Unable to resume Bitlocker after applying Cumulative November Update of Windows 10 1909

[SwissSam]

Hi all,

I'm currently preparing the rollout of Windows 10 1909 for our clients and ran into an issue with the HP EliteBook G1 desktop. When I load the initial W10 1909 build from October 2019, Bitlocker can encrypt the disk and everything works fine. After applying the November 2019 upgrade (or newer, doesn't matter) Bitlocker is unable to resume protection. When I try to resume Bitlocker, I get "An internal error has occurred within the Trusted Platform Module support program".

I've applied the latest BIOS and also the latest available TPM Firmware (TPM 1.2). I also cleared the TPM.

TPM Settings in the BIOS are as follows:

Tpm PPI policy changed by OS allowed
  Disable
  *Enable
Tpm measure boot variables/devices to PCR1
  *Disable
  Enable
Tpm No PPI provisioning
  Disable
  *Enable
Tpm No PPI maintenance
  *Disable
  Enable

Any hint what I'm doing wrong?

[SwissSam · Accepted solution]

Ok, found the cause of the issue. Reading [edit]guided me to the solution. Looks like this behavior is a side effect when System Guard Secure Launch is set in the domain via Policy. I have now disable Secure Launch and restaged the device and... voilà, Bitlocker is working again with 1909 and latest cumulative updates.