Persistent BitLocker Recovery Key Prompts After BIOS Update

[Li1987]

We recently updated the BIOS on several HP EliteBook laptops following HP's guidance. As part of the process we suspended BitLocker before the update and resumed it afterward. The update also involved setting the UEFI CA 2023 registry key as per HP's recommendation.

Following the BIOS update, affected devices are repeatedly prompting users for a BitLocker recovery key at boot. This is not a one-time occurrence One device has been challenged 3 times within one week. Each time the user enters the recovery key, Microsoft Intune automatically rotates and escrows a new key as expected, however the prompts keep returning.

https://support.hp.com/us-en/document/ish_3894564-1633733-16

https://support.hp.com/us-en/document/ish_13070353-13070429-16

[JulianBlu]

After receiving BIOS Update U70 Ver. 01.18.00 - 02/04/2026 on my HP Elite x360 1040 G9 via Windows Update I'm getting BitLocker Recovery Key Prompt at every single resume from hibernation.
Resetting TPM did nothing.

[JulianBlu]

Gone to  HP support page: BIOS U70 Ver. 01.18.00 is not offered, it's probably been retired because of this issue.
Downloaded 01.17 and downgraded my EliteBook.
Re-enabled BitLocker, did a few restart/shutdown/hibernations and so far so good.

[nicos18]

@JulianBlu: about the BIOS update not offered on the HP support website I can say that, in some cases, the BIOS update is released on Windows Update 14 days before it shows up on the HP website.

In my case, it's happened back in December and now; my latest BIOS update appeared on Windows Update last Tuesday so, if the timing is correct, the BIOS should appear on HP website on May the 5th.

I don't know why they do that as it could be more logical to put the BIOS update first on the official website then on Windows Update.

And I also want to add that, in this case, the HP PC Hardware Diagnostics for Windows finds the BIOS update (in Windows Update), while HP Support Assistant does not.

[Christoph_vW · Accepted solution]

We had the BitLocker Recovery Key issue after updating 830 G9 Notebooks to BIOS 1.18 as well. All Notebooks had the UEFI 2023 CA Certificates and the UEFI 2023 Bootloader already.

To resolve this we had to disable the "Enable MS UEFI CA key" setting in BIOS settings.

"The Enable MS UEFI CA Key setting manages the third-party Microsoft UEFI CA 2011 certificate. To find this setting, access f10 BIOS setup menu."