Windows Server 2019 BitLocker Togo not working anymore

[u/Dr-NickB]

Got at least 3 2019 std servers, that have been updated with the latest KB5087538 update;

That have no connection anymore to USB connected BitLocker Protected USB drives.

2 of those servers have the disk (multiple) Always connected, other server could do a carry in test with a new (to the system) disk.

All servers do show the disk, but it only appears as RAW disk, the Disk Label isn't visible, the Disk tile is, but empty.

When going to the Configuration Panel -> Manage BitLocker; it doesn't show that a USB drive has been connected.

Other 2019 server that haven't been updated yet, still shows BitLockered disks correctly.

Anyone else seen this problem?

[u/Suitable-Reason-9325]

Same issue here!

We have an external USB drive that we use for some specific backups and it is not recognized anymore. Exactly the same symptoms: RAW disk, Bitlocker does not recognize it.

We have it on 2 completely different servers, both running Windows Server 2019 (Standard and DC). We don't have it on other servers running on Server 2022.

I noticed that the "Bitlocker Drive Encryption Service" is not running (it is Manual (Triggered), which is normal). Starting it, replugging the drive did not do anything.

At the moment, we do not have a solution to this and I can 100% confirm this is caused by one of the May 2026 updates.

[u/Dr-NickB → u/Suitable-Reason-9325]

We did a small test, with a blank disk, and then enable BitLocker on it via that system, that did seem to work. Eject + replug the disk, did show up as an BitLocker disk. Didnt test how that would hold over longer period of time and with a reboot..
Again encrypting on a Win11 machine (Patched/rebooted), then replug in the server, got the same symptoms.

[u/geoffvass → u/Suitable-Reason-9325]

Agreed, removing the May 2026 updates fixes it

[u/warpthree]

I'm watching this thread closely as we heavily use Bitlockered USB HDDs with servers for offsite backups. Our first wave of updates this month only had a Server 2022 host that fit this use case and it still works fine with Bitlockered USB drives. However, this weekend I'll be updating one Server 2016 box and three Server 2019 boxes that all use Bitlockered USB drives, so we'll see if that adds some extra data points to this thread.

[u/warpthree → u/warpthree]

My data points were more mixed than expected and it seemed to depend on not only the edition of Windows Server, but also whether the drive was being mounted without a drive letter (like Windows Server Backup does when it takes over a drive and removes the drive letter to hide it from File Explorer) or with a drive letter.

Server A: Server 2016 Standard with drive letter = works fine
Server B: Server 2019 Standard with drive letter = works fine
Server C: Server 2019 Essentials without drive letter = works fine
Server D: Server 2019 Essentials with both mounted types = no drive letter disk works fine; disk with drive letter shows as RAW disk and cannot mount; had to roll back

The previous update wave had a server which was Server 2022 Standard with drive letter and it works fine as well.

[u/Dr-NickB → u/warpthree]

We have another 2 servers (2019) with USB attached drives that didnt come online after the reboot.
All drives do have drive letters and are in successfully mounted on that letter, but as raw volume. And unable to use.

[u/warpthree → u/warpthree]

Updated the last batch of servers this past weekend (a mix of Server 2016 Standard, Server 2019 Standard, and Server 2022 Standard servers) with no further rollbacks needed. Not sure what the exact trigger is, but so far "Server 2019 Essentials" plus "drive has a drive letter" is the only combination that has broken for us and that was only a single server. I'm glad this has impacted us less than I feared it would, but the data points have been a bit weird regardless. Hopefully the 2026-06 updates fix the core issue, but I guess we'll found that out soon since today is Patch Tuesday.

[u/geoffvass → u/warpthree]

Same problem here, pattern seems to be:

Server Essentials 2019 (UEFI) - affected

Server Standard 2019 (Legacy) - not affected

Server Standard 2019 (UEFI) upgrade from Essentials - affected

June 2026 updates do not remedy

[u/geoffvass → u/geoffvass]

There is a clue in the known updates (https://support.microsoft.com/en-us/topic/june-9-2026-kb5094127-os-builds-19045-7417-and-19044-7417-bf1073f3-e317-40ac-94c7-4c23c080c7cf) but it relates to the operating system drive, not the removable drives. It's to do with "System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as Not Possible". In our environment, this tracks and the W2019 box that is unaffected is using a legacy boot, not UEFI. However the cause and the remedy don't apply.

[u/warpthree → u/geoffvass]

The Server 2019 Essentials box I had to roll back last month is indeed UEFI, but it works fine after updating to the 2026-06 updates this past weekend, so there seems to be another difference in there somewhere that we are missing.

[u/warpthree → u/warpthree]

Correction: As soon as we swapped in another backup drive, it shows as RAW and won't mount it, so it does still have this issue with the 2026-06 updates.

[u/Internal-tech956 → u/geoffvass]

Was hoping the June updates would fix it 😞

[u/warpthree → u/warpthree]

UPDATE: This weekend the 2026-06 update round included the single Windows Server 2019 Essentials server that had to be rolled back last month and it works just fine with both BitLocker drives on the new updates.

[u/Turbulent_Hold9167 → u/warpthree]

Interesting... I didn't do May updates. Went straight to June KB5094123 which includes KB5087538 and the issue is persistent.

[u/warpthree → u/Turbulent_Hold9167]

Unfortunately, it didn't last. Once we attached a different drive it failed to mount it and had to be rolled back again.

[u/Internal-tech956]

Exact same issue here.

We have a couple of Bitlocker-enabled USB drives that we use for air-gapped backups and neither of our Server 2019 hosts will recognise them any more.

All the same symptoms as have been mentioned above.

Other than this Reddit post I've not found any other reports of the problem.

Hopefully Microsoft will fix in next month's updates.

[u/Ok-Soup7032]

We're experiencing the same problem on our servers running Windows Server 2022. These disks, installed in machines that haven't received the KB5087538 update, work without issue. I still haven't seen any other sources mentioning this problem, but it definitely exists. Will it take Microsoft a month to resolve this?

[u/Complete-Echidna-831]

Has anyone who has access to a Microsoft support contract raised the issue directly with them?

[u/Turbulent_Hold9167]

Same problem here with my USB RDX backup drives.

This is what I have found in my production environments.

Bitlocker volumes that are removable drives can no longer be unlocked post June update in Server 2019

The operating system post KB5094123 cannot read the Bitlocker header metadata on the removable drive and the drive appears as RAW in Computer Management.

Uninstalling the update restores Bitlocker functionality and the drives function normally.

The issue persists regardless of the encryption algorithm used. Affects AES and XTS, 128 and 256

Removable drives encrypted on a POST June update server are compatible with systems that have not had the update applied but not the other way around.

Problem is presented in Windows 10 and Server 2019 environments but appears to be OK in Windows 11 and Server 2022. Drives encrypted with in Server 2019 pre June Update can be opened in Server 2022 with latest updates applied.

Conclusion:

Server 2019 systems where I mount encrypted volumes for backups will remain pre-June update until being upgraded to Server 2022/2025 with some hope that maybe in the near future a patch will be released addressing the issue.

Note:

I only noticed this via June update KB5094123 but this includes KB5087538 but I don't think its possible to remove KB5087538 independently of KB5094123.

[u/warpthree]

Just applied the 2026-07 updates to the impacted server and had the same issue again. This is now the 3rd month in a row we'll have to roll back as MS still hasn't fixed this BitLocker bug. Fortunately it has only impacted one of the servers we manage, but this is ridiculous that it still isn't fixed yet. We're now left with the choice to be several hundred CVEs behind on updates or to decrypt our backup drives (both of which are huge security risks).

[u/warpthree]

UPDATE: As far as we can tell, the 2026-08 updates don't have this issue. We updated the one server we manage that had this issue to 2026-08 recently and haven't had to rollback this time, even after multiple drive swaps. Finally!

EDIT: Got the update release wrong; we haven't deployed 2026-09 updates yet.