it that way.
Open Command Prompt as administrator again
Resume: manage-bde -protectors -enable C:
Verify: manage-bde -status C: — Protection Status must read On again
Restart once to confirm the PC boots normally with protection active
🔴 Suspended is not a permanent state to live in. While protection is suspended, the drive key is available without TPM checks, so anyone with the machine can boot it. Always resume protection the same day, and treat a forgotten suspended state as an open lock.
🎥 Watch the Complete Process in the Video
Finding the recovery key and unlocking a real BitLocker locked drive — complete knowledge, step by step.
No. The data stays fully encrypted. Suspending only pauses the key protectors so the TPM check is skipped at boot. Resuming restores the normal protection instantly — there is no long encryption or decryption process either way.
I already updated the BIOS without suspending and now it asks for the key. What now?
Enter the correct recovery key once to boot, then reseal the TPM from inside Windows by suspending protection, restarting once, and resuming it. Our BIOS update recovery guide on this site walks through that exact situation.
Can I suspend BitLocker from Settings instead of commands?
On Windows 11 Pro you can suspend from the BitLocker settings pages, and Control Panel offers Suspend protection on both editions with full BitLocker. Windows Home only has Device encryption, which offers a simpler on and off switch rather than suspend.
This guide is based on the Technical Anshu video linked above • Stuck on a step, ask in the video comments and the community will help you 🙏