Quick answer
A BitLocker recovery screen means Windows detected a change at startup — a BIOS/firmware update, a Secure Boot or boot-order change, a USB device left plugged in, or a new motherboard or SSD — and locked the drive as a precaution. Write down the first 8 characters of the Key ID, then find the matching 48-digit key in your Microsoft account (personal PCs), Microsoft Entra ID/Intune or Active Directory (company PCs). Don't reinstall Windows before you've looked: without the key the data is gone for good, and Microsoft can't recover it for you.
Contents
Why is Windows asking for a BitLocker recovery key?
Because BitLocker noticed that the startup environment changed, so it locked the drive until someone proves they own it — with the 48-digit recovery key.
BitLocker encrypts the whole Windows drive and works with the TPM chip on the motherboard. Every time the PC starts, the TPM checks that the firmware, BIOS settings and boot files are the same as before. If they match, the drive unlocks silently. If something changed, BitLocker assumes someone may be trying to get at the data and asks for the recovery key instead (Microsoft Learn).
| Common cause | What it looks like in practice | How to prevent it |
|---|---|---|
| BIOS / firmware update | Dell, HP or Lenovo update tools, or a Windows Update that includes firmware | Suspend BitLocker before every update |
| BIOS setting changed | Secure Boot toggled, boot order changed, TPM cleared | Protect the BIOS with a password |
| Booting from another device | A USB drive or dock left plugged in at startup, or network (PXE) boot | Unplug what you don't need before powering on |
| Hardware change | New motherboard, or the SSD moved to another PC | Back up the key and suspend before repairs |
| Too many wrong PINs / passwords | A company lockout policy kicks in | Review lockout thresholds |
Where is the BitLocker recovery key stored?
It depends on how the PC was set up: with a personal Microsoft account, a Microsoft 365 work account (Entra ID), or your company's Active Directory.
When BitLocker is first turned on, Windows usually backs up the key automatically. The problem is that most users have no idea where. Use this table:
| PC set up with | Key stored in | How to view it | Who can see it |
|---|---|---|---|
| Personal Microsoft account @outlook.com, @hotmail.com | Microsoft account | aka.ms/myrecoverykey | The account that set up the PC |
| Microsoft 365 work account Entra joined | Microsoft Entra ID (+ Intune if used) | aka.ms/aadrecoverykey → Devices → View BitLocker Keys | The user (if allowed) or an IT admin |
| Company domain Active Directory | The computer object in AD DS | ADUC → Properties → BitLocker Recovery tab | Domain Admins or delegated staff |
| Manual backup | A .txt file, USB drive or printout | Open it on another device | Whoever kept it |
6 steps to find the BitLocker recovery key and get back in
Note the Key ID, undo the latest change, then look up the key based on how the PC is managed. A phone is all you need.
-
Note the Key ID and device name
Take a photo of the blue screen and write down the first 8 characters of the recovery key ID. One account can hold several keys, and this is how you pick the right one. On a company PC, also note the device name (often on a sticker underneath) so IT can find it quickly.
Don't reset the PC or reinstall Windows at this point.
-
Undo the most recent change
Sometimes you don't need the key at all:
- Unplug USB drives, docking stations or external disks, then restart.
- If someone just changed Secure Boot or the boot order in the BIOS, set it back.
Still asking? Go to step 3, 4 or 5 depending on the type of PC.
-
Personal PC: check your Microsoft account
On a phone or another computer, go to aka.ms/myrecoverykey and sign in with the Microsoft account used to set up the PC. Choose the key whose Key ID matches the screen. If it isn't there, try the account of whoever set the PC up for you.
-
Company PC: check Microsoft Entra ID / Intune
If you sign in with a company Microsoft 365 account, go to aka.ms/aadrecoverykey → Devices → select the PC → View BitLocker Keys.
If your organisation has disabled self-service, an IT admin can find it on the device's page in the Microsoft Entra admin center or under the device's recovery keys in the Intune admin center, as described in Microsoft's recovery process.
-
Domain-joined PC: check Active Directory
For companies with a Windows Server domain controller, an admin has two options (the BitLocker Recovery Password Viewer from RSAT must be installed):
- Open Active Directory Users and Computers → right-click the computer object → Properties → BitLocker Recovery tab.
- Or right-click the domain → Find BitLocker Recovery Password → enter the first 8 characters of the Key ID → Search.
-
Enter the key, then find the cause
Type the 48-digit key on the blue screen (no need to type the dashes). Once you're in Windows, don't stop there — open Command Prompt as administrator and check:
manage-bde -status C: :: encryption and protection status manage-bde -protectors -get C: :: current Key ID and recovery passwordThen look in Event Viewer (Applications and Services Logs → Microsoft → Windows → BitLocker-API) and the Windows Update history to see whether an update caused it, or whether someone changed the PC outside working hours. Finally, make sure the key is backed up centrally.
What Hinet's team learned from BitLocker cases
In October 2026 Hinet handled a case where a user's PC booted straight to the BitLocker recovery screen. The team started by locating the key that matched the Key ID — but before handing it to the user, we always check one more thing: was there an update, or did anyone work on the machine outside office hours?
That's because a BitLocker recovery screen isn't just a lock-out problem; it's also a security signal. If the cause was a scheduled BIOS update, entering the key is the end of it. If nobody can explain why the startup changed, someone may have tried to boot the PC from a USB drive to get at the data — and that needs investigating.
Our take: BitLocker isn't the enemy; not knowing where the key is, is the real risk. Many newer Windows 11 PCs have BitLocker on without users realising, and the day a PC locks is the worst day to start searching. Store every device's key centrally from the day you hand the PC to an employee.
How do you stop the recovery screen from coming back?
Store every PC's key centrally, and suspend BitLocker before every BIOS update or repair.
- Keep every key in a central system — for Microsoft 365 PCs, join them to Entra ID and use an Intune policy that requires key backup; for domain-joined PCs, use Group Policy to store keys in AD.
- Suspend before BIOS / firmware updates via Control Panel → BitLocker Drive Encryption → Suspend protection, or (as administrator):
The data stays encrypted, and protection resumes on its own after the restart.manage-bde -protectors -disable C: -RebootCount 1 - Find PCs with no key on file — run
manage-bde -protectors -get C:while the PC still works, and back it up following Microsoft's guide. - Set a BIOS password so users can't change Secure Boot or the boot order themselves.
- Add it to your joiner/leaver checklist: every PC handed out must have its key on file, and every PC returned must be unlocked before the user's account is deleted.
When should you call an expert?
If you've checked everywhere and still can't find the key, if it keeps asking after you've entered it, or if you can't explain the cause — have an administrator look before anyone resets the PC.
Resetting means accepting permanent data loss, so it should be the very last option. Hinet looks after client PCs through IT Support Outsource and sets up Microsoft 365 Business so every device's key is stored centrally. If you need an engineer to connect once you're back in, see how to install AnyDesk on Windows, or report the issue using the form below.
FAQ: BitLocker recovery keys
I never turned BitLocker on — why is it asking for a recovery key?
Many Windows 10/11 devices turn on Device Encryption (which uses BitLocker) automatically when they're set up with a Microsoft or work account — especially Windows 11 from version 24H2. Users often don't know the drive is encrypted. In that case the key is usually backed up to the account that first set up the PC.
Can Microsoft or a repair shop recover my BitLocker key?
No. Microsoft states that its support team can't retrieve, provide or recreate a lost BitLocker recovery key, and a repair shop can't decrypt the drive without it. If the key really can't be found, the only option is to reset or reinstall Windows, which erases everything on the drive.
My Microsoft account lists several recovery keys. Which one do I use?
Match the first 8 characters of the Key ID shown on the blue screen. One account can hold keys for several PCs, and one PC can have several keys if BitLocker was turned off and on again.
After entering the key, will it ask again on the next restart?
Usually not — once you unlock with the recovery key, BitLocker re-measures the current startup configuration. If the cause is still there, such as a USB device left plugged in or a TPM problem, it will ask again, so always track down the cause.
How do I update the BIOS without triggering BitLocker recovery?
Suspend BitLocker first, via Control Panel > BitLocker Drive Encryption > Suspend protection, or with manage-bde -protectors -disable C: -RebootCount 1. The data stays encrypted, and protection resumes automatically after the set number of restarts.
Should we just turn BitLocker off to avoid this?
We don't recommend it, especially on laptops. BitLocker stops anyone who steals or finds a device from reading company data, which also matters for personal-data obligations under Thailand's PDPA. The better fix is to store every device's recovery key centrally.
References
- Microsoft Support — Find your BitLocker recovery key
- Microsoft Learn — BitLocker recovery overview
- Microsoft Learn — BitLocker recovery process
- Microsoft Support — Back up your BitLocker recovery key
Related guides
Technically reviewed by the Hinet Computer System engineering team · Last updated 29 Oct 2026