BitLocker Recovery Key: Where to Find It and What Admins Do Next

Updated: November 2026

A blue screen asks for 48 digits, and the laptop won't go any further until it gets them. The key is usually saved somewhere already, and the screen itself tells you which one to look for. This guide shows where a BitLocker recovery key is stored, how to match it to the locked drive, and what IT should do once the drive is open.

TL;DR

• Where it is. A BitLocker recovery key is usually in your Microsoft account (aka.ms/myrecoverykey) or your work account (aka.ms/aadrecoverykey).
• What it is. It's a 48-digit number that opens the drive when Windows can't do it alone.
• Which one. Match the first 8 characters of the key ID shown on the recovery screen.
• No key. There's no bypass, only a reset that erases the drive.
• For IT. Verify the caller, rotate the key after use and find the root cause.

What a BitLocker Recovery Key Is

A BitLocker recovery key is a 48-digit number that opens a BitLocker-encrypted drive when Windows can't open it automatically. It's written as eight blocks of six digits. Each block carries a built-in checksum, so the recovery screen flags a mistyped block and lets you fix it before you finish, per Microsoft's recovery process guide.

Every key has a partner: the key ID. It's a longer identifier shown on the recovery screen, and you only need its first 8 characters. One account can hold several keys (one per drive, one per PC, old ones from before a reinstall). The key ID tells you which of them fits this drive.

The naming trips people up. Microsoft's support pages call the 48 digits the recovery key. Its admin docs call the same number the recovery password and use "recovery key" for a .bek file saved on a USB drive. Same job, different storage. This guide says "recovery key" for the 48 digits, because that's what the screen asks for.

One more thing before you start hunting. Microsoft Support states it can't retrieve, provide or recreate a lost BitLocker recovery key. There's no master copy in Redmond. Without the key, the encrypted data stays scrambled, which is the whole point, and our guide to how decryption works explains why nobody can shortcut it.

Why Your PC Is Asking for It

BitLocker normally opens the drive silently at startup. The TPM, a security chip on the motherboard, holds measurements of the boot path: firmware, Secure Boot settings and the boot manager. If they match what it saw last time, the drive opens and you never see BitLocker at all. If something changed, BitLocker can't tell a firmware update from someone with a screwdriver, so it asks for the key. If Windows reports the chip as missing, start with our fix for TPM not detected.

Microsoft's BitLocker recovery overview lists the usual triggers:

• A BIOS or UEFI firmware update, or a change to Secure Boot settings
• The TPM turned off, cleared or failing its self-test
• A new boot order, such as a USB stick, DVD or PXE network boot ahead of the internal drive
• Docking or undocking a laptop, or moving the drive into another PC
• A replaced motherboard, which brings a new TPM with it
• Too many wrong PINs, or too many failed sign-ins where a lockout policy is set

Software can do it too. A Windows update can break the boot path on specific hardware, which is what happened in May 2025 (more on that below). And some fixes send a PC to Safe Mode or the recovery environment on purpose, where BitLocker may ask for the key before anything else loads. Our WinRE explainer covers what the recovery environment does.

"I never turned BitLocker on" is a common reply, and it's often true. Microsoft's device encryption page says that when you first sign in or set up a PC with a Microsoft account, or a work or school account, device encryption turns on and a recovery key is attached to that account. With a local account, it doesn't turn on automatically. So a laptop can be encrypted without anyone choosing it, and the key sits in whichever account set it up.

How to Find Your BitLocker Recovery Key

Start on the locked screen. Write down the first 8 characters of the key ID, then read the hint lines under it. They come from BitLocker's own record of where the key was saved: a Microsoft account, a printout or file, or your organization's help desk. Starting with Windows 11 version 24H2, the screen also shows a hint of which Microsoft account holds the key, according to Microsoft's notes on the preboot recovery screen.

Grab a second device (a phone works) and check the places below in order.

In Your Microsoft Account

For a personal PC signed in with a Microsoft account, open aka.ms/myrecoverykey on another device and sign in. You'll see each saved key with its key ID and device name. Find the matching ID and type the 48 digits into the locked PC.

If someone else set up the PC or turned BitLocker on, the key may be in their account, per Microsoft's find your key page. On a family laptop, that's whoever unboxed it.

Microsoft's own walkthrough shows the Microsoft account route step by step:

In a Work or School Account

If the PC was ever signed into an organization's account, the key may be in Microsoft Entra ID (formerly Azure AD). Open aka.ms/aadrecoverykey, sign in, select Devices, expand the device and choose View BitLocker Keys. Users on Intune-managed devices can also find keys in the Company Portal app. If neither shows a key, your organization may have switched off self-service, and the help desk reads it to you instead.

In Active Directory

On domain-joined PCs, the key lives in a child object of the computer object in Active Directory. Only Domain Admins can read it by default, unless access is delegated. The help desk uses the BitLocker Recovery Password Viewer, a free RSAT extension for Active Directory Users and Computers. It opens a BitLocker Recovery tab on the computer's properties, and its Find BitLocker Recovery Password search takes the first 8 characters of the key ID.

Active Directory keeps every recovery password a computer has ever had until the computer object is deleted. So an old machine may show several 48-digit numbers, and only one of them fits. The key ID settles it. If you're not sure which directory a device belongs to, our comparison of Entra ID and AD sorts it out.

In Intune or Configuration Manager

In the Microsoft Intune admin center, open Devices, select the device, then Recovery keys under Monitor, then Show Recovery Key. Each view writes an audit log entry under the KeyManagement category. Configuration Manager sites with tenant attach can show keys in Intune too, for admins with the Read BitLocker Recovery Key permission. Our Intune review covers where Intune fits next to an RMM.

On a Printout, in a File or on a USB Drive

When BitLocker is turned on by hand, Windows offers to print the key or save it as a text file. Look wherever the paperwork for the PC lives, and search USB drives and cloud storage for files with "BitLocker" in the name. If the key went to a USB flash drive, plug it into the locked PC and follow the prompts. A text file on that drive has to be read from another device.

With manage-bde, If Windows Still Starts

Sometimes the prompt is for a second data drive, or you're checking a PC before it ever locks. If Windows starts, open Command Prompt as administrator and run:

code
manage-bde -protectors -get C:

Find the Numerical Password entry. Its ID is the key ID, and the Password line is the 48-digit key. In PowerShell, (Get-BitLockerVolume -MountPoint C:).KeyProtector returns the same data. Copy it somewhere off the PC, because a key stored on the drive it protects is no use once that drive locks.

Without a Microsoft Account

A PC that only ever used a local account isn't encrypted automatically. So if it asks for a key, someone turned BitLocker on by hand, or an organization did it by policy. The key went wherever that person or policy chose.

Work through it in this order. If the PC ever belonged to a company or school, the key may be in that organization's Entra ID or Active Directory, and its help desk can look it up by key ID. If a relative, a shop or an old IT contractor set the PC up, the key may sit in their Microsoft account. Then check for a printout, a text file or a USB drive from the day it was turned on.

The PC maker can't help here. The key is created on the device when encryption turns on, so Dell, Lenovo and HP never see it. If the drive still opens, back the key up now with manage-bde, before you need it.

When the Key Doesn't Work or Isn't There

The Key Is Rejected

The screen checks each 6-digit block as you type and lets you fix a mistyped one. So if every block is accepted and the drive still won't open, you're holding the wrong key. Go back to the key ID. Accounts and directories keep old keys from earlier installs, and the one at the top of the list isn't always the one that fits.

If the right key fails on a drive that's physically damaged, that's a different job. Microsoft's BitLocker Repair tool (repair-bde) can rebuild critical parts of the volume and salvage data, but it needs the recovery key plus a key package. Key packages aren't saved by default; they're an Active Directory backup option or a manual export.

"No BitLocker Recovery Key Found for This Device"

That message, or the Microsoft account version ("You don't have any BitLocker recovery keys uploaded to your Microsoft account"), usually means one of four things. You're signed into a different account from the one that set up the PC. The key was never backed up, because Microsoft warns that backup to Entra ID or Active Directory doesn't always happen automatically unless policy requires it. The device was deleted from Entra ID, and deleting a device removes its BitLocker keys with it. Or the drive was never encrypted at all.

That last one catches people out. In this r/WindowsHelp thread, a user who built their own PC found no keys in their Microsoft account, and the replies point them to check whether encryption was ever on:

If Windows still starts, manage-bde -status settles it in one line: Protection On or Protection Off. Reused Autopilot devices add one more case. Microsoft notes that the new owner of a reused Autopilot device has to ask an administrator for the key.

Bypassing the BitLocker Recovery Screen

There's no bypass, by design. The data on the drive is encrypted with AES, and the recovery screen is the only door that takes a key you can type.

Sites promising a BitLocker key generator are scams, because a recovery key can't be calculated from anything on the locked PC. At best you lose the money; at worst you run malware on whatever PC you download it to. Turning BitLocker off isn't a way out either, because that requires the drive to be open first.

That leaves two legitimate paths. Find the key, using the places above. Or reset or reinstall Windows and accept that the data on the drive is gone, then restore from a backup if one exists. Our factory reset guide covers the reset from the recovery environment, including on a PC that won't boot.

For IT Teams: Retrieving Keys Safely

A recovery key opens every file on the drive. Treat a key request like a password reset with higher stakes, because whoever hears the 48 digits can read the laptop.

Who Can Read Keys

In Microsoft Entra ID, the device's owner can read their own keys by default. Admins need a role that carries the microsoft.directory/bitlockerKeys/key/read permission. The built-in ones are Cloud Device Administrator, Helpdesk Administrator, Intune Administrator, Security Administrator and Security Reader, per Microsoft's device identity docs.

You don't have to hand out a broad role to every technician. A custom role with just that permission, scoped to an Administrative Unit, lets a technician read keys for one office or one department only. That's role-based access control doing what it's for. An MSP may hold key access in several client tenants at once, so scope it per client and per technician, the same way you'd scope any admin role. In Active Directory, delegate read access on the recovery objects to a help desk group instead of handing out Domain Admin.

Verify the Caller

Microsoft's help desk template for key retrieval starts with "Verify the user's identity": the caller must be the authorized user of the device, and the device must belong to them. That step matters more than any other, because a key read over the phone is a target for voice phishing. Pressure and urgency are the usual tools of targeted phishing, and a locked laptop supplies both.

A routine that holds up under pressure:

1. Call back on the number in your directory, never the one the caller offers.
2. Confirm the device name, then have the caller read the key ID from the locked screen.
3. Check that device's primary user in Intune or registered owner in Entra ID.
4. Ask what happened before the lock, and note it in the ticket for root cause.
5. Read the key in blocks of six, then rotate it once the device is back up.

Audit Every Read

Every Show Recovery Key click in Entra ID or Intune, and every Microsoft Graph call that returns the key, writes an entry to the Entra audit log under KeyManagement. Review those entries the way you'd review admin sign-ins. Each key read should match a ticket. A read with no ticket is a question for whoever did it.

Decide on Self-Service

Users can read their own device keys at aka.ms/aadrecoverykey unless an admin turns on "Restrict users from recovering the BitLocker key(s) for their owned devices" in Entra device settings. Changing it takes at least the Privileged Role Administrator role, per Microsoft's page on default user permissions.

Both settings have a cost. Self-service means fewer tickets, help at 2 a.m., and a release valve when dozens of devices lock at once. Restricting it means every recovery passes through a person who can ask why, which is when root causes get found. Microsoft's own guidance leans cautious: allow self-service in trusted environments only. A middle path is to keep self-service on, limit key access to compliant devices with Conditional Access, and watch the audit log.

Rotate the Key After Use

Once a key has been read out, it's known to the caller, the technician and anyone within earshot. Rotation retires it. With automatic recovery password rotation turned on, Entra joined and hybrid joined devices generate a new recovery password after the old one is used, and store the new one in Entra ID. Microsoft's reasoning is simple: the same password shouldn't open the drive twice.

In Intune, rotation is the "Configure Recovery Password Rotation" setting in the BitLocker policy, also shown as client-driven recovery password rotation. Admins can also rotate a single device on demand with the BitLocker key rotation remote action, on Windows 10 version 1909 or later and Windows 11, per Microsoft's Intune BitLocker docs. That action needs the device to back up keys to Entra ID before encrypting, and an Intune role with the Rotate BitLockerKeys right. Configuration Manager can trigger rotation too.

Active Directory has no automatic rotation, so it's a manual job. Add a new recovery password with manage-bde -protectors -add C: -recoverypassword, back it up with manage-bde -protectors -adbackup C: -id {new-id}, then delete the old protector by its ID. The old password stays in AD's history, but it no longer opens the drive.

Find the Root Cause

Opening the drive closes the user's problem, not yours. Microsoft recommends finding out why recovery triggered before you hand over the key, and again if the same device keeps asking. Start with manage-bde -status to see the protection mode, then check the BitLocker events in Event Viewer for a boot file or platform change. Ask the user when the PC last started normally and what happened since.

When a device keeps coming back, look at the firmware first. Our explainer on what UEFI is covers the settings that change boot measurements.

Secure Boot has its own 2026 certificate changes, covered in our guide to checking Secure Boot.

Suspending BitLocker leaves the drive fully encrypted. It only stops the TPM check for a set number of restarts, then protection resumes and the key is resealed to the new measurements. If you don't pass a reboot count, Suspend-BitLocker uses one restart.

The last row of the table deserves a second read. Microsoft's guidance says that when the root cause can't be determined, the help desk should respond as it would to malware. A laptop that left the office and came back asking for its key with no explanation is a small incident response case.

When Many Devices Lock at Once

One locked laptop is a user. Twenty locked laptops of the same model, on the same morning, is an update.

On 13 May 2025, Microsoft shipped Windows 10 security update KB5058379. On devices with Intel Trusted Execution Technology turned on and 10th generation or later vPro processors, it could crash the LSASS process and drop the PC into Automatic Repair, asking for the BitLocker recovery key. Microsoft fixed it with out-of-band update KB5061768 on 19 May 2025, available only from the Microsoft Update Catalog.

The r/sysadmin thread from that week reads like a timeline of a bad Thursday. The poster saw half a dozen laptops lock, then more overseas overnight. Further down, one admin reported 37 of 121 almost identically configured Dell Latitudes affected:

The July 2024 CrowdStrike outage was bigger. Microsoft estimated the faulty update hit 8.5 million Windows devices, per its 20 July 2024 post.

The fix ran through Safe Mode, and Microsoft's own recovery steps warned that the PC may ask for the BitLocker recovery key on the way in, pointing users to aka.ms/aadrecoverykey on their phones.

When the tickets start stacking, check Microsoft's Windows release health page and your security vendors' status pages before treating each one as a user problem. If it's a known issue, pause the update ring in Intune or decline the update in WSUS so the next wave doesn't install it.

Then pull keys in bulk, with every read logged. This Graph PowerShell loop, built on Microsoft's own sample, returns keys for a list of device names:

powershell
Connect-MgGraph -Scopes 'BitlockerKey.Read.All','Device.Read.All' -NoWelcome
foreach ($name in Get-Content .\locked-devices.txt) {
  foreach ($dev in Get-MgDevice -Filter "displayName eq '$name'") {
    $keys = Get-MgInformationProtectionBitlockerRecoveryKey -Filter "deviceId eq '$($dev.DeviceId)'"
    foreach ($k in $keys) {
      $key = (Get-MgInformationProtectionBitlockerRecoveryKey -BitlockerRecoveryKeyId $k.Id -Select key).Key
      [pscustomobject]@{ Device = $name; KeyId = $k.Id; Key = $key }
    }
  }
}

Each call that selects the key property writes a KeyManagement audit entry, so the reads stay traceable. Duplicate device names return more than one device, so match the key ID before reading digits out. Keep the output on screen or in a protected location, and delete it after the event: a CSV of recovery keys opens every drive on it. If self-service is on, let users read their own keys and keep the help desk for the rest. Once devices are back, rotate every key that was read.

If updates fail instead of locking drives, our upcoming guide, How to Fix Windows Update Errors, covers the error codes.

How to Back Up a Recovery Key

On a personal PC, type BitLocker in Start, open Manage BitLocker and select Back up your recovery key. Windows offers four places: your Microsoft account, a USB flash drive, a file or a printout. Microsoft's backup guide adds one rule worth keeping: never store the USB drive or the printout with the computer, because a thief who takes both can read everything.

For company devices, the backup should happen before encryption starts, with policy refusing to encrypt until the key reaches Entra ID or Active Directory. Our BitLocker setup guide walks through that escrow setup and the Intune rollout. For a device that's already encrypted, manage-bde -protectors -aadbackup C: -id {key-id} pushes the existing key to Entra ID, and -adbackup does the same for Active Directory.

Then check that the backup landed. A device that shows encrypted in Windows but has no key in your directory is a future data-loss ticket. In OpenFrame, Mingo reads endpoint state via osquery, so a technician can see a device's encryption status before it turns into a recovery ticket. Flamingo builds OpenFrame, which competes with some of the management tools named in this guide.

The Short Version

A BitLocker recovery key is 48 digits matched to a drive by its key ID. For a single PC, check the Microsoft account, then the work account, then paper and USB drives. For a help desk, the job runs longer: scoped roles, a callback before any digits are read, an audit entry for every read, rotation after use, and a root cause in the ticket.

Macs have the same problem with a different key. Our guide to what FileVault is covers the Apple side.

For where disk encryption sits next to everything else on a laptop, read our endpoint security guide.

The 48 digits get the user back in. The rotation, the audit entry and the root cause are what close the ticket.