New warning for Windows users.

NurPhoto via Getty Images

Barely 48 hours after Microsoft’s new security update went live, we had warnings that its first serious issue was causing havoc for some users. Microsoft has now confirmed that PCs set up in a specific way will lock-up after the update. Either do not update until you change your settings, or have your recovery key ready.

April’s bumper Windows update fixed more than 160 vulnerabilities, of which eight are critical and one is now under active attack. The update also changed Windows after 15 years for most users. Secure Boot certificates first issued in 2011 now expire in June. The latest update brings both new certificates and a status checker.

Forbes‘Starting In April’—Microsoft Changes Windows Update After 15 Years

But Microsoft now warns that critical though this update is, “some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update.”

That means checking your settings before installing the update — unless it’s already too late. “This issue only affects a limited number of systems in which ALL of the following conditions are true. These conditions are unlikely to be found on personal devices not managed by IT departments.”

Here are those conditions:

1. "BitLocker is enabled on the OS drive.
2. The Group Policy ‘Configure TPM platform validation profile for native UEFI firmware configurations’ is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually).
3. System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as 'Not Possible’.
4. The Windows UEFI CA 2023 certificate is present in the device’s Secure Boot Signature Database (DB), making the device eligible for the 2023‑signed Windows Boot Manager to be made the default.
5. The device is not already running the 2023-signed Windows Boot Manager."

And here is the workaround:

1. "Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console.
2. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
3. Set ‘Configure TPM platform validation profile for native UEFI firmware configurations’ to ‘Not Configured’.
4. Run the following command on affected devices to propagate the policy change: gpupdate /force
5. Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C:
6. Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C:
7. ​​​​​​​This updates the BitLocker bindings to use the Windows-selected default PCR profile."

ForbesWhy You Should Stop Google’s Hidden Tracking On Your iPhoneBy Zak Doffman

Microsoft says “a permanent resolution for this issue is planned in a future Windows update,” which means the first inevitable emergency update is now being prepped and will likely turn up with a small number of days.

“While initially Microsoft did not report any known issues,” Neowin says “the company has now added that all systems which have received the updates are affected by the BitLocker-related issue. This means Windows 11, Windows 10, as well as Windows Server 2025 and Server 2022, are all hit by this.”