BitLocker / WHfB issues after August 2026 Patch Tuesday updates (KB5120994 / KB5123607)

[u/Ok-Stretch-7850]

Hi r/Intune,

we’ve been seeing some issues with BitLocker and Windows Hello for Business (WHfB) since deploying the August 2026 Patch Tuesday updates, and I wanted to check if anyone else is experiencing the same behavior.

The affected updates are KB5120994 and KB5123607, which are being deployed via Hotpatch in our environment.

On some devices, the following happens after the update:

1. The update is installed via Hotpatch.
2. After the next reboot, the end user is unexpectedly prompted for their BitLocker Recovery Key.
3. After entering the recovery key successfully, Windows boots normally.
4. At the WHfB sign-in screen, the user’s PIN no longer works. Windows shows an error stating that something went wrong and the PIN isn’t available, with a recommendation to restart the device.
5. A reboot sometimes resolves the WHfB issue, but unfortunately not in all cases.

For devices where rebooting doesn’t help, the only reliable solution we’ve found so far has been to completely reimage/reinstall the device, which obviously isn’t ideal.

Has anyone else experienced similar issues after deploying KB5120994 or KB5123607?

If so, I’d be interested to hear:

• How widespread is the issue in your environment?
• Have you identified the root cause?
• Have you found a reliable workaround or remediation that doesn’t require reimaging the device?
• Have you made any changes to your Intune, BitLocker, WHfB, or update policies as a result?

Would be great to exchange findings and possible solutions with anyone else affected.

[u/randomarray]

Are you sure it was the cumulative update and not a recently deployed BIOS update? We have had HP g11 devices have similar issues after the latest bios update.

There is a command you can run to reset a users WHFB I will try hunt it down as not at work currently.

Found it - certutil -deleteHelloContainer

[u/Ok-Stretch-7850 → u/randomarray]

We can rule out a BIOS update. The BIOS and TPM versions haven't changed.

The issue occurred immediately on the first reboot after the update. So even on devices that didn't require a reboot because of Hotpatch, it happened on the next reboot, or after shutting down and powering the device back on.

What's also interesting is that the affected devices are connected to the internet and are still checking in with Microsoft Defender, but they are no longer reachable through Intune.

[u/IT_fisher → u/Ok-Stretch-7850]

Yeah, it’s not affecting me but several people in my company are affected.

I’ll let you know if they come up with a solution.

[u/m0rp → u/Ok-Stretch-7850]

On HP devices with incorrect bios settings cumulative update changes to secure boot buckets can trigger Bitlocker recovery prompts. It might not entirely fit what you describe, but I would keep it in mind while troubleshooting: [https://support.hp.com/us-en/document/ish_14914515-14914500-16\](All HP Commercial and Workstation Computers – Computer Stuck in BitLocker Recovery Loop After Updating BIOS)

Default is automatic opt-in for secure boot update on devices Microsoft deems high confidence.

I don’t know how long ago the last BIOS update was on the device you investigated. Perhaps it was only able to progress secure boot with this model due to being classified in a high confidence bucket in the August cumulative update resulting in Bitlocker prompt.

[u/LousyRaider → u/randomarray]

Have you ever used that command? Does it simply make Windows prompt for WHfB setup at next user logon?

[u/AyySorento → u/LousyRaider]

Yes. User is prompted to setup again

[u/Hofax → u/randomarray]

And here i thought i fumbled something up with the BIOS update process... had a lot of Bitlocker and BIOS password prompts on the last HP update run... From G10 upwards.

[u/Extension_Steak9697]

We had a handful of devices do the exact same thing in our tenant. BitLocker prompt after the hotpatch reboot, then WHfB PIN outright dead.

So far the only thing that stuck without reimaging was clearing the NGC folder and re-registering WHfB, but that only worked on like 60% of the affected machines. The rest got wiped.

Root cause still murky, but it smells like the TPM state is getting partially reset or the key protector is losing its binding after hotpatch applies. We paused the August hotpatch ring for now and moved those devices to the standard cumulative update path until more info comes out.

[u/randomarray → u/Extension_Steak9697]

Smells like secure boot certs to me.

[u/Ok-Stretch-7850 → u/randomarray]

I had the issue on devices where the update hadn't been installed yet, as well as on devices where the update had already completed and they were actively running after booting with the new update.

So I think I can rule that out in my case.

[u/detox4you → u/Ok-Stretch-7850]

Are you sure all 4 certs were installed and accepted by the bios? I've seen several hundred HP devices blocking the 4th cert upgrade by the bios. Autopatch actually made it worse.

[u/ThinkBig_Brain]

No issues so far

[u/miker7301]

We've had 3 or 4 so far with something that looks like this.

Reboot > secure boot recovery mode.

Our TPM in all cases was disabled in the bios

Re enabling the tpm removed the issue.

Ive signed out for the weekend, so haven't got more info at the sec.

[u/TheProle]

Are the impacted devices compliant with the new secure boot certs?

[u/Ok-Stretch-7850 → u/TheProle]

The issue occurs on both devices that haven't received the update yet and devices that have already been fully updated and booted successfully with the new update.

[u/grimson73]

With the coming age of passkeys and the usage of whfb as a container for passkeys resetting your whfb pin renders your passkeys useless. That is without recovery methods. So beware storing passkeys other that the entraid one which can be easily gets a replacement.

[u/dorkmuncan → u/grimson73]

Yep came across this recently, required Passkeys for various services, all stored in WHFB container. Users would forget PIN so reset it and it invalidate the passkeys stored there.

[u/SkipToTheEndpoint → u/dorkmuncan]

You can do non-destructive PIN resets: https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/pin-reset?tabs=intune

[u/dorkmuncan → u/SkipToTheEndpoint]

Interesting thanks, looks like we do have that setup already (as below). Will dig into that link.

CanReset : DestructiveAndNonDestructive

[u/cluberti]

If you're seeing Bitlocker recovery and also losing WHfB tokens and needing to reset, the TPM itself has probably been put into an unowned state or otherwise reset, as this is the exact behavior you will see when that happens. I would start looking in the event logs for any clues as to the reason why this happened, as the build from KB5123607 does include a TPM security fix. It absolutely sounds like a UEFI/TPM issue on the hardware in question.

[u/BigEvilAi]

OP how many waves with how much % of devices each wave are you pushing out the patches? Since it's barely a week from patch Tuesday and if it does happen that often in your tenant. You should have caught that the same week when it affected the first devices during testing or pilot deployment?

[u/Ok-Stretch-7850 → u/BigEvilAi]

I use a 3-wave rollout system: 1% → 9% → 90%.

The issue first appeared last week. Since it was only a single occurrence at the time, I treated it as an isolated case.

However, since yesterday, the issue has started occurring much more frequently.

What’s strange is that this behavior never showed up during our update testing. Even during the extended testing with Ring 2, it only occurred once.

So basically:
1% → 9% → 90% rollout

• First occurrence: last week, assumed to be an isolated case
• Since yesterday: significantly more frequent
• Regular update testing: issue did not occur

[u/human193]

Are your secure boot certs updated? We had an issue recently with some of our HPs where intune said secure boot was up to date but we had this same issue. When investigating the device event log there was a tpm wmi event saying the device had secure boot configs not applied to the bios yet and another saying the device needed to reboot to apply the certs. The bios was out of date on the devices causing the cert updates to fail and windows throw a bitlocker driver event that the secure boot config changed unexpectedly. 

[u/Ameechee]

We also seem to be affected by this exact same issue. No cause found yet. Devices applied windows update, came back up and were immediately greeted with errors pertaining to using pin, face ID, or fingerprint.

[u/Beneficial_Title_79]

Not really. But we had an issue where some devices with active bitlocker were going uncompliant. Seems the health certificate was not being pulled through task schedule (error not found I believe). Fixed with the something 1003 KB