The blue BitLocker recovery screen means Windows noticed a change in how the PC starts, such as a BIOS update, a TPM reset or a new boot device, and refused to unlock the drive on its own. It wants the 48-digit recovery key created when encryption was turned on.
The fastest route: note the Key ID on that screen, then look where the PC’s setup put the key. Personal PCs signed in with a Microsoft account usually saved it there; work PCs usually saved it to Microsoft Entra ID (and Intune) or Active Directory.
One honest warning: there is no legitimate shortcut. BitLocker is designed so that without the recovery key or another working unlock method, nobody can read the drive, and Microsoft Support can’t retrieve or recreate a lost key. Put your effort into finding it.
Try these first
- Write down the first 8 characters of the Key ID on the recovery screen.
- On a phone or another PC, sign in at aka.ms/myrecoverykey with the Microsoft account used on this PC.
- Work or school PC: check aka.ms/aadrecoverykey (Devices, then View BitLocker Keys) or ask your IT admin.
- Unplug USB drives, SD cards and docks, then restart.
- If you just changed a BIOS setting (Secure Boot, TPM, boot order), change it back and restart.
- Back in Windows, save a fresh copy of the key somewhere other than this PC.
Read the recovery screen before you do anything else
The screen shows a Recovery key ID. Write down its first 8 characters; if an account holds several keys, only the one whose ID matches will work.
On Windows 11 version 24H2 and later, the screen also shows a hint of the Microsoft account the key was saved to.
The key itself is 48 digits in eight groups of six. The recovery console checks each six-digit block as you type, so a rejected block usually means a mistyped digit, not a wrong key. If the number row doesn’t respond, the function keys F1 through F10 enter the digits 1 through 0.
Many people never knowingly turned BitLocker on: Windows 11 enables Device encryption automatically on supported hardware, including Home, when the PC is set up with a Microsoft, work or school account, and the key usually goes to that account.
If your screen says Preparing Automatic Repair instead, see our automatic repair loop guide; those repair tools may ask for this key too.
Where your BitLocker recovery key is stored
Find the row that matches your PC.
| How the PC was set up | Where to look | Who can get it |
|---|---|---|
| Personal PC signed in with a Microsoft account (Home or Pro) | aka.ms/myrecoverykey from another device; match the Key ID | You, or whoever set the PC up (see below) |
| Work or school PC joined to Microsoft Entra ID or managed in Intune | aka.ms/aadrecoverykey, or myaccount.microsoft.com > Devices > View BitLocker Keys. On Intune-managed PCs, the Company Portal website (portal.manage.microsoft.com) also works: Devices > your PC > Get recovery key | You, unless your admin restricted self-service; otherwise your IT admin |
| Office PC joined to an on-premises Active Directory domain | The computer object in Active Directory (BitLocker Recovery tab) | A domain admin or delegated help desk |
| BitLocker turned on by hand and the key saved manually | A printout, a USB flash drive (plug it into the locked PC; if it holds a text file, read that on another computer), or a text file on another drive | Whoever kept it; check where you file warranties and receipts |
| Local account only, no Microsoft or work account | Device encryption never locks a drive that has only had local accounts, so a Microsoft or work account was used at some point (at setup, before a switch to a local account, or by another admin), or someone turned on BitLocker on a Pro PC and saved the key by hand | Whoever set it up |
| Used or refurbished PC | Possibly the previous owner’s account | The seller; if they can’t produce it, see the last section |
Your account shows no key, or none that match
- Wrong account. Try every Microsoft account used on this PC, including old Hotmail, Outlook.com or Xbox addresses, and use the account hint on the recovery screen.
- Keys for other PCs. The list holds keys for every PC and past Windows install on that account, often under names like DESKTOP-ABC1234. Match the Key ID, not the name.
- Someone else set it up. A former employee, a previous IT provider, a relative or the seller may have used their own account. Ask them to check aka.ms/myrecoverykey.
- A work email was ever used on it. Check aka.ms/aadrecoverykey too, or ask that organization’s IT admin.
For admins: pull the key from Intune, Entra ID or Active Directory
Admins can retrieve the BitLocker recovery key directly from Intune, Entra ID or Active Directory. Confirm the person asking is the device’s real user first; anyone holding the key can read the whole drive.
Microsoft Intune admin center
- Go to Devices > All devices and select the PC.
- Under Monitor, select Recovery keys, then Show Recovery Key.
- Match the BitLocker Key ID to the one on the user’s screen.
If Intune reports No BitLocker key found for this device, the key isn’t in Entra ID: either it was never backed up, or the device record was deleted. On a hybrid-joined PC, check Active Directory too. Each key view is logged in the audit log under KeyManagement.
Microsoft Entra admin center
Go to Entra ID > Devices > All devices, open the device and select Show Recovery Key. You need to own the device or hold a role such as Cloud Device Administrator or Helpdesk Administrator.
On-premises Active Directory
With the BitLocker Recovery Password Viewer (part of RSAT) installed, open Active Directory Users and Computers, open the computer’s Properties and select the BitLocker Recovery tab. To search by Key ID instead, right-click the domain and choose Find BitLocker Recovery Password. AD keeps every old key for a computer, so use the entry whose ID matches.
Afterward
Rotate the key once the user is back in, since it has now been read aloud or shared. Intune’s BitLocker key rotation device action does this when your BitLocker policy enables rotation.
Then check your other PCs while they still start normally. Backup to Entra ID or AD only happens when a BitLocker policy turns it on, and a PC encrypted before it joined the domain may have no key on file. On a working PC, manage-bde -protectors -get C: lists the recovery password and its ID, and manage-bde -protectors -aadbackup C: -id "{ID}" (Entra ID) or manage-bde -protectors -adbackup C: -id "{ID}" (AD) sends it up. Keep the quotes; without them, PowerShell in Terminal never passes the braced ID to manage-bde. AD backup is also refused unless Group Policy allows it (Choose how BitLocker-protected operating system drives can be recovered, with AD DS backup turned on).
For help with BitLocker key backup as part of your Microsoft 365 security setup, see our Microsoft 365 management service.
Why BitLocker keeps asking for the recovery key
One prompt after a firmware change is normal. A prompt on every restart means the trigger is still in place.
| What happened | Likely cause | What to do |
|---|---|---|
| Asked once, right after a BIOS, UEFI or firmware update | The measured startup components changed | Enter the key once. Unlocking with the key resets the TPM measurements, so the next restart should be normal |
| Asks on every restart | A changed setting is still there: Secure Boot off, TPM disabled, or an extra boot device | Put the setting back, then suspend and resume BitLocker once (next section) to reseal |
| Asks only when docked, or with a USB drive or SD card inserted | The firmware sees a different boot order | Unplug at startup, or set the internal drive first in the boot order both docked and undocked |
| After a motherboard replacement, or the drive was moved to another PC | A new TPM can’t read the old seal | Enter the key; BitLocker re-binds to the new TPM. Moving the drive back will prompt again |
| After the TPM was cleared or reset | The TPM’s stored keys are gone | Enter the key. Your Windows Hello PIN usually breaks too; see how to fix “your PIN isn’t available” |
| After too many wrong startup PIN entries (TPM plus PIN setups) | TPM lockout | Enter the key, then in Manage BitLocker choose Change PIN > Reset a forgotten PIN |
| Work PC, after too many wrong Windows passwords | An Intune or Group Policy sign-in limit forces recovery on purpose | Enter the key, then sign in with the correct password |
| Surface: the key is accepted but Windows still won’t start after a firmware update | Secure Boot off or custom PCR settings | Needs a Surface recovery USB and command-line work; treat it as a stop-and-get-help case |
Microsoft says updates delivered through Windows Update don’t need any BitLocker action from you. When a prompt follows “an update,” the usual cause is firmware from the PC maker’s utility, a BIOS setting change, or a dock or USB device attached at that restart. Rarely, a Windows update itself has a BitLocker bug, as Microsoft confirmed after its July 2024 security updates; if several PCs prompt after the same update, check the Windows release health page first.
Rather have a technician sort it out?
Once the PC is back in Windows, we can help work out why BitLocker keeps asking and make sure the recovery key is backed up somewhere other than that PC. If the computer won’t start, call us and we’ll tell you honestly whether it can be fixed remotely or needs a hands-on repair. Once it starts, a technician can connect with your approval and fix the rest for $59.
Back in Windows: stop the prompt from returning
Once Windows loads, open Terminal (Admin) and check the drive:
manage-bde -status C:
Look for Protection On. Then run manage-bde -protectors -get C:; on a modern PC the TPM entry says Uses Secure Boot for integrity validation. If it doesn’t, Secure Boot is probably off and firmware changes will trigger prompts far more often.
If the prompt has appeared more than once, reseal the key by suspending and resuming protection:
Suspend-BitLocker -MountPoint "C:" -RebootCount 1
Restart, and protection resumes on its own. On Pro, Enterprise and Education, Manage BitLocker > Suspend protection does the same; Windows 11 Home has no Manage BitLocker, so use the command.
Now save a fresh copy of the key somewhere that isn’t this PC. On Pro, choose Back up your recovery key in Manage BitLocker and pick your Microsoft account, a file on another drive, or a printout. On Home, check that a key with this PC’s ID shows at aka.ms/myrecoverykey, or copy the Numerical Password from manage-bde -protectors -get C: onto paper. Don’t keep the printout or USB stick in the laptop bag.
Before a BIOS, TPM or firmware update, suspend BitLocker
This one habit prevents most surprise recovery screens. Suspending keeps the drive encrypted but skips the startup check, then reseals the key to the new firmware when protection resumes.
Firmware updates often restart the PC more than once, so Microsoft recommends a reboot count of 2 or more, or 0 to stay suspended until you resume it yourself:
- Open Terminal (Admin) and run
Suspend-BitLocker -MountPoint "C:" -RebootCount 0 - Install the BIOS, UEFI or TPM firmware update and let it finish every restart.
- Back in Windows, run
Resume-BitLocker -MountPoint "C:"and confirm withmanage-bde -status C:that protection is on.
The Command Prompt equivalent is manage-bde -protectors -disable C: -rc 0, then manage-bde -protectors -enable C: when you’re done.
While suspended, the unlock key sits unprotected on the drive, so anyone who takes the PC can read it. Resume the same day.
Suspend first for BIOS or UEFI updates (from the maker’s tool or a USB stick), TPM firmware updates that clear the TPM, and Secure Boot or boot-setting changes. Some makers’ utilities suspend BitLocker for you; check rather than assume.
If you can’t find the key, and when to stop
Before giving up, work through the “Your account shows no key” checklist above and the paperwork from the day the PC was set up.
If the key truly doesn’t exist, the only way forward is to wipe the PC (Reset this PC > Remove everything, or a clean install) and restore files from OneDrive, a cloud backup or a file server. With no backup, those files are gone, which is why encrypted laptops need a real file backup.
Be wary of anyone promising to “bypass” BitLocker without the key; data recovery labs can’t decrypt a properly encrypted drive either.
If the key is accepted but the PC then shows a stop code or Preparing Automatic Repair, BitLocker is no longer the problem. After a BIOS change, an INACCESSIBLE_BOOT_DEVICE stop code often means the storage controller mode was switched; for a repair loop, use the automatic repair guide linked above.
Stop and get help when those steps don’t get Windows started, when the drive clicks, isn’t detected or throws disk errors, or before you reset a PC whose data matters. A clicking or undetected drive needs hands-on work from a repair shop or data recovery lab, not a remote session. Microsoft’s BitLocker Repair Tool can sometimes salvage a damaged drive, but only with the recovery key, and repeated attempts on a failing drive can make it worse.
A PC stuck at this screen can’t accept a remote connection, so someone has to be at the keyboard for the unlock. Once Windows is up, working out why it keeps prompting and backing the key up properly is a typical $59 remote fix.
Common questions
Can Microsoft or my PC maker give me my BitLocker recovery key?
Only if it was saved to your Microsoft account, and then you can see it yourself at aka.ms/myrecoverykey from any device. Microsoft states that its support team can’t retrieve, provide or recreate a lost BitLocker recovery key. The PC maker doesn’t get a copy either; Dell, for one, tells customers it can’t recover the key. For a work PC, the copy lives in your organization’s Entra ID or Active Directory, so ask your IT admin.
Why does BitLocker ask for a recovery key after a BIOS update?
BitLocker measures the firmware and boot files at every start. A BIOS or UEFI update changes those measurements, so the TPM refuses to release the key and Windows falls back to the recovery key. Enter it once and the measurements are reset. Next time, suspend BitLocker before the update with Suspend-BitLocker and a RebootCount of 0, then resume it afterward.
Can I skip the BitLocker recovery screen?
Not if you want Windows to start. Some recovery screens offer to skip the drive, but that only lets repair tools run without access to it; Windows itself lives on the locked drive. Pressing Esc or restarting repeatedly won’t clear the prompt either. You need the recovery key, or you need to undo whatever changed, such as a BIOS setting or an attached dock.
How do I see my recovery key while I am still signed in to Windows?
On any edition, including Home, open Terminal as administrator and run manage-bde -protectors -get C:. The Numerical Password entry shows the ID and the 48-digit key. On Pro, Enterprise or Education, Manage BitLocker > Back up your recovery key also saves or prints a copy. If you use a Microsoft account, confirm at aka.ms/myrecoverykey that a key with this PC’s ID is listed. Do this for every PC you own and keep the copies away from the PCs.
Does suspending BitLocker decrypt my drive?
No. Suspending leaves every file encrypted but stores the unlock key in the clear on the drive, so the PC can start without checking its firmware measurements. That makes firmware updates safe, but it also means the drive isn’t protected while suspended. Resume protection as soon as the update is done. Turning BitLocker off is different: that fully decrypts the drive.
Is it safe to read my recovery key to an IT technician?
Only to someone you trust who is helping with that specific PC, because the key unlocks everything on the drive. On a work PC, ask your admin to rotate the key afterward; Intune can do this remotely when rotation is enabled. On a personal PC, adding a new recovery password doesn’t cancel the old one. Once you’re back in Windows, add a new one with manage-bde, delete the old one by its ID, then save the new key somewhere other than the PC.
Should I turn off BitLocker so it stops asking?
Usually not. Turning it off does stop the prompts, but the cause is still there and a lost or stolen laptop becomes readable by whoever has it. Prompts normally stop once the trigger is undone and BitLocker is suspended and resumed once. If you still want it off, use Settings > Privacy & security > Device encryption on Windows 11 Home, or Manage BitLocker > Turn off BitLocker on Pro. Decryption runs in the background. On a work PC, ask your admin first.