BitLocker Recovery Key: Where to Find It, Why Windows Asks for It, and How to Stop It
Top: a Lenovo ThinkPad work laptop on Windows 11. Laptops set up with a Microsoft or work account usually encrypt their drive from the first sign-in. Photo: Edvard10, CC0, cropped.
Your BitLocker recovery key is a 48-digit number saved when encryption was switched on. On your own laptop, open aka.ms/myrecoverykey on another device and sign in with your Microsoft account. On a work or school laptop, try aka.ms/aadrecoverykey, or call your IT team. Pick the key whose ID matches the Key ID on the screen. Don’t reset the laptop yet: without the key, a reset deletes every file on the drive.
Start from your situation:
- It’s your own laptopCheck your Microsoft account. How
- It’s a work or school laptopYour work account, or IT. How
- It appeared after a BIOS update or on a dockUndo the change. Why
- It asks at every startSuspend, then resume. How
- You look after the company’s laptopsKeys and fleet fixes. How
- You can’t find the key anywhereWhat’s left. See
Where to find your BitLocker recovery key: Microsoft account, work account or printout
First, note the Key ID on the blue screen. You only need its first 8 characters. It tells you which key to use if you find more than one. On Windows 11 version 24H2 and later, the screen also hints at the Microsoft account the key was saved to.
Then check these places, in this order:
- Your Microsoft account. On a phone or another computer, go to aka.ms/myrecoverykey and sign in. Find the key with the matching ID. If someone else set the laptop up or switched BitLocker on, the key may be in their account. So check every Microsoft account that has been used on it.
- Your work or school account. Go to aka.ms/aadrecoverykey, sign in, select Devices, expand the laptop and select View BitLocker Keys.
- A printout. Look where you keep the laptop’s receipt and papers.
- A USB stick. Plug it into the locked laptop and follow the instructions. If the key was saved as a text file, open it on another device.
Match the BitLocker recovery key ID
A key only unlocks the drive whose ID it matches. If you type a key from the right account but the wrong laptop or an older drive, it fails. The recovery screen also checks each block of 6 digits as you type, so a typo shows up straight away rather than after all 48.
Work laptop: get the BitLocker recovery key from your work account or IT
On a company laptop, the key is usually saved to your company’s Microsoft Entra ID or Active Directory, not to your own account. The aka.ms/aadrecoverykey link above may show it. Your company can switch that option off. If the key isn’t there, call the help desk and give them two things:
- The laptop’s name, often on a sticker or asset tag.
- The Key ID from the blue screen.
Tell them what happened just before, such as an update or a new dock, so they can stop it on other laptops too.
Why is my laptop asking for a BitLocker recovery key? What the blue recovery screen means
Each time the laptop starts, BitLocker checks that the start-up hasn’t changed since it last unlocked the drive. If something has, it won’t unlock the drive by itself and asks for the key. That stops someone taking the drive out or changing the start-up to get at your files.
| What changed | What to do |
|---|---|
| A BIOS or UEFI firmware update | Enter the key once. Next time, suspend BitLocker first. How |
| It started on a dock, or with a USB stick or drive plugged in | Unplug it and restart. On a dock, keep the laptop’s own drive first in the boot order, docked and undocked. |
| Secure Boot was switched off or changed in the BIOS | Switch Secure Boot back on and restart. |
| The TPM security chip was cleared or switched off, or the motherboard was replaced | You need the key. Then suspend and resume BitLocker. |
| Too many wrong PINs or Windows sign-in attempts | You need the key. |
| The drive was moved to another computer | You need the key to unlock it there. |
On Windows 11 version 24H2 and later, press Alt on the recovery screen to see the error and its code.
BitLocker keeps asking for the recovery key at every start
If the screen comes back after you’ve entered the key, BitLocker is still comparing against the old start-up. Enter the key, get into Windows, then:
- Remove what changed. Unplug the dock and any USB drives, and switch Secure Boot back on if it was turned off.
- Suspend, then resume BitLocker. Open Control Panel > BitLocker Drive Encryption, select Suspend protection, restart, then select Resume protection. This updates BitLocker’s record of the start-up without needing the key again. Your files stay encrypted while it’s suspended.
- Update the BIOS from the laptop maker, with BitLocker suspended first.
BitLocker recovery key not working, or stuck in a loop?
If Windows won’t start even after the correct key, select Skip this drive on the recovery screen, then Troubleshoot > Advanced options > Command Prompt. Run manage-bde -status first. The Windows drive often has a different letter here, so note the letter of the locked drive and use it in place of C: below. Then run these two commands, putting your 48-digit key in the first:
manage-bde -unlock C: -rp your-48-digit-keymanage-bde -protectors -disable C:
Close the window and restart. Once Windows is up, open Command Prompt as administrator and run manage-bde -protectors -enable C: to switch protection back on.
Key rejected? Check the Key ID matches, and that the key came from the account linked to this laptop. A key with a different ID won’t work, however carefully you type it.
BitLocker recovery after a BIOS update: Dell, HP and Lenovo laptops
Windows updates from Microsoft don’t need you to do anything. Firmware is different. Microsoft lists BIOS and UEFI firmware updates installed outside Windows Update, and some TPM firmware updates, among those that may need BitLocker suspended first.
- Dell tells you to always suspend BitLocker before you update the BIOS. Its update tools can do this for you.
- HP issued an advisory on 12 May 2026 for business PCs stuck in a BitLocker recovery loop after its April 2026 BIOS updates. EliteBook, ProBook and ZBook models were among them. Its workaround is to press F10 at start-up and switch on the Microsoft 2023 certificate options under Security > Secure Boot Configuration, then save and restart.
- Lenovo has a support article for an unexpected recovery screen after a repair or changed BIOS settings.
To suspend BitLocker for a firmware update, open Control Panel > BitLocker Drive Encryption and select Suspend protection. It resumes after one restart. Firmware updates often restart more than once, so for those, open PowerShell as administrator and run Suspend-BitLocker -MountPoint "C:" -RebootCount 0. When the update has finished, run Resume-BitLocker -MountPoint "C:".
For IT teams: find a BitLocker recovery key in Entra ID, Intune or Active Directory
Where to look up a user’s key:
- Microsoft Entra ID: open the device in the Entra admin centre and select Show Recovery Key. Each view is logged. The Intune admin centre shows the same keys for enrolled devices. The Helpdesk Administrator and Cloud Device Administrator roles can read keys, or you can create a custom role.
- Active Directory: in Active Directory Users and Computers, right-click the domain and choose Find BitLocker Recovery Password, then type the first 8 characters of the ID. This needs the BitLocker Recovery Password Viewer from RSAT.
Then stop it happening across the fleet:
- Check the keys are actually backed up. Backup to Entra ID or AD isn’t automatic unless policy turns it on. On a laptop with no saved key, run
manage-bde -protectors -get C:to see the recovery password’s ID. Thenmanage-bde -protectors -adbackup C: -id {ID}sends it to AD, and-aadbackupin its place sends it to Entra ID. - Rotate a key once it has been used. Intune can rotate the key remotely, or rotate it automatically with the client-driven rotation policy.
- Suspend before firmware rollouts with
-RebootCount, or use the maker’s tool. Afterwards, check that each drive shows On again, not Suspended, because a suspended drive isn’t protected. - Put your help desk on the recovery screen. BitLocker policy can add a custom message and URL there, such as your support number.
- Watch the 2026 boot changes. Microsoft’s April 2026 update sent some devices with certain TPM validation settings into recovery, fixed on Windows 11 version 23H2 by the June 9 update (KB5093998). Since then, users have posted “Secure Boot policy has unexpectedly changed” after firmware from Windows Update.
Lost your BitLocker recovery key? What you can still do, and why there’s no bypass
- Check every account again. Every Microsoft account ever signed in on the laptop, the account of whoever set it up, and any work or school account.
- Undo the last change and restart. Unplug the dock or USB drive, switch Secure Boot back on, or put back the BIOS setting you changed. If the start-up matches again, BitLocker may unlock by itself.
- Fully power it off once. Hold the power button until the laptop switches off, then start it again. One person on Microsoft’s forum said this cleared the prompt on two Dell Latitudes in July 2026. It costs nothing to try.
There is no way round BitLocker without the key. Microsoft Support can’t find, give or recreate a lost key, and “Skip this drive” only opens the recovery options. If nothing works, the last step is to wipe the laptop with one of the Windows recovery options. Reset this PC may ask for the key too. If it does, reinstall Windows from installation media on a USB stick. How to factory reset a laptop covers both routes. You get a working laptop back, but every file on that drive is deleted.
How to turn off, disable or remove BitLocker on Windows 11
First, check the BitLocker status. Control Panel > BitLocker Drive Encryption shows each drive as On, Off or Suspended. Or run manage-bde -status in Command Prompt.
- Suspend keeps your files encrypted but leaves the key unprotected on the drive until you resume. Use it for BIOS updates and hardware changes.
- Turn off decrypts the whole drive, which takes a while. On Windows 11 Pro, select Turn off BitLocker in that Control Panel page, or run
manage-bde -off C:. On Windows 11 Home, go to Settings > Privacy & security > Device encryption and use the switch.
Don’t turn BitLocker off to fix a recovery prompt. Microsoft’s guidance is to decrypt only when you no longer need the protection. Suspend and resume fixes the prompt and keeps a lost laptop’s files safe. On a work laptop, ask IT first, because company policy may switch it straight back on.
What is BitLocker Drive Encryption, and is BitLocker enabled by default?
BitLocker encrypts your drive, so anyone who takes the laptop or its drive can’t read your files. A security chip in the laptop, the TPM, unlocks it automatically at each start, as long as nothing has changed. The recovery key is the backup way in when the chip won’t unlock it.
Many people never switched it on themselves. Windows turns on device encryption, a simpler form of BitLocker, when you first sign in with a Microsoft, work or school account. It saves the key to that account. With a local account, it doesn’t switch on automatically. The full BitLocker Drive Encryption tools come with Windows Pro, Enterprise and Education.
BitLocker recovery key: your questions
Usually in the Microsoft account used on the laptop, at aka.ms/myrecoverykey. On a work or school laptop, try aka.ms/aadrecoverykey or ask IT, and pick the key whose ID matches the screen.
Something in the start-up changed, most often a BIOS update, a dock or USB drive plugged in at start-up, or Secure Boot switched off. Undo the change and restart, or enter the key and then suspend and resume BitLocker.
Only by wiping it: reset it, or reinstall Windows from a USB stick if the reset asks for the key. Every file on the drive is deleted, so check every account first.
You find the copy saved when BitLocker was switched on, in an account, a printout, a file or on a USB stick. Nobody, Microsoft included, can create a new one for a drive that is already locked.
On an external or data drive, the recovery key unlocks it in place of the password, and then you can turn BitLocker off. On the main Windows drive without a key, the only way is to wipe it.
No. Microsoft Support can’t retrieve, provide or recreate a lost key, though you can see one saved to your own Microsoft account at aka.ms/myrecoverykey.
Sources
- Microsoft, find your BitLocker recovery key. The Key ID, aka.ms/myrecoverykey, aka.ms/aadrecoverykey, the printout and USB stick, the reset warning, and that Microsoft Support can’t retrieve a key.
- Microsoft, BitLocker recovery overview. What triggers recovery, where keys are stored, and suspend and resume to avoid it.
- Microsoft, BitLocker recovery process. Self-service at myaccount.microsoft.com, the help desk checklist, the 6-digit checks, Entra ID roles and the Active Directory viewer.
- Microsoft, BitLocker preboot recovery screen. The 24H2 account hint, the Alt key, error causes and fixes, and the custom message.
- Microsoft, BitLocker FAQ. Which updates need BitLocker suspended, boot order with a dock, and suspend versus decrypt.
- Microsoft, BitLocker recovery known issues. The Command Prompt steps out of a recovery loop, and Suspend-BitLocker with a reboot count.
- Microsoft, BitLocker operations guide, and manage-bde protectors. Status, suspend, resume, turning off, and key backup commands.
- Microsoft, device encryption in Windows. When it switches on by itself, Windows Home, and docks at start-up.
- Microsoft, manage devices in Entra ID, and Intune BitLocker. Show Recovery Key, audit logging, and key rotation.
- Microsoft, KB5093998. The June 2026 fix for recovery after the April 2026 update on devices with certain TPM validation settings.
- Dell, enable or disable BitLocker with TPM, updating the BIOS with BitLocker on, and Dell Update, suspend BitLocker. Always suspending before a BIOS update, and the update tool doing it for you.
- HP, computer stuck in BitLocker recovery loop after updating BIOS, and Windows Central’s report. The May 2026 advisory, affected models and the Secure Boot workaround.
- Lenovo, unexpected BitLocker recovery screen. Recovery after a repair or changed BIOS settings.
- Microsoft Q&A, recovery after a Windows Update firmware update. The Secure Boot message from July 2026, and the Dell Latitudes cleared by a full power-off.
- Photo: ThinkPad T14 by Edvard10 (CC0, cropped).
