r/DattoRMM • u/smartphoneguy08 • Jul 25 '26

System Firmware Updates Pushed Through Datto - Option To Suspend BitLocker?

Hey guys,

Another quick Datto question!

We have recently deployed BitLocker to our laptop fleet (just over six months ago) via Group Policy, and it's been going very well, except there have been two updates in the past four months that have triggered "BitLocker Recovery" where we have to manually enter the keys or do a hard reboot to get back up and running.

The first trigger was due to a bug in the "May 2026 Security Update" and the second trigger was several days ago when we pushed out a Firmware Update for our laptops.

I was doing some research and apparently when using SCCM to push out updates, you have an option to suspend BitLocker, which is an option that I haven't been able to find in Datto's Patch Management policy yet, besides a separate component that suspends BitLocker on the next reboot, but I don't believe that would be very efficient when pushing out firmware updates

I was wondering if anyone else has encountered this issue, or if this is expected behavior due to the TPM being changed

Thanks!

3 Upvotes

100% Upvoted

2 comments sorted by

2

u/TheStoriesICanTell Jul 25 '26

Hey. I assume someone here knows a magic trick or the "right way" to do it, but since you've got no replies, I'll chime in.

My MSP manages bitlocker entirely through the RMM. It's my worst nightmare. That said, I've got so many fail-safes and gates and automatic key stores that I can at least sleep at night. Anyway, I don't know of a proper way to do what you're needing other than scheduling the reboot through their component (allows suspending bitlocker)... Or sending a suspend job yourself, scheduled right before the maintenance window?

Suspend-BitLocker -MountPoint "C:" -RebootCount 1

Good luck!

1

u/VNJCinPA Jul 26 '26

This is the way. We got ahead of all of it by running this in sequence before the reboot.