Bitlocker for removable media issue after applying KB5087538

Question

Bitlocker for removable media issue after applying KB5087538

Ryan Tan (NCS) 20

Version: Windows 10 Enterprise 1809 LTSC, 10.17763.8755

Recent deployed KB: KB5087538 (x64)

Our solution utilizes SD Card (Removable Media) which is bitlocked

Bitlocker Version: 2.0

Encryption Method: AES 128

After the Windows update and device get restarted, the system fails to get information when executing “manage-bde -protectors E: -get” on the SD card.

Error: An error occurred while retrieving the volume’s key protectors.

While executing another command “manage-bde -status”, for the SD card volume:

Error: An error occurred (code 0x8031009b) The management information stored on the drive contained an unknown type. If you are using an old version of Windows, try accessing the drive from the latest version.

On the same device, the HDD C: & D: are also bitlocked but did not encounter the problem. TPM is turned on.

Is there any component of this new KB5087538 that could affect bitlocker or is there any workaround/fix for this issue?

moved from Windows / Windows 10 / Windows update, recovery, and backup

Nathan 0 Reputation points

2026-06-25T10:55:53.27+00:00

Hi Ryan,

You are not alone, I am investigating this issue also.

Bitlocker volumes that are removable drives can no longer be unlocked post June update in Server 2019

The operating system post KB5094123 cannot read the Bitlocker header metadata on the removable drive and the drive appears as RAW in Computer Management.

Uninstalling the update restores Bitlocker functionality and the drives function normally.

The issue persists regardless of the encryption algorithm used.

Removable drives encrypted POST June update using compatibility mode AES 128 are compatible with systems that have not had the update applied but not the other way around.

Problem is presented in Windows 10 and Server 2019 environments but appears to be OK in Windows 11 and Server 2022

Drives encrypted with Compatible Mode in Server 2019 pre June Update can be opened in Server 2022 with latest updates applied.

I would be interested if you could check your inaccessible drives in Windows 11 or Server 22 and report your findings.

Cheers

Nathan

Answer accepted by question author

Jason Nguyen Tran 24,545 Independent Advisor

Hi Ryan Tan (NCS),

Based on the error codes and behavior you described, this looks like a regression affecting removable media metadata handling rather than fixed drives. The update itself does not list BitLocker changes in its release notes, but I’ve seen similar cases where removable drives (like SD cards) fail to return protector information after certain cumulative updates.

Here are a few steps you can try:

Test the SD card on a system without KB5087538 to confirm the update is the trigger.
Check Event Viewer under Microsoft > Windows > BitLocker-API for more detailed error logs.
Run Get-BitLockerVolume in PowerShell to verify protector types and confirm if metadata is being read.
If urgent, consider temporarily uninstalling KB5087538 or accessing the SD card from a newer Windows build that recognizes the metadata.
Ensure the SD card is formatted with NTFS and has no corruption by running chkdsk /f.

If the issue persists, I recommend opening a support case. In the meantime, rolling back the update or testing on a newer build are the most reliable workarounds.

If this guidance helps you move forward, please hit “accept answer” so I know it was useful.

Jason.

0 comments

1 additional answer

Your answer

Nathan 0 Reputation points

2026-06-25T10:55:53.27+00:00

Hi Ryan,

You are not alone, I am investigating this issue also.

Bitlocker volumes that are removable drives can no longer be unlocked post June update in Server 2019

The operating system post KB5094123 cannot read the Bitlocker header metadata on the removable drive and the drive appears as RAW in Computer Management.

Uninstalling the update restores Bitlocker functionality and the drives function normally.

The issue persists regardless of the encryption algorithm used.

Removable drives encrypted POST June update using compatibility mode AES 128 are compatible with systems that have not had the update applied but not the other way around.

Problem is presented in Windows 10 and Server 2019 environments but appears to be OK in Windows 11 and Server 2022

Drives encrypted with Compatible Mode in Server 2019 pre June Update can be opened in Server 2022 with latest updates applied.

I would be interested if you could check your inaccessible drives in Windows 11 or Server 22 and report your findings.

Cheers

Nathan

Answer 1

KB5087538 is not described in the provided context, so no direct confirmation can be given that this specific update changes BitLocker behavior for removable media.

However, the context does include general BitLocker troubleshooting guidance and manage-bde usage that can be applied to this scenario:

Gather detailed BitLocker status and TPM information for the affected system to confirm the state of the SD card volume and compare it with the working C: and D: volumes:
- Open an elevated PowerShell window and run:
  - Get-Tpm > C:\TPM.txt
  - manage-bde.exe -status > C:\BDEStatus.txt
  - manage-bde.exe E: -protectors -get > C:\Protectors_E.txt
  - Get-BitLockerVolume | fl > C:\BitLockerVolumes.txt
- Review the output for the SD card volume (E:) to see whether BitLocker still recognizes it as an encrypted volume and whether any protectors are listed or reported as invalid.
Use manage-bde to check for policy- or protector-related issues:
- If manage-bde -status shows the SD card as locked or with no valid protectors, attempt to unlock it (for example, with a recovery password or key file if available) and then re-run:
  - manage-bde -protectors -get E:
- If the drive can be unlocked but protectors cannot be read, the metadata on the removable drive may be in a state that the updated BitLocker stack no longer accepts (as suggested by error 0x8031009b: “management information stored on the drive contained an unknown type”). In that case, backing up data from the SD card and re-encrypting it with the current OS build may be required.
If the issue appears only on this OS build and only for removable media, and the SD card can be accessed (after unlocking) from another, newer Windows build without errors, follow the error guidance: use a later Windows version to access and migrate data, then recreate BitLocker on the SD card from the updated environment.
If BitLocker operations on the SD card are blocked by existing BitLocker policy or protector configuration, use manage-bde to adjust protectors once the drive is accessible. For example, after unlocking and confirming status, new protectors can be added with commands such as:
- manage-bde -protectors -add E: -password
- or, if appropriate for the environment, using other protector types as documented under manage-bde protectors.

If the SD card’s BitLocker metadata is irreparably incompatible (as implied by 0x8031009b) and no recovery key or alternate OS can read it, the only remaining option is typically to reinitialize the SD card (which will erase data) and then re-enable BitLocker on it using the current Windows 10 1809 LTSC build and its BitLocker version.

References: