After installing KB4494440 and restarting, some devices running Windows Server 2016 with Hyper-V enabled may enter Bitlocker recovery mode and receive an error, "0xC0210000".
Note Windows 10, version 1607 may also be affected when Bitlocker and Hyper-V are enabled.
If your device is already in this state, you can successfully start Windows after suspending Bitlocker from the Windows Recovery Environment (WinRE) using the following steps:
- Retrieve the 48 digit Bitlocker recovery password for the OS volume from your organization's portal or from wherever the key was stored when Bitlocker was first enabled.
- From the recovery screen, press the enter key and enter the recovery password when prompted.
- If your device starts in the Windows Recovery Environment and asks for recovery key again, select Skip the drive to continue to WinRE.
- Select Advanced options then Troubleshoot then Advanced options then Command Prompt.
- Unlock OS drive using the command: Manage-bde -unlock c: -rp <48 digit numerical recovery password separated by “-“ in 6 digit group>
- Suspend Bitlocker using the command: Manage-bde -protectors -disable c:
- Exit the command window using the command: exit
- select Continue from recovery environment.
- The device should now start Windows.
- Once started, launch an Administrator Command Prompt and resume the Bitlocker to ensure the system remains protected, using the command: Manage-bde -protectors -enable c:
Note The workaround needs to be followed on every system restart unless Bitlocker is suspended before restarting.
To prevent this issue, execute the following command to temporarily suspend Bitlocker just before restarting the system: Manage-bde -protectors -disable c: -rc 1
Note This command will suspend Bitlocker for 1 restart of the device (-rc 1 option only works inside OS and does not work from recovery environment).
Next steps: Microsoft is presently investigating this issue and will provide an update when available.
Microsoft is presently investigating this issue and will provide an update when available.