Take Action: Out-of-band update to address BitLocker recovery prompt issue on Windows 10

Microsoft has identified a known issue affecting a small number of Windows 10 devices with Intel Trusted Execution Technology (TXT) enabled on 10th generation or later Intel vPro processors. After installing the May 13, 2025, Windows security update (KB5058379), these systems might experience unexpected termination of lsass.exe, which triggers Automatic Repair. On devices with BitLocker enabled, this results in a prompt for the BitLocker recovery key to proceed.

To address this issue, an out-of-band (OOB) update has been released today, May 19, 2025 (KB5061768). This update is available exclusively via the Microsoft Update Catalog and is cumulative—no previous updates are required before installing it. It supersedes all prior updates. The OOB update is available only for the Windows versions affected by issue: Windows 10, version 22H2, Windows 10 Enterprise LTSC 2021, and Windows 10 IoT Enterprise LTSC 2021.

Important: Consumer devices running Home and Pro editions of Windows 10 are unlikely to be affected, as they typically do not use Intel vPro processors.

If you have not yet deployed the May 2025 Windows security update (KB5058379) and your IT environment includes devices with the affected processors, we recommend applying this OOB update instead: May 19, 2025—KB5061768 (OS Builds 19044.5856 and 19045.5856) Out-of-band. If your organization is not affected by this issue, you do not need to install this OOB update.