Moorfox
Where do I find a BitLocker recovery key?
Match the Recovery key ID shown on the blue screen (the first eight characters are enough) to the stored entry in Entra ID, the Microsoft account, or Active Directory. If the machine boots, run Get-BitLockerVolume -MountPoint 'C:' or manage-bde -protectors -get C: to read the key locally before hardware changes lock it out.
The ID is a label, not the key. If the key exists nowhere in these locations, the data is gone. BitLocker has no backdoor; wipe the drive and restore from backup.
Where do I find a BitLocker recovery key?
A client calls because their machine is stuck on a blue BitLocker recovery screen. The prompt asks for a 48-digit key in eight groups of six. The screen also displays a Recovery key ID. The ID is a label, not the key itself: it names which stored key the machine is requesting, and the first eight characters are all you need to match it against your records. A single machine can hold multiple keys due to rotation or multiple volumes. Match the ID on the screen to the right entry wherever your keys are stored.
Keys live in specific places depending on how the machine was enrolled. Work machines joined to Entra ID store keys there automatically if a disk-encryption policy is active. Personal machines or those using automatic device encryption back up to the Microsoft account of the first administrator. On-premises machines rely on Active Directory, but only if the correct Group Policy was enabled before encryption started. If the machine still boots, you can pull the key locally before hardware changes lock it out.
What causes the recovery screen?
The recovery screen appears when the system detects a change in the trusted boot environment. This is the design working, not a fault. Common triggers include firmware or BIOS updates, clearing or replacing the TPM, and motherboard swaps. Changes to Secure Boot settings, boot order, or the use of certain docks can also break the chain of trust. Moving the drive into another machine or entering too many wrong PINs will trigger the prompt.
When the hardware state changes, the TPM refuses to release the decryption key automatically. The system falls back to the recovery password to ensure data remains secure. You need to identify which change occurred and then locate the matching key in your backup systems.
How do I back up keys proactively?
Back up keys before a crisis occurs. For Entra-joined machines, keys escrow automatically if Intune policies are applied. You can also force a backup from an elevated PowerShell session:
$vol = Get-BitLockerVolume -MountPoint 'C:'
$id = ($vol.KeyProtector | Where-Object KeyProtectorType -eq 'RecoveryPassword').KeyProtectorId
BackupToAAD-BitLockerKeyProtector -MountPoint 'C:' -KeyProtectorId $idFor on-premises Active Directory environments, use the command line. Run manage-bde -protectors -adbackup C: -id "{the protector ID}" in an elevated command prompt. This writes the key to the computer object in AD. You must have the "BitLocker Recovery Password Viewer" feature installed in RSAT to view these keys in ADUC. Always back up keys while the machine is healthy. Once the machine is locked, it cannot help you back up the key.
What if the key exists nowhere?
If you cannot find the key in Entra ID, Microsoft Account, Active Directory, or locally on the machine, the data is gone. BitLocker is designed to make data unrecoverable without the key. There is no Microsoft support backdoor. No third-party tool can recover the key. Wipe the drive.
Reinstall Windows and restore data from the most recent backup. Use this incident to fix the escrow gap. Ensure all machines in the fleet have keys backed up to a central location. Check for automatic device encryption on personal machines and verify which Microsoft account received the backup.
Moorfox's remote terminal runs as SYSTEM, so the Get-BitLockerVolume and manage-bde commands above run on a working machine without a desktop session, and the same escrow script can be saved and run across a whole group. Pair it with a scheduled BitLocker status check so machines that are encrypted but not escrowed show up as a list, not as a locked laptop.
Where do I look for the key?
Search Entra ID, Active Directory, or the Microsoft Account for the entry whose ID matches the eight characters on the screen. In Entra ID, navigate to entra.microsoft.com > Devices > All devices > pick the device > BitLocker keys. In AD, use ADUC > Action > Find BitLocker recovery password to search the domain by key ID.
For personal machines, visit aka.ms/myrecoverykey. This lands on account.microsoft.com > Devices > recovery keys. Look for the entry that matches the key ID. The key was backed up to whichever Microsoft account signed in as the first administrator. On a home-bought laptop, this is often the owner's personal account, not the business one. Match the ID exactly to find the correct 48-digit key.
Two more places worth a look: the machine itself, while it still boots (manage-bde -protectors -get C: from an elevated prompt), and paper. When someone enables BitLocker by hand, Windows offers to print the key or save it to a .txt file or USB stick, so search the client's document store for files named "BitLocker recovery key".
Why does the key I found not work?
The key you found may not work if it is the wrong entry. Match the full key ID, not just part of it. The key may have been rotated after your copy was made. BitLocker allows multiple keys; the machine requests the current active one. A typo is also common: the key is 48 digits, no letters.
If the key is correct but still fails, the machine may be requesting a different key due to a recent change. Check if a firmware update or TPM clear occurred after the key was backed up. And in some cases the key was generated but never escrowed anywhere, which puts you in the section above: if no store has an entry matching the ID on the screen, treat it as a lost key.
Frequently asked questions
Can I find the BitLocker key using only the 8-character key ID?
No, the ID is a label, not the key itself. You must search Entra ID, Active Directory, or the Microsoft Account for the entry whose ID matches the eight characters on the screen. In Entra ID, go to Devices > All devices > BitLocker keys. In AD, use ADUC > Action > Find BitLocker recovery password.
Why does the BitLocker key I found not work?
You may have selected the wrong entry; match the full key ID exactly. The key might have been rotated after your copy was made, or there may be a typo. The key is 48 digits with no letters. If the ID matches but it fails, check if a firmware update or TPM clear occurred after the key was backed up.
Does reinstalling Windows get around BitLocker encryption?
No, the disk stays unreadable without the recovery key. Reinstalling Windows just abandons the data on the encrypted volume. You must locate the 48-digit key from your backup systems to decrypt the drive before or during the OS installation.
Where did the BitLocker key go on a machine I did not set up?
Automatic Device Encryption backed it up to the Microsoft account of the first administrator. On a home-bought laptop, this is often the owner's personal account, not the business one. Visit aka.ms/myrecoverykey to check the personal account for the recovery keys.
Can Microsoft give me the BitLocker key if I prove ownership?
No, there is no Microsoft support backdoor to recover lost keys. BitLocker is designed to make data unrecoverable without the key. If the key is not in Entra ID, AD, or the Microsoft Account, the data is gone and you must wipe and reinstall.