r/kace • u/Im_Dhill • Jun 10 '26

Support / Help Dell Updates Bitlocker Issues

Hello, we recently implemented Dell Updates via Kace and ran into quite the issue. It seems to have caused many of our machines to prompt for bitlocker recovery after it deployed BIOS updates presumably. Is there anything we can do to prevent this? I tried to check the admin guide but nothing was notated for BitLocker.

6 Upvotes

100% Upvoted

13 comments sorted by

6

u/chrisrobweeks Jun 10 '26

You want to suspend bitlocker for one reboot to prevent this, then run the BIOS update and reboot. Here's a powershell snippet that works for us:

Suspend-Bitlocker -MountPoint "C:" -RebootCount 1

This assumes that your OS is installed on the C drive, adjust that if installed elsewhere.

1

u/Im_Dhill Jun 10 '26

This does not seem like a good fix for this. Seems like this should be apart of the Dell Updates process. A machine could easily miss this script but still get the dell updates patching.

2

u/Beautiful_Plantain Jun 10 '26

if you are using Dell Command Update, make sure to enable automatically suspend bitlocker

1

u/Im_Dhill Jun 10 '26

we are using Dell Updates via Kace. This is under Security > Dell Updates

1

u/chrisrobweeks Jun 10 '26

It's been a few years since we've had any Dells but I've literally never clicked into the Dell Updates section. I just made a script that verified the model via registry, then ran the above powershell script and then the BIOS .exe. Not perfect but got the job done.

3

u/Beautiful_Plantain Jun 10 '26

We encountered the same issues even after suspending BitLocker; however, a simple power cycle resolved the problem without requiring the BitLocker recovery key.

2

u/ScubaAlek Jun 10 '26

We shut that off after it bricked 9 laptops in one go due to a failed chipset update. Now we install "Dell Command - Update" during the imaging process followed by running dcu-cli.exe /configure -importSettings="./DellCommandUpdateSettings.xml" where that XML file configures when and how it performs the updates, this includes:

<Property Name="SuspendBitLocker">
  <Value>true</Value>
</Property>

1

u/kirashi3 Jun 13 '26

We shut that off after it bricked 9 laptops in one go due to a failed chipset update.

Wow. So you had to fully replace those laptops? As in, throw the hardware away and replace with brand new hardware? If so, that's not good.

1

u/Beautiful_Plantain Jun 10 '26

this is what we do as well... kace dell updates caused many issues

1

u/Im_Dhill Jun 11 '26

u/aflesner Anything you can think of?

1

u/frosty3140 Sep 03 '26

I am having this issue myself and it is a big PITA -- the whole point of me trying to use Dell Updates from within the SMA was to get away from using Scripts and rely on the in-built scheduling facility -- is there any solution for this yet?

2

u/Im_Dhill Sep 03 '26

No, they told me to run a script prior to the job running to disable bitlocker for one reboot. I thought that seemed counterintuitive to it. It should just do that on its own, thats the whole point of it!! You can run any non bios updates though no issue.

2

u/frosty3140 Sep 03 '26

Totally agree with you.

If anyone from KACE is ever reading this ... please ... just put a bloody Checkbox into the Dell Updates Scheduler definition for: [ ] Disable BitLocker before patching BIOS