How to Fix Windows Asking for BitLocker Recovery Key at Startup
The BitLocker recovery screen is a blue screen that appears before Windows loads, showing a recovery key ID and requesting a 48-digit recovery key. This is BitLocker’s security mechanism – it detected something unusual and wants proof that the person accessing the drive is authorised. This guide covers finding your recovery key, entering it and preventing the issue from recurring.
Seeing the BitLocker recovery screen does not mean you have been hacked. It is a security feature that triggers when the PC detects hardware changes, firmware updates or other events that BitLocker treats as potential tampering.
Step 1: Find the Recovery Key
The BitLocker recovery screen shows a Recovery Key ID (a short identifier like 3F2A1B4C). Use this ID to find the correct key from your saved locations.
Check Microsoft Account (Most Common)
On another device (phone or another PC), open a browser and go to: account.microsoft.com/devices/recoverykey
Sign in with the same Microsoft account used on the locked PC. If the recovery key was saved to the Microsoft account during BitLocker setup, it will appear here with the device name and Key ID. Match the Key ID shown on the BitLocker screen to the one on this page.
Check Azure AD (Work Devices)
For work devices managed by an organisation, the IT admin can find the key in:
- Microsoft Intune admin centre: endpoint.microsoft.com > Devices > select device > Recovery keys
- Azure AD: aad.portal.azure.com > Devices > select device > BitLocker keys
- Microsoft 365 admin centre (if using Business Premium): active devices list
Contact your IT department or managed IT provider to retrieve the key.
Check Other Saved Locations
If the recovery key was not saved to a Microsoft account:
- USB drive: Look for a text file named something like BitLocker Recovery Key 3F2A1B4C.txt on any USB drives saved during setup
- Network drive or SharePoint: Search for BitLocker Recovery Key in your shared drives
- Printed copy: Check physical files – the key is a long number on a printed page
Step 2: Enter the Recovery Key
Type the 48-Digit Key
On the blue BitLocker recovery screen, the cursor is already active in the recovery key input field. Type the 48-digit recovery key carefully. The key is in the format: 123456-234567-345678-456789-567890-678901-789012-890123 (8 groups of 6 digits separated by hyphens).
You do not need to type the hyphens – type just the numbers and BitLocker adds the formatting automatically. Press Enter when complete.
If the key is accepted, Windows will proceed to boot normally. If rejected, verify you have the correct key (matching Key IDs) and that you typed it correctly.
Step 3: Investigate and Prevent Recurrence
Identify What Triggered Recovery Mode
After booting into Windows, open Command Prompt as Administrator and run:
manage-bde -status C:
This shows the current BitLocker status. Open Windows Event Viewer (search in Start menu). Navigate to Windows Logs > System. Look for events around the time BitLocker triggered – look for events related to TPM, Secure Boot or BIOS changes.
Common causes and fixes:
- BIOS/UEFI firmware update: Normal one-time occurrence. No action needed – subsequent boots will be normal.
- Secure Boot disabled in BIOS: Re-enable Secure Boot in BIOS/UEFI settings.
- TPM not functioning: Check Device Manager for TPM errors. Run tpm.msc and check TPM status.
- Hardware change (new RAM, SSD): One-time occurrence after new hardware. Normal after first boot.
Suspend BitLocker Before Planned Maintenance
Before any planned maintenance that might trigger BitLocker recovery (BIOS update, hardware change), suspend BitLocker first. Open Command Prompt as Administrator and run:
manage-bde -protectors -disable C:
Perform the maintenance work. After completing maintenance and booting Windows successfully, re-enable BitLocker protection:
manage-bde -protectors -enable C:
Suspending BitLocker allows Windows to boot without requiring the recovery key, even through events that would normally trigger recovery mode.
Need IT Help in Malaysia?
Cybergate provides managed IT support for businesses across Malaysia. Our team is available Monday to Saturday, 9am to 6pm.