The update finished perfectly - and now the PC is asking for a 48-digit recovery key you have never seen. Nothing is broken and no data is lost, but without that key the drive stays locked. This page makes sure you meet that screen prepared, or never meet it at all.
BitLocker seals its drive key to measurements of the boot chain that the TPM chip takes every start - firmware included. Change the firmware and the measurements change, so the TPM refuses to release the key silently and Windows asks a human for the recovery key instead. That is the protection working exactly as designed. The failure is never the screen; the failure is not having saved the key before the update. Many modern laptops are encrypted by default (shown as device encryption), so 'I never turned BitLocker on' proves nothing - check.
manage-bde -status C:aka.ms/myrecoverykey on your phone and sign inmanage-bde -protectors -get C: -type RecoveryPassword and note the 48-digit password shownSuspending tells Windows to keep the drive key available in the clear for the next boots, so the firmware change passes without a key prompt. It does not decrypt anything and it switches itself back on - it is a pause built for exactly this job.
manage-bde -protectors -disable C:manage-bde -protectors -disable C: -RebootCount 2manage-bde -status C: that protection shows as suspended, then do the updatemanage-bde -protectors -enable C: if it has not resumed by itselfStay calm and read the screen - your data is intact and the PC is waiting, not broken. Find the key whose Key ID matches the ID on screen (the Microsoft account page lists them by ID), type the 48 digits, and Windows starts. Then save the key somewhere sensible for next time. The honest hard truth: if the key was never saved anywhere and the account does not hold it, there is no legitimate way through - the encryption is designed so that nobody, including support, can bypass it. That is precisely why this page exists and why the key comes before the flash, every time.
The video covers the full update with the BitLocker preparation in place, step-by-step.
Watch Full VideoNo. If protection is suspended beforehand, the update passes silently. Even without suspending, some updates keep the measurements the TPM expects and no prompt appears. But 'usually fine' is not a plan - the prompt appears exactly when the boot chain changed, which is what an update is. Prepare as if it will ask, every time.
No. Suspending leaves all data encrypted; it only stores the drive key in a way the next boots can use without TPM measurements, for a limited number of restarts or until you resume it. Decryption would mean rewriting the whole drive unencrypted, which is slow, unnecessary and not what any of these commands do.
Your IT team almost certainly holds the key centrally, and on managed machines firmware updates are normally their job in the first place. The right move is to ask them before updating - they may push the update themselves with protection handled. What you should not do is flash a work laptop privately and meet the recovery screen alone.