BitLocker Recovery Key Screen at Startup: Why It Happens and Where to Find Your Key

29 Jul 2026
BitLocker Recovery Key Screen at Startup Why It Happens and Where to Find Your Key

You switch on your computer expecting the usual Windows sign-in screen, but instead you see a blue page asking for a 48-digit BitLocker recovery key.

For many people, this is the first time they realise BitLocker is active on their device. The screen can look alarming, particularly when Windows will not continue without the key.

The important thing to understand is that the recovery screen does not automatically mean your computer has been hacked, your files have been deleted or the drive has failed.

BitLocker is a Windows security feature that encrypts the contents of a drive. When it detects an unexpected change to the way the computer starts, it may refuse to unlock the drive automatically and request the recovery key instead. 

Here is why that happens, where your key may be stored and what to do if the screen keeps returning.

What Is a BitLocker Recovery Key?

A BitLocker recovery key is a unique 48-digit numerical code that can unlock an encrypted drive when Windows cannot use its normal unlocking method.

It normally appears in groups of six digits, similar to this:

123456-123456-123456-123456-123456-123456-123456-123456

The key is created when BitLocker or Windows Device Encryption is enabled.

Depending on how the computer was configured, the recovery key may have been:

  • Saved to your Microsoft account
  • Stored in your organisation’s Microsoft Entra ID
  • Saved in Active Directory
  • Printed on paper
  • Saved to a USB drive
  • Saved as a text file
  • Recorded by your IT support provider

BitLocker normally unlocks the Windows drive automatically by working with the computer’s Trusted Platform Module, or TPM. The recovery key is the fallback method when that automatic process fails. 

Why Is BitLocker Asking for the Key?

BitLocker monitors parts of the computer’s startup environment. If something changes unexpectedly, it may treat the change as a possible security risk.

The recovery screen is therefore a protective response. BitLocker is effectively saying:

“The startup environment is different from what I expected, so I need the recovery key before I release the encrypted data.”

Microsoft describes BitLocker recovery as the process used when a protected drive cannot unlock through its normal mechanism. 

Common triggers include the following.

1. A BIOS or Firmware Update

A BIOS, UEFI or device-firmware update can change measurements used by the TPM to verify the computer’s startup environment.

This may cause BitLocker to request the recovery key on the next restart, even when the update was legitimate.

It is particularly common after:

  • BIOS updates
  • UEFI updates
  • TPM firmware updates
  • Motherboard firmware changes
  • Manufacturer security updates
  • Changes to Secure Boot certificates

Normally, entering the correct key allows Windows to start and BitLocker then accepts the updated environment.

2. A Windows Update

Some Windows updates modify boot files, security components or the protected startup chain.

Most updates complete without triggering BitLocker recovery. However, a recovery prompt may appear when:

  • The update changes boot-related components
  • Firmware is updated at the same time
  • The update is interrupted
  • Secure Boot settings change
  • The computer shuts down unexpectedly during installation
  • Existing firmware has a compatibility problem

Installing an update shortly before the recovery screen does not necessarily mean the update damaged the computer. It may simply have changed something BitLocker was monitoring.

3. Secure Boot Was Changed or Disabled

Secure Boot helps verify that trusted software is used during startup.

BitLocker may request recovery if Secure Boot is:

  • Disabled
  • Re-enabled
  • Reset
  • Reconfigured
  • Switched between standard and custom modes
  • Updated with new certificates or keys

The same can happen when a BIOS update restores Secure Boot settings to their defaults.

4. TPM Settings Were Changed

The TPM securely protects information used to unlock the encrypted drive.

Recovery may be triggered when:

  • The TPM is disabled
  • The TPM is cleared
  • TPM ownership changes
  • TPM firmware is updated
  • The motherboard is replaced
  • BIOS settings affecting the TPM are changed
  • Windows can no longer communicate with the TPM

Do not clear the TPM as an attempt to bypass the recovery screen. Clearing it may remove protected credentials and create additional problems.

5. The Boot Order Changed

Changing which device the computer attempts to start from can trigger recovery.

This may happen after:

  • Connecting a bootable USB drive
  • Changing the boot order in the BIOS
  • Attempting to start from external media
  • Adding another internal drive
  • Replacing a storage device
  • Using a recovery or installation USB
  • Changing UEFI and legacy boot settings

Remove unnecessary USB storage devices and restart before making more significant changes.

6. Hardware Was Added or Replaced

BitLocker may respond to major hardware changes, including:

  • Replacing the motherboard
  • Moving the encrypted SSD to another computer
  • Replacing the TPM
  • Changing certain storage controllers
  • Adding or removing internal drives
  • Altering PCIe hardware
  • Changing docking arrangements on some devices

Replacing ordinary accessories such as a mouse or keyboard would not normally trigger recovery.

7. The Computer Was Docked or Undocked

Some laptops can enter recovery after changes involving:

  • USB-C docks
  • Thunderbolt docks
  • External graphics devices
  • Dock firmware
  • Bootable devices connected through a dock
  • Changes to display or storage hardware

Disconnect the dock and unnecessary peripherals, then restart the laptop.

8. A Startup File or Boot Configuration Changed

BitLocker can also react when the Windows boot environment has been modified.

Possible causes include:

  • A damaged boot configuration
  • Dual-boot configuration changes
  • Partition changes
  • Boot-repair tools
  • Disk-cloning software
  • Third-party encryption products
  • Malware affecting startup files
  • A failed Windows installation
  • Restoring an old system image

In these cases, entering the key may unlock the drive, but the underlying boot problem may still require repair.

9. BitLocker Was Not Suspended Before Planned Maintenance

Before certain firmware, BIOS or hardware changes, BitLocker protection should be suspended temporarily.

Suspending BitLocker does not decrypt the drive. It temporarily prevents the usual startup checks from causing recovery during the planned change.

Once the maintenance is complete and the computer has restarted successfully, BitLocker protection can be resumed.

This should normally be handled by the organisation’s IT provider on business devices.

Where to Find Your BitLocker Recovery Key

The blue recovery screen usually displays a Recovery Key ID.

This is not the recovery key itself.

The Recovery Key ID helps you identify which stored 48-digit key belongs to that computer. Compare the ID on the screen with the ID shown alongside the saved key.

Do not enter the Key ID into the recovery box. Windows requires the full 48-digit recovery key.

Option 1: Check Your Microsoft Account

For a personal computer, the key may have been saved automatically to the Microsoft account used when the device was set up.

Using another phone, tablet or computer:

  1. Open Microsoft’s BitLocker recovery-key page.
  2. Sign in using the Microsoft account associated with the locked computer.
  3. Review the listed devices and recovery keys.
  4. Match the displayed Key ID with the ID on the BitLocker screen.
  5. Enter the corresponding 48-digit key.

Microsoft notes that from Windows 11 version 24H2, the recovery screen may display a clue showing which Microsoft account is associated with the key. 

You may need to check more than one Microsoft account, particularly if the computer was originally configured using:

  • A personal account
  • A family member’s account
  • An old email address
  • A previous employee’s account
  • An account used by the person who first set up the PC

Option 2: Check Your Work or School Account

If the device belongs to a business or school, the recovery key may be stored in the organisation’s Microsoft Entra environment.

Try signing in to your organisation’s account portal from another device and checking the registered device information.

Whether you can view the key yourself depends on the organisation’s configuration and permissions.

If the key is not shown, contact your IT team or managed service provider. They may be able to retrieve it using:

  • Microsoft Intune
  • Microsoft Entra ID
  • Active Directory
  • The organisation’s endpoint-management platform
  • A documented asset-management record

Microsoft provides separate recovery processes for Entra-joined, hybrid-joined and Active Directory-joined devices. 

Option 3: Check a Printed Copy

When BitLocker was activated, someone may have selected the option to print the recovery key.

Look in:

  • Computer paperwork
  • A home office filing cabinet
  • The box supplied with the PC
  • IT handover documentation
  • Security records
  • Business continuity documentation

The printed document may be labelled BitLocker Drive Encryption recovery key.

Option 4: Check a USB Drive

The recovery key may have been saved to a USB flash drive.

Connect the USB drive to another computer and look for a text file containing the words:

BitLocker Recovery Key

Do not connect unknown USB drives to a business computer without approval.

Option 5: Search for a Saved Text File

Someone may have saved the recovery key as a file.

Search your other storage locations for terms such as:

  • BitLocker
  • Recovery key
  • BitLocker Recovery Key
  • The computer name
  • The Recovery Key ID

Check:

  • OneDrive
  • SharePoint
  • Google Drive
  • Dropbox
  • External backup drives
  • A password manager’s secure notes
  • Your Documents folder on another PC
  • IT documentation systems

Be careful not to store the recovered key somewhere publicly accessible.

Option 6: Ask the Person Who Set Up the Computer

The recovery key may belong to the account used during the computer’s original setup.

This is common when:

  • A family member configured the device
  • An employee’s computer was prepared by a manager
  • An external IT company installed Windows
  • The laptop previously belonged to someone else
  • A retailer or reseller completed the setup

The person who enabled encryption may have the key in their Microsoft account or documentation.

Option 7: Contact Your IT Provider

For a company-owned device, contacting IT should usually be one of the first steps.

Provide them with:

  • The employee’s name
  • The computer name, if known
  • The serial number or asset tag
  • The Recovery Key ID shown on the screen
  • A photograph of the screen, excluding any sensitive key once found
  • Details of any recent updates or hardware changes

Do not post the recovery screen or recovery key on public forums.

What Should You Do Once You Find the Key?

Carefully enter the 48-digit number using the keyboard.

The recovery screen normally accepts number keys without requiring hyphens.

After the key is accepted, Windows should continue starting.

Once you have signed in:

  1. Restart the computer again.
  2. Check whether the recovery screen returns.
  3. Install pending Windows and manufacturer updates.
  4. Check BIOS and firmware settings.
  5. Confirm that the TPM and Secure Boot are enabled.
  6. Make sure the recovery key is securely backed up.
  7. Ask IT to investigate if it is a managed device.

A single recovery prompt after a legitimate firmware update may not require further action.

A prompt at every startup indicates an unresolved problem.

What If BitLocker Requests the Key Every Time?

Repeated recovery prompts usually mean the TPM cannot validate the startup environment consistently.

Possible causes include:

  • Incorrect Secure Boot configuration
  • A BIOS setting that changes between restarts
  • TPM communication problems
  • Damaged BitLocker protectors
  • A firmware compatibility issue
  • A persistent boot configuration change
  • A failed or incomplete firmware update
  • Hardware instability
  • A dual-boot configuration
  • Changes to monitored TPM measurements

Microsoft explains that unexpected changes in the TPM’s Platform Configuration Registers can trigger the BitLocker preboot recovery screen. 

Do not repeatedly decrypt and re-encrypt the drive without identifying the cause.

For a business computer, your IT provider should examine:

  • BitLocker protector configuration
  • TPM status
  • Secure Boot status
  • BIOS and firmware versions
  • Windows update history
  • Intune compliance and encryption policies
  • Relevant event logs
  • The device’s recovery-key escrow status

Should You Disable BitLocker?

Disabling BitLocker may remove the recovery prompt, but it also removes the drive’s encryption protection.

Without encryption, someone who steals the computer may be able to remove its storage drive and read the data from another device.

For business systems, disabling encryption could also breach:

  • Company security policies
  • Cyber-insurance requirements
  • Client contracts
  • Data-protection procedures
  • Compliance obligations

It is normally better to fix the reason BitLocker is entering recovery than to disable the protection entirely.

Do Not Clear the TPM Without Preparation

Clearing the TPM is sometimes suggested as a universal BitLocker fix. It is not.

The TPM may protect:

  • BitLocker keys
  • Windows Hello credentials
  • Device certificates
  • Virtual smart cards
  • Work-account credentials
  • Other security information

Before clearing it, ensure that:

  • You possess the correct BitLocker recovery key
  • Important data is backed up
  • You know the impact on Windows Hello
  • Business certificates can be restored
  • Your IT administrator has approved the work

Clearing the TPM without the recovery key can leave the encrypted drive inaccessible.

What If You Cannot Find the Recovery Key?

BitLocker encryption is specifically designed to prevent access without an authorised unlocking method.

Microsoft cannot recreate a lost recovery key, and neither can a repair shop or IT provider simply bypass the encryption.

If the key cannot be found, the remaining option may be to erase the drive and reinstall Windows. This removes the encrypted data.

Before doing that, check thoroughly:

  • Every Microsoft account you may have used
  • Work and school accounts
  • Your organisation’s IT systems
  • Printed documents
  • USB drives
  • Cloud-storage accounts
  • Password-manager notes
  • Previous IT providers
  • The person who configured the PC

Do not pay for software claiming it can magically recover a correctly encrypted BitLocker drive without the key. Such claims are generally misleading.

How to Prevent This Problem Next Time

Once access has been restored, take several preventative steps.

Back Up the Recovery Key

Store the key in at least one approved secure location.

For a personal PC, this might include your Microsoft account and an encrypted password manager.

For a business, recovery keys should normally be escrowed automatically into Microsoft Entra ID, Intune or Active Directory.

Check the Key Before Firmware Changes

Before updating the BIOS, replacing hardware or changing Secure Boot settings:

  1. Confirm that the recovery key exists.
  2. Verify that it matches the correct device.
  3. Back up important files.
  4. Suspend BitLocker where appropriate.
  5. Complete the maintenance.
  6. Restart and test the device.
  7. Resume protection.

Maintain Reliable Backups

BitLocker protects data from unauthorised access. It does not protect against:

  • Drive failure
  • Accidental deletion
  • Ransomware
  • Corrupted files
  • A lost recovery key
  • Physical damage

Maintain a separate, tested backup of important data.

A Quick Recovery Checklist

When the BitLocker screen appears:

  1. Do not panic or reset the PC.
  2. Photograph or write down the Recovery Key ID.
  3. Disconnect unnecessary USB devices and docks.
  4. Check the Microsoft account linked to the computer.
  5. Check the organisation’s work or school account.
  6. Search printed, USB and cloud-storage records.
  7. Contact IT if the device belongs to a business.
  8. Enter the matching 48-digit key.
  9. Restart and check whether the prompt returns.
  10. Investigate BIOS, TPM or Secure Boot settings if it happens repeatedly.

How Hamilton Group Can Help

BitLocker is valuable protection, but recovery screens can bring work to a complete stop when keys are not stored correctly or devices enter a recovery loop.

Hamilton Group can help businesses with:

  • Locating escrowed BitLocker recovery keys
  • Microsoft Intune and Entra ID configuration
  • BitLocker recovery-loop investigations
  • TPM and Secure Boot troubleshooting
  • BIOS and firmware update planning
  • Encryption-policy deployment
  • Windows device management
  • Recovery-key auditing
  • Laptop replacement and data-migration planning
  • Secure backup and disaster recovery

We can also check whether recovery keys are being stored centrally for every managed device. This prevents an unexpected BitLocker screen from turning into permanent data loss.

Regain Access Without Risking Your Data

A BitLocker recovery screen usually means Windows has detected a change in the trusted startup environment. It does not necessarily mean the computer has been compromised.

The key is to locate the correct 48-digit recovery code, avoid risky changes and investigate the underlying cause when the screen appears repeatedly.

For help recovering a business device, reviewing your BitLocker configuration or securing recovery keys across your organisation, call Hamilton Group on 0330 043 0069 or book a call with one of our experts today.


 

Previous Next