kb5087420

KB5087420 is a Windows 11 version 23H2 update released on May 12, 2026, raising systems to OS Build 22631.7079. The update may cause some enterprise-managed BitLocker devices to prompt for a recovery key after the first restart due to Secure Boot certificate migration. This issue arises from a collision between Windows servicing and older enterprise hardening configurations. Microsoft indicates the affected population should be limited, but the situation highlights how tightly pinned security controls can become a help-desk event when boot trust changes. The tag covers discussions around this specific update, its impact on BitLocker, and broader lessons for enterprise IT management.