How to find your BitLocker recovery key, and back it up before you need it

You want your BitLocker recovery key. Maybe a laptop has just booted to a recovery screen asking for a 48-digit key and you do not have it. Maybe nothing is wrong yet and you want to know, today, where the key is and that it can be found by someone other than the person who set the machine up. Both cases are covered here.

Applies to: Windows 10 and Windows 11 devices encrypted with BitLocker, whether the key is kept in a Microsoft account, Microsoft Entra ID, Active Directory Domain Services (AD DS), or on paper. Commands run in an elevated Command Prompt or PowerShell. The admin steps need the roles named below.

Treat the recovery key like a password. Anyone who holds it can unlock the drive and read everything on it. Do not store it on the drive it protects, and do not keep a printout or USB stick in the same bag as the laptop. Microsoft says its own support cannot retrieve, provide or recreate a lost recovery key. If the key cannot be found anywhere and the cause of the recovery cannot be undone, the only route Microsoft documents is resetting the device, which removes all the files on it.

What is going on

BitLocker normally unlocks the drive silently at startup, using the TPM (and a PIN, if one is set). If something it checks has changed, it refuses and asks for the recovery key instead: a 48-digit number. The recovery screen also shows a Key ID. A device can have more than one recovery key, so the Key ID is how you pick the right one.

Microsoft lists many things that can send a device into recovery. The ones that catch administrators out are:

• A firmware change. Upgrading the BIOS or UEFI firmware changes early startup components that BitLocker measures. Microsoft says to suspend BitLocker before a planned firmware upgrade, then resume it afterwards.
• A Secure Boot change. If the TPM protector uses PCR 7, BitLocker expects Secure Boot to be on and its configuration to be unchanged. Turning Secure Boot off, or changing its configuration, shows the codes E_FVE_SECUREBOOT_DISABLED or E_FVE_SECUREBOOT_CHANGED. A firmware update applied without updating the TPM protector shows E_FVE_PCR_MISMATCH.
• A TPM change. Turning off, disabling or clearing the TPM, hiding it from the operating system, or replacing the motherboard.
• Boot changes. Changes to the boot manager or the NTFS partition table, booting from a CD, DVD or PXE ahead of the disk, or moving the drive to another computer.
• Too many failed attempts. Entering the wrong PIN too many times, or exceeding the device lockout threshold when that policy is configured.

On Windows 11, version 24H2 and later, pressing Alt on the recovery screen shows an additional information screen with an error category and code. Write those down as well: they tell you why recovery started.

Before you start / check first

1. Note the Key ID on the recovery screen

Microsoft Support asks you to take note of the first 8 digits of the recovery key ID. That is enough to match the right key if the device has more than one. Photograph the screen with a phone if you cannot copy it down.

2. Read the hint on the screen

Windows shows a hint about where the key was saved. The preboot recovery screen hints at a Microsoft account (Windows 11 24H2 and later also hint which account), at Microsoft Entra ID, or at a printout or text file. There is no specific hint for keys stored in on-premises AD DS: you see your organisation custom message if one is configured, or the generic text to contact the help desk. An organisation can also put its own message and URL on this screen.

3. Work out whose key store to check

Where the key can be	Typical device	How to get to it
Microsoft account	Personal device signed in with a Microsoft account. Microsoft says this is the default recommended store for devices that are not Entra joined or AD joined.	https://aka.ms/myrecoverykey (leads to account.microsoft.com/devices/recoverykey), from another device.
Work or school account (Microsoft Entra ID)	Entra joined or Entra hybrid joined device, or one that was ever signed in to an organisation.	https://aka.ms/aadrecoverykey or https://myaccount.microsoft.com, Devices tab, View BitLocker Keys. Admins: Entra admin center or Intune.
Active Directory Domain Services	Domain-joined device where policy backs up to AD DS.	Active Directory Users and Computers, by an administrator or delegated help desk.
Printout, text file or USB stick	Any device where someone chose to save it that way. Microsoft recommends the account or directory backups instead.	Wherever it was filed. A text file saved to a USB stick has to be read on a different device.

If the machine was set up, or BitLocker was turned on, by somebody else, the key may be in that person’s account. Check any account that was ever used on the device.

Why this works

A recovery password is generated by BitLocker and is unique to the volume it protects. Whether Windows can copy it somewhere you can reach depends on policy and on how the device is joined. Where backup is configured, the key is copied to Microsoft Entra ID, AD DS or a Microsoft account, with its Key ID, so you can find it by device or by ID. Where it was never copied, the only copies are the ones someone made by hand. That is why the backup step below matters more than the lookup step.

The fix

A. You are locked out now and the key is yours to retrieve

From another device with a browser:

1. Personal device: go to https://aka.ms/myrecoverykey, sign in with the Microsoft account, and find the Key ID you wrote down.
2. Work or school device: go to https://aka.ms/aadrecoverykey, sign in with the work or school account, select Devices, expand the device, select View BitLocker Keys, and find the Key ID.
3. Enter the 48 digits on the recovery screen. The recovery screen checks each 6-digit block as you type and lets you correct a mistyped block.

Microsoft Entra ID can block self-service. An administrator can switch on the setting that restricts users from recovering BitLocker keys for their own devices. If your own account shows nothing, ask your help desk before assuming the key was never saved.

B. You are the administrator or help desk

Verify who is asking before you read out a key. Microsoft recommends confirming the person is the authorised user of that device, recording the device name and the Key ID, and finding out why recovery happened before handing the key over. Reading a key from Entra ID creates an audit log entry.

Microsoft Entra ID. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com), go to Entra ID > Devices, open the device, and select Show Recovery Key. [UNCONFIRMED: the exact label of the BitLocker keys item inside the device page. Microsoft Learn names the Show Recovery Key button and a BitLocker keys link on the Devices overview page, but not the full menu path.] You need to be the device owner or hold a role such as Cloud Device Administrator, Helpdesk Administrator, Intune Administrator, Security Administrator or Security Reader. Show Recovery Key writes a KeyManagement audit log entry.

Microsoft Intune. For Intune-managed devices, in the Intune admin center go to Devices > All devices, select the device, and under Monitor select Recovery keys, then Show Recovery Key. It lists the BitLocker Key ID, the recovery key and the drive type. It reads the same Entra ID store, so the Entra permission microsoft.directory/bitlockerKeys/key/read is required.

Active Directory. Recovery information is stored as child objects of the computer object. By default only Domain Admins can read it, though access can be delegated. With the BitLocker Recovery Password Viewer (part of RSAT, an extension to Active Directory Users and Computers):

1. To look up a computer: open Active Directory Users and Computers, right-click the computer object, select Properties, then the BitLocker Recovery tab.
2. To search by ID: right-click the domain container, select Find BitLocker Recovery Password, type the first eight characters of the Password ID, and select Search.

Active Directory keeps every recovery password a computer has had, so there can be several objects under one computer. Match on the ID, not on the newest one. To read them from PowerShell (needs the Active Directory module and the same read rights):

Get-ADObject -Filter "objectClass -eq 'msFVE-RecoveryInformation'" -SearchBase (Get-ADComputer "PC-NAME").DistinguishedName -Properties "msFVE-RecoveryPassword", whenCreated | Format-List Name, whenCreated, msFVE-RecoveryPassword

The class is msFVE-RecoveryInformation and the 48-digit password is the msFVE-RecoveryPassword attribute, both documented by Microsoft. The object name contains the creation date and the recovery GUID, which is the Key ID the recovery screen shows. [UNCONFIRMED: Microsoft Learn does not publish this exact Get-ADObject command. It is assembled from the documented class and attribute names and the Get-ADObject cmdlet, so test it against one computer first.]

C. Back the key up from the running machine, before you need it

Do this on a machine that is working today. Open an elevated Command Prompt or PowerShell.

1. See what protectors exist and note the recovery password ID:

manage-bde -protectors -get C:

# PowerShell equivalent
(Get-BitLockerVolume -MountPoint C).KeyProtector

Look for the Numerical Password protector (RecoveryPassword in PowerShell). Its ID in braces is the Key ID. If there is no recovery password protector at all, add one first:

manage-bde -protectors -add -recoverypassword C:

# PowerShell equivalent
Add-BitLockerKeyProtector -MountPoint C -RecoveryPasswordProtector

2. Save a copy with the Control Panel applet (a good option for a personal machine). Select Start, type BitLocker, open Manage BitLocker, find the volume, and select Back up your recovery key. The choices Microsoft documents are your Microsoft account or Microsoft Entra ID account (where applicable), a USB flash drive, a file, or a printout. A file must go somewhere that is not on the device itself, such as a network folder.

3. Back up to Microsoft Entra ID (Entra joined or hybrid joined devices). Replace {ID} with the recovery password ID from step 1, keeping the braces:

manage-bde -protectors -aadbackup C: -id {ID}

# PowerShell equivalent
BackupToAAD-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId "{ID}"

4. Back up to Active Directory (domain-joined devices):

manage-bde -protectors -adbackup C: -id {ID}

# PowerShell equivalent
Backup-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId "{ID}"

You may not need steps 3 and 4. Microsoft notes they are not required where the policy Choose how BitLocker-protected operating system drives can be recovered is set to require backup to AD DS. Microsoft recommends configuring this by policy so backup is automatic, using the option to not enable BitLocker until recovery information is stored. There is no automatic backup for removable drives: use the commands above.

Only if you are rotating a key that has already been used. Microsoft recommends invalidating a recovery password after it has been used. Its documented method removes the existing recovery password protectors, adds a new one and backs the new one up: manage-bde -protectors -delete C: -type RecoveryPassword, then manage-bde -protectors -add C: -RecoveryPassword. For a moment the volume has no recovery password, and every printout and file you made earlier stops working. Do not run the delete until you are ready to back up the new key straight away. On Entra joined devices, an Intune BitLocker key rotation action does this remotely when rotation is enabled by policy.

Verification

1. Run manage-bde -protectors -get C: and note the ID of the Numerical Password.
2. Look that ID up where it should now be: https://aka.ms/myrecoverykey or the Entra admin center for Entra ID, Active Directory Users and Computers for AD DS. The same ID must be listed.
3. Ask someone other than the person who set the device up to find it. If only one person can, the backup is not finished.
4. If you keep a printout or file as well, check it is not stored on the encrypted drive or in the laptop bag.

Notes

• Planned firmware or BIOS work: suspend BitLocker first so the device does not go into recovery. manage-bde -protectors -disable C: suspends protection, and by default it resumes at the next restart. Use -rebootcount N (0 to 15) if the update needs several restarts, and note that 0 suspends until you resume it yourself. manage-bde -protectors -enable C: resumes. While suspended the encryption key is stored unprotected on the drive, so resume as soon as the work is done.
• After a change that caused recovery: once the drive is unlocked with the recovery password, Microsoft says the TPM measurements are reset to match the current configuration. If recovery repeats on every start, find the cause. Suspending and resuming BitLocker refreshes the validation profile.
• Deleting a device in Entra ID deletes its BitLocker keys. Microsoft Entra ID also stores a maximum of 200 recovery keys per device, and Intune notes that silent encryption fails once that limit is reached.
• Autopilot devices that change owner: the new owner has to contact an administrator for the key.
• Data Recovery Agents (a certificate-based recovery for domain devices) and key packages are separate recovery options, set up in advance. They are not covered here.
• Vendor documents used: BitLocker recovery overview, https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview; BitLocker recovery process, https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/recovery-process; BitLocker preboot recovery screen, https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/preboot-recovery-screen; BitLocker operations guide, https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/operations-guide; manage-bde protectors, https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/manage-bde-protectors; Backup-BitLockerKeyProtector, https://learn.microsoft.com/en-us/powershell/module/bitlocker/backup-bitlockerkeyprotector; Manage device identities in the Microsoft Entra admin center, https://learn.microsoft.com/en-us/entra/identity/devices/manage-device-identities; Encrypt Windows devices with BitLocker using Intune, https://learn.microsoft.com/en-us/mem/intune/protect/encrypt-devices; ms-FVE-RecoveryInformation class, https://learn.microsoft.com/en-us/windows/win32/adschema/c-msfve-recoveryinformation; Find your BitLocker recovery key (Microsoft Support), https://support.microsoft.com/windows/find-your-bitlocker-recovery-key-6b71ad27-0b89-ea08-f143-056f5ab347d6.

Not sure where your key is stored? Describe the device (personal or work, how it is joined) in The Patch Panel and we will help you work out where to look. Never post a recovery key itself. The best answer earns points on Top of the Stack.