Last night a Windows update broke my Bitlocker

My leading theory is that a Windows update or WinRE servicing operation disabled Windows Recovery Environment and failed to re-enable it properly.

The issue

After every reboot, Windows prompted me to enter the BitLocker recovery key. This happened regardless of whether I shut down the PC and powered it back on or simply selected “Restart” from Windows.

My first suspicion

My first suspicion was that a Windows installation on the second SSD was modifying the shared boot configuration on the SSD #1, which caused BitLocker in Windows #1 to detect a change in the boot environment and request the recovery key.

I suspected this because I had manually registered Windows #2 in the boot menu on SSD, instead of using its original boot menu on SSD2.

But when I tried to use only Windows #1, the issue was still present, which proved that Windows #2 wasn’t the cause.

Solution

First of all, I figured out the partition number of the recovery partition. In my case it was the partition number 6.

Then I mounted it to the drive R:

Set-Partition -DiskNumber 0 -PartitionNumber 6 -NewDriveLetter R

then I verified that WinRe image exists on disk R:

Test-Path 'R:\Recovery\WindowsRE\winre.wim'

it returned true.

Get Roman’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Then I registered it:

reagentc /setreimage /path R:\Recovery\WindowsRE

and enabled WinRe:

reagentc /enable

Checking the result

When I run:

reagentc /info

I see:

Windows RE status: Enabled

I hope it’s needless to say that I execute all the commands in PowerShell opened with admin privileges.

Removal of the temporary drive letter

To unmount drive R I executed:

Remove-PartitionAccessPath -DiskNumber 0 -PartitionNumber 6 -AccessPath 'R:\'

Re-enabling protection

I am not sure if it was necessary but I executed:

manage-bde -protectors -enable C:

and then:

manage-bde -status C:

to see: “Status: Protection On”.

Possible cause

My recovery partition and the WinRe image were all right. The missing component was a BCD entry pointing to the recovery environment. We restored that entry without reinstalling Windows, modifying the partitions, or decrypting your drive.

So, specifically “reagentc /enable” fixed the missing BCD entry.

And “reagentc /setreimage” provided the correct recovery-image location beforehand.