Windows 10: Bitlocker Suspended - Wizard Initiation has failed when Attempting to Resume

Team,Bit locker Suspended - Wizard Initiation has failed when attempting to resume after Windows 11 24H2 Upgrade from 23H2. Please find the attached screenshot for reference

:)

 

Bitlocker Suspended - Wizard Initiation Fails when Attempting to Resume

I have Windows 10 Pro and have Bitlocker activated on my computer for many months. I have (3) drives (C, D E) that were all encrypted with Bitlocker. C is the main Windows installation and boot drive. Recently, I received a prompt that showed that Bitlocker
encryption was suspended on C. The other drives remain encrypted.

When I attempt to resume encryption, the following error is generated:

Bitlocker Drive Encryption Error

Wizard Initiation has failed.

The system cannot find the file specified.

Two questions:

1. How do I go about reenabling encryption for C?

2. Why was Bitlocker disabled?

 

Bitlocker Suspended - Wizard Initiation Fails when Attempting to Resume

David,

Encryption is enabled and his been enabled on the device. This is a new error that recently popped up. Under the Bitlocker Drive Encryption menu, C drive shows "Bitlocker Suspended". When I attempt to Resume Protection, the error noted in my original post
occurs.

 

Bitlocker Suspended - Wizard Initiation Fails when Attempting to Resume

This behavior can occur in the following situation:

• BitLocker is enabled and configured to use platform configuration register (PCR) values other than the default values of PCR 7 and PCR 11, for example:

• Safe boot is disabled.

• The PCR values have been explicitly defined, as per group policy.

• A firmware update is installed that updates the firmware of the TPM device or changes the signature of the system firmware. For example, the dTPM surface update (IFX) is installed.

Note: You can check the PCR values that are in use on a device by running the following command from a command prompt with elevated privileges:

manage-bde.exe -protectors -get <OSDriveLetter>:

Note: PCR 7 is a requirement for devices that support the connected standby mode (also known as InstantGO or Always On, always connected equipment), including Surface devices. On these systems, if TPM with PCR 7 and secure boot are configured correctly, BitLocker
binds to PCR 7 and PCR 11 by default.

Method 1: Suspend BitLocker during TPM or UEFI firmware updates:

You can avoid this scenario by installing updates on system firmware or TPM firmware by temporarily suspending BitLocker, before applying updates to TPM or UEFI firmware using Suspend-BitLocker.

Note: TPM and UEFI firmware updates may require several restarts during installation. Therefore, the BitLocker suspension must be performed using the Suspend-BitLocker cmdlet and the Reset Account parameter to specify a number of reboots greater than 2 to keep
BitLocker suspended during the firmware update process. A reset counter 0 will suspend BitLocker indefinitely, until BitLocker resumes through the PowerShell Resume-BitLocker cmdlet or other mechanism.

To suspend BitLocker for installing TPM or UEFI firmware updates:

Open an administrative PowerShell session.

Type the following cmdlet and press Enter.

Suspend-BitLocker -MountPoint "C:" -RebootCount 0

where C: is the drive assigned to the disk.

Install the Surface device driver and firmware updates.

After the correct installation of the firmware updates, resume BitLocker using the Resume-BitLocker cmdlet as follows:

Resume-BitLocker -MountPoint "C:"

Method 2: Enable Safe Boot and Restore PCR Defaults:

It is strongly recommended to restore the default and recommended settings of the secure boot and PCR settings after suspending BitLocker to avoid introducing BitLocker recovery when applying future updates to TPM or UEFI firmware.

To enable Safe Boot on a Surface device that has BitLocker enabled:

Select the Security tab.

Click Change settings in "Safe Boot."

Select Microsoft Only and click OK.

Select Exit and then Restart to restart the device.

Restart BitLocker with the Resume-BitLocker cmdlet as described in method 1.

To change the PCR values used to validate BitLocker Drive Encryption:

Disable all group policies that configure PCR or remove the device from all groups in which those policies are applied. See "Deployment options" in the BitLocker Group Policy Reference for more information.

Suspend BitLocker with the Suspend-BitLocker cmdlet as described in method 1.

Restart BitLocker with the Resume-BitLocker cmdlet as described in method 1.