BitLocker is probably on, and it may be blocking your next update
Windows 11 can enable BitLocker device encryption automatically during a fresh installation on supported hardware. That means a lot of business machines are encrypted right now without anyone deliberately turning it on. Most of the time that’s fine. The problem shows up when you try to upgrade Windows, push a firmware update, or install certain non-Microsoft applications, and the process fails or stalls.
The fix isn’t to permanently turn off encryption. For most businesses, that would be the wrong call. The right move is usually to suspend BitLocker, finish the update, and let encryption resume on its own. This article explains the difference, the actual steps, and when permanent removal makes sense.
Suspend vs. disable: they are not the same thing
Suspending BitLocker temporarily pauses encryption protection. The drive is still encrypted, but the protection is inactive while you complete a specific task. Once you’re done, you resume it. Disabling BitLocker permanently decrypts the entire drive. That process can take anywhere from a few minutes to several hours depending on drive size and speed, and once it’s done, the data sits unprotected unless you manually re-enable encryption later.
For routine Windows feature updates, firmware upgrades, or BIOS changes, suspension is almost always the right tool. Permanent disablement makes sense in narrower situations, like decommissioning a device or setting up a dual-boot configuration where encryption creates real compatibility problems.
How to actually do it
The Pureinfotech guide on disabling and suspending BitLocker on Windows 11 covers three methods in detail. For most business users, the two most practical options are Control Panel and PowerShell.
To suspend BitLocker temporarily through Control Panel, go to System and Security, open BitLocker Drive Encryption, and click Suspend protection under the operating system drive. Click Yes, do your update or firmware install, then go back and click Resume protection.
If you’re managing machines remotely or prefer scripting, PowerShell works cleanly. Run this as administrator:
- Suspend: Suspend-BitLocker -MountPoint “C:” -RebootCount 0
- Resume: Resume-BitLocker -MountPoint “C:”
The -RebootCount 0 flag means BitLocker stays suspended until you manually resume it. You can set it up to 15 reboots if you need it to stay off through a multi-stage update process.
For permanent removal on Windows 11 Pro, the Settings app path is Privacy and Security, then Device Encryption, then toggle it off. On Windows 11 Home, Device Encryption is a lighter version of BitLocker and is also controlled from Settings. The full Control Panel BitLocker management options require Pro, Enterprise, or Education.
What this means if you’re managing a fleet
If you’re running Intune or Windows Update for Business across multiple machines, you should have a policy that handles BitLocker suspension before major updates. Doing this manually on 20 or 30 machines is tedious and easy to miss. It’s also worth knowing that once you permanently disable BitLocker, it does not turn back on automatically. Someone has to re-enable it intentionally.
For laptops and any device that leaves the office, leaving encryption off is a real risk. If the device is lost or stolen, the data is fully accessible. This matters for compliance reasons too, especially if you handle any client data, financial records, or health information. Keeping encryption on and managing it properly is much better than turning it off to avoid friction.
Patch management and encryption policy go together. If your team is already thinking about update reliability, our breakdown of the August 2026 Patch Tuesday fixes for Windows 11 is worth reading alongside this. And if firmware updates are part of the picture, the Windows Secure Boot certificate situation is something to have on your radar.
Get the suspension and resumption steps documented somewhere your team can find them. That alone will prevent a lot of unnecessary support tickets. If you want someone to handle this at the policy level across your whole environment, booking an IT assessment with Exine is a reasonable starting point.
FAQ
Will I lose data if I disable BitLocker on Windows 11?
No. Disabling BitLocker decrypts the drive but leaves your files completely intact. The decryption runs in the background while you continue using the computer. The only thing that changes is that the drive is no longer encrypted after the process finishes.
Does BitLocker turn itself back on after I disable it?
No. Once you fully disable BitLocker and the drive decrypts, it stays off until someone manually re-enables it. Suspending BitLocker is different since that is a temporary pause and protection can be resumed manually at any time.
Can I suspend BitLocker on Windows 11 Home?
Windows 11 Home uses Device Encryption, a lighter version of BitLocker. You can turn it off from Settings under Privacy and Security. The full suspend and resume controls available in Control Panel require Windows 11 Pro, Enterprise, or Education.
How long does it take to decrypt a drive when disabling BitLocker?
It depends on drive size and speed. Smaller, faster SSDs may finish in minutes. Larger or slower drives can take several hours. You can keep using the computer while decryption runs in the background, so it doesn’t have to be a disruptive process.
