When rebooting a windows machine after patching check if the machine has a bitlocker encrypted boot drive and disable bitlocker encryption.

Optional (and maybe harder, so maybe don't bother):
Have an option to set -RebootCount (for how many reboots bitlocker should be disabled) or set it to >1 as some updates reboot multiple times and check after reboot if patching is done and re-enable bitlocker.

Alternatively:
Have an option to start a script at the beginning of the patch process so we can do is ourselves with Powershell's Suspend-BitLocker cmdlet.