WUFB & Bitlocker

[lalanc01]

Hi, I wanted to know how WUFB manages bitlocker encrypted devices?

In SCCM, when we update/reboot an encrypted device, bitlocker is suspense automatically until the update process is finished, so there's no Pin prompt.

Is there the same mechanisim in WUFB?

Thks in advance.

[#2]

Hi @lalanc01,

BitLocker is suspended automatically for feature updates (starting in Win 10 1803) but not for quality updates.

[#3]

@Jason_Sandys so what is the recommendations for encrypted devices that are updates with WUFB for quality updates so that the device is not waiting for the pin?

This is mainly for on-prem devices that are accessed via RDP/Citrix from home users because of covid.

[#4]

@lalanc01 There's not really a generic recommendation here. For on-prem devices, one possibility is to use network unlock. Disabling BitLocker automatically for a quality update every month though is a security risk as it leaves the device potentially exposed to anyone in physical possession of it.

[#5]

@Jason_Sandys    I have several surface devices that are bitlockered and I never pause bitlocker for quality updates.  Granted there has been times they've freaked out on me and needed the bitlocker recovery key because of a freak out during windows update, but that's the exception not the norm.

https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-upgradi...