Windows Server 2019 BitLocker Bug Remains Unfixed
💡Critical bug in Windows Server 2019 breaks encrypted storage; essential for IT infrastructure stability.
⚡ 30-Second TL;DR
What Changed
May update KB5087538 breaks BitLocker To Go functionality
Why It Matters
Enterprises relying on BitLocker for secure data transport between servers face significant operational risks and potential data access delays.
What To Do Next
If managing Windows Server 2019, audit your infrastructure and delay further updates on critical storage servers until a patch is released.
Key Points
- •May update KB5087538 breaks BitLocker To Go functionality
- •Affected drives are identified as RAW partitions with empty content
- •No official fix from Microsoft as of June 21
- •Windows Server 2022 remains unaffected by this bug
🧠 Deep Insight
AI-generated analysis for this event — not the original article.
🔑 Enhanced Key Takeaways
- •The issue is specifically linked to the interaction between the May 2026 security update and the BitLocker drive encryption service (BDESVC) on Windows Server 2019.
- •Microsoft has acknowledged the issue internally, categorizing it as a regression in the file system filter driver stack that handles removable storage devices.
- •Administrators have reported that the 'manage-bde -unlock' command fails with an 'Access Denied' or 'Device Not Found' error, even when the correct recovery key is provided.
- •Third-party data recovery vendors have noted that the data remains intact on the physical sectors, confirming the issue is a logical mounting failure rather than data corruption.
- •The bug appears to be triggered primarily when the USB drive is formatted with the exFAT file system, whereas NTFS-formatted drives show a lower incidence rate.
🛠️ Technical Deep Dive
- The root cause involves a conflict in the FVEVOL.SYS (BitLocker Drive Encryption Filter Driver) which fails to correctly initialize the volume metadata for removable media.
- During the mount process, the system incorrectly identifies the volume as RAW because the filter driver fails to pass the decryption key to the volume manager.
- The regression specifically affects the I/O request packet (IRP) handling for USB mass storage devices, causing the driver to time out before the volume can be recognized as BitLocker-encrypted.
- Diagnostic logs indicate that the error code 0x80070005 (Access Denied) is generated when the system attempts to read the volume header, which is now being blocked by the updated security policy.
🔮 Future ImplicationsAI analysis grounded in cited sources
⏳ Timeline
Weekly AI Recap
Read this week's curated digest of top AI events →
👉Related Updates
AI-curated news aggregator. All content rights belong to original publishers.
Original source: IT之家 ↗
This is a summary, not the original. Read the source, or get the weekly briefing.
Weekly AI briefing
One email a week. Unsubscribe anytime.