Question regarding random Decryption when using Cortex XDR

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Question regarding random Decryption when using Cortex XDR

L0 Member

Hello all,

Wanted to ask if any of you had something similar happening around.

Scenario : 

2 systems (just as an example, as they are more) - 1 of the systems gets decrypted after a system update was done (BIOS, driver updates etc.) , the other system does not get decrypted for the same updates, instead the BitLocker suspends itself and after the upgrade is done, it 'resumes' itself (which in my opinion is the correct expectation). This information I get from Event Viewer (sadly I can't see what the decryption issue is there, neither can I see it in the traps logs).

Both of the systems are using the same encryption profile from Cortex, both of the systems are using the same GPO configuration that pushes Cortex BitLocker encryption.

At first I though it might be related to no AD connectivity prior to the upgrade initiation, but this was false, I checked if Secure boot might cause it, but this was also false. Both of the systems are using UEFI.

Anybody got any idea what specs/configs I need to check/compare for those systems that decrypt and those that do not?

Thank you!


L4 Transporter

Hi @milen.slavov ,


Thanks for reaching out through LIVEcommunity! 


After reading your issues I'd highly suggest creating a support ticket and having our TAC engineers take a look into this issue.  Digging deeper into this issue to provide you with useful information is going to require you to upload some logs in order to gather more information.  A support case can be created here.


I hope you find this information helpful.

L3 Networker

Hi Milen.Slavov,


Please ensure:

Please open a support case for analysis. 


Thank you


Thank you

If you found this answer helpful, please select Accept as Solution.
  • 2 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!