Known issues with Microsoft update KB4535680
Some original equipment manufacturer (OEM) firmware might not allow for the installation of this update (KB4535680)
If BitLocker Group Policy Configure TPM platform validation profile for native UEFI firmware configurations is enabled and PCR7 is selected by policy, it may result in the BitLocker recovery key being required on some devices where PCR7 binding is not possible.
To view the PCR7 binding status, run the Microsoft System Information (Msinfo32.exe) tool with administrative permissions.
Important Changing from the default platform validation profile affects the security and manageability of your device. BitLocker’s sensitivity to platform modifications (malicious or authorized) is increased or decreased, depending on inclusion or exclusion (respectively) of the PCRs. Specifically, setting this policy with PCR7 omitted, will override the Allow Secure Boot for integrity validation Group Policy. This prevents BitLocker from using Secure Boot for platform or Boot Configuration Data (BCD) integrity validation. Setting this policy may result in BitLocker recovery when the firmware is updated. If you set this policy to include PCR0, you must suspend BitLocker before you apply firmware updates.
We recommend not to configure this policy, but to let Windows select the PCR profile for the best combination of security and usability based on the available hardware on each device.
Workaround
To workaround this issue, do one of the following based on credential guard configuration before you deploy this update:
On a device that does not have Credential Gard enabled, run following command from an Administrator command prompt to suspend BitLocker for 1 reboot cycle:
Manage-bde –Protectors –Disable C: -RebootCount 1
Then, restart the device to resume the BitLocker protection.
Note Do not enable BitLocker protection without additionally restarting the device as it would result in BitLocker recovery.
On a device that has Credential Guard enabled, there may be multiple restarts during the update that require BitLocker to be suspended. Run the following command from an Administrator command prompt to suspend BitLocker for 3 restart cycles. Manage-bde –Protectors –Disable C: -RebootCount 3
This update is expected to restart the system two times. Restart the device once again to resume the BitLocker protection.
Note Do not enable BitLocker protection without additionally restarting as it would result in BitLocker recovery.
Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.