Find Your BitLocker Recovery Key: All the Ways

You need the BitLocker key exactly when nobody knows where it is.

A blue screen that says: “Enter the recovery key for this drive.” With a key ID and a field for 48 digits. In our support cases, this is one of the situations in which users are most nervous, often in the morning after an overnight update. See also External monitor: no signal after BIOS update.

The good news: on company devices the key is almost always stored somewhere. Here are all the ways to find it.

First: note the key ID

The recovery screen shows a key ID (a long string of characters, often with hyphens). Write down at least the first eight characters or take a photo of the screen. That lets you find the right key if several are stored.

Way 1: Retrieve it yourself (company device with Entra ID)

Many companies allow users to retrieve the key for their own devices themselves.

1. On another device (phone, a colleague's PC), open myaccount.microsoft.com and sign in with your work account.
2. Open Devices.
3. Select the affected device › View BitLocker keys.
4. Enter the key with the matching ID.

If the option is not visible, the organization has disabled self-service retrieval, and IT can help.

Way 2: IT retrieves the key

• Entra admin center: Devices › All devices › select the device › BitLocker keys.
• Intune admin center: Devices › select the device › Recovery keys.
• Active Directory (domain without cloud): In Active Directory Users and Computers, on the computer object, the BitLocker Recovery tab, provided the keys are backed up to AD through policy.

IT should verify the caller's identity before handing out the key, since the key unlocks all the data on the device.

Way 3: Microsoft account (devices set up privately)

If the device was set up with a personal Microsoft account, the key is often stored there: open aka.ms/myrecoverykey and sign in with that account.

Way 4: Printout, file, USB stick

With manual activation, Windows offers to print the key, save it as a file or store it on a USB stick. In a company that should be the exception, but in small offices the printout is sometimes found in the “IT” folder.

Why does Windows ask for the key at all?

BitLocker detected a change at startup that an attacker could exploit. Common triggers:

• BIOS/firmware update – overnight update from the manufacturer's tool
• Secure Boot / TPM – settings changed in the BIOS, TPM reset
• Boot order – boot from USB or network, docking station with a stick connected
• Hardware swap – motherboard, SSD, sometimes docking station
• Multiple wrong PINs – with BitLocker with a startup PIN

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial

Prevention: so it doesn't happen again

• Back up keys centrally: through Intune policy or Group Policy to Entra ID or Active Directory, and check that a key exists for every device.
• Suspend BitLocker before BIOS updates (PowerShell as administrator):

Suspend-BitLocker -MountPoint "C:" -RebootCount 1

• Control updates centrally instead of through manufacturer tools on each device. See Patch management for small businesses.
• Check the status:

Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, ProtectionStatus, KeyProtector

And if the key is really gone?

Then the data on the drive is lost. That is the point of encryption. All that remains is to reinstall Windows. Data in OneDrive, SharePoint or a backup is not affected. That is why important files don't belong only on the local drive. See Microsoft 365 backup and Company laptop lost or stolen.

How does SuperSupport help with BitLocker?

No agent can help on the locked device itself, because the computer doesn't start. But the user can report from another company device in the chat that the recovery key is being requested, and the case goes to IT with the device and key ID. As a preventive measure, the SuperSupport agent checks on Windows devices whether BitLocker is active and protectors are set up. What this looks like for internal IT teams and MSPs is explained on the respective pages.

Frequently asked questions

Where do I find my BitLocker recovery key?

On company devices, usually in Entra ID or Intune. Users can often retrieve it themselves for their devices at myaccount.microsoft.com; otherwise IT can help. On devices set up privately, it is in the Microsoft account at aka.ms/myrecoverykey. In domains without cloud, often in Active Directory. It may also have been printed, saved as a file or stored on a USB stick.

Why does Windows ask for the BitLocker recovery key?

Because BitLocker detected a change at startup that could indicate a tampering attempt, for example a BIOS or firmware update, changed Secure Boot or TPM settings, a new boot order, a docking station at startup or a hardware swap.

How do I tell which key is the right one?

The recovery screen shows a key ID. It must match the ID of the stored key; comparing the first eight characters is usually enough. The key itself consists of 48 digits in eight blocks.

What happens if the recovery key can't be found?

Then the data on the drive is no longer accessible, which is exactly what the encryption is for. All that remains is to reinstall Windows. Data stored in OneDrive, SharePoint or a backup is not affected.

How do I prevent the prompt during a BIOS update?

Suspend BitLocker for one restart before the update, for example with Suspend-BitLocker -MountPoint C: -RebootCount 1 in an elevated PowerShell. Many manufacturer update tools do this automatically, but not all of them.

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial