BitLocker Practical Guide — How to Find the Recovery Key and Manage It Safely

“I updated the BIOS, and a blue screen asked me for a 48-digit number.” “Device Encryption was on even though I do not remember turning it on.” When BitLocker gives you trouble, what to do first depends on whether Windows is booting right now.

If the machine is stuck at the recovery screen, look for the key that matches the recovery key ID on the screen before changing settings or resetting the PC. If it still boots, do not just look at the encryption switch: check the protection status and where the recovery key is stored. Separating these two makes the work ahead easier to see.¹²

This article is a practical guide for people using personal PCs, IT staff at small and midsize businesses, and developers who manage business applications and equipment PCs. The first half covers recovery and status checks; the second half covers rollout, maintenance, and disposal. The management commands are examples run with administrator rights on a running Windows system, not steps to run straight from the recovery screen. The technical information was checked against Microsoft’s published documentation as of September 8, 2026.

In the diagram a solid line marks a relation that always holds and a dashed line marks a conditional one (the conditions are given per relation on the detail page). The full list of relations (48 in total, with evidence and certainty) and the definitions of the main concepts are collected on the knowledge map detail page (in Japanese). Data: JSON-LD / Turtle

1. If the Recovery Screen Appears, Look for the Key Before Resetting

1.1. The 48 Digits You Type In and the ID You Use to Find Them Are Different Things

What consumer-facing screens call the “BitLocker recovery key” is normally a recovery password made up of 48 digits. It is not your Windows sign-in password and not your Windows Hello PIN. The recovery key ID shown on the screen, by contrast, is an identifier for picking out a stored key; it is not the unlocking secret itself.¹

Start by writing down the first 8 characters of the key ID. They are not necessarily digits, so do not think of it as an “8-digit PIN”. Open the storage location on another PC or a smartphone, take the 48-digit recovery key from the entry whose ID matches, and type it into the recovery screen. Old records for the same PC name may still be there, so it is important not to pick an entry by PC name alone. On Windows 11 version 24H2 and later, the recovery screen may also show a hint about which Microsoft account holds the key.¹

flowchart TB
        accTitle: Roles of the recovery key ID and the recovery key
        accDescr: Shows how to match the on-screen ID against an entry at the storage location and then type in the corresponding 48 digits.
        A["Write down the key ID on the recovery screen"] --> B["Open the storage location on another device"]
        B --> C["Find the record whose ID matches"]
        C --> D["Type in the matching 48 digits"]

Figure 1: The ID is for finding the key, and the 48 digits are for unlocking the drive.

1.2. Do Not Assume Where the Key Is Stored, Go Back to When It Was Set Up

These are the typical storage locations, not four mutually exclusive choices. The same key can be kept in more than one place. You cannot conclude that “we use Microsoft 365, so the company side must have it” or that “I am on a local account now, so it cannot be in a Microsoft account”. Check who set the PC up, whether it is joined to an organization, the policy in force when it was enabled, and any backup made later.¹³⁴

Technical documentation distinguishes the 48-digit recovery password from the recovery key in .bek format that is saved to a USB drive or similar. This article follows the consumer-facing naming and calls the former the “recovery key”, but a .bek file is not something you type in as 48 digits. Use the recovery procedure that matches your configuration.³

1.3. Even When You Cannot Find It, Leave Operations That Erase Data for Last

While the key is still missing, avoid clearing the TPM, changing Secure Boot settings, or resetting the PC. Piling on more changes that can themselves trigger a recovery prompt will not make an unsaved recovery key appear. On an organization-managed PC, check with the administrator and find out whether another legitimate recovery method exists, such as a data recovery agent configured in advance.³⁵

If every valid unlocking method has been lost, not even Microsoft Support can retrieve or re-create the recovery key. At that point, check whether you can restore from a data backup kept elsewhere. Resetting or reinstalling to make the PC usable again is a different thing from getting the original encrypted data back. Understand that a reset loses local files before you decide.¹

flowchart TB
        accTitle: Deciding what to do when the recovery key cannot be found
        accDescr: Check with the administrator and for another recovery method, then decide about the data backup and reuse of the PC separately.
        A["Not in the usual storage locations"] --> B["Ask the administrator and the person who set it up"]
        B --> C{"Is there a valid unlocking method"}
        C -- "Yes" --> D["Recover through the proper procedure"]
        C -- "No" --> E["Check the data backup"]
        E --> F["Confirm what is lost and decide about reuse"]

Figure 2: It matters not to treat finding the key, restoring the data, and resetting the PC as a single operation.

2. What BitLocker Protects and What It Does Not

BitLocker is the volume-level encryption feature of Windows. Its main purpose is to lower the risk that stored data is read offline after loss, theft, or improper disposal. Even if the SSD is removed and connected to another PC, the encrypted contents cannot be read as ordinary files without a valid unlocking method. Note that describing it as covering “the whole drive” does not mean that absolutely everything, down to boot partitions such as the EFI partition, is encrypted.⁶

While Windows is running and the drive is unlocked, on the other hand, any app with the right permissions can read and write files. BitLocker on its own does not stop malware, ransomware, or exfiltration from a machine that is already signed in, and it is no substitute for backing up data. When you evaluate encryption, think separately about which state of the device you are protecting, and from whom.⁷

flowchart TB
        accTitle: Where BitLocker protects you
        accDescr: Shows that protecting an offline drive and app access after boot are separate layers.
        A["Stored business data"] --> B["Offline drive"]
        A --> C["Windows already booted"]
        B --> D["Contents protected by BitLocker"]
        C --> E["Permissions and app-side measures also needed"]

Figure 3: Encrypting data at rest and controlling access after boot play different roles.

The TPM Is Not a Device That Encrypts Data, It Is a Mechanism That Protects Keys

In a typical configuration, BitLocker uses the TPM to protect the key. Measurements of the boot components are recorded in the TPM’s PCRs, and when the configured validation conditions are met, the key needed for a normal boot becomes available. The TPM itself does not encrypt all the data on the SSD, and it does not reject every BIOS change across the board.⁶⁸

flowchart TB
        accTitle: Normal boot and recovery with a TPM-based BitLocker configuration
        accDescr: When the boot measurements meet the validation conditions the volume unlocks normally, and when they do not a recovery method is required.
        A["Measure the boot environment and record it in the PCRs"] --> B{"Are the configured validation conditions met"}
        B -- "Met" --> C["Unlock normally using the TPM"]
        B -- "Not met" --> D["Unlocking with a recovery method required"]

Figure 4: Whether a change to the boot environment leads to a recovery prompt also depends on which conditions are validated.

A BIOS/UEFI update, disabling or clearing the TPM, a change to Secure Boot settings, replacing the motherboard, moving the drive to another machine, and similar actions can all become the trigger for a recovery prompt. Because they also occur during legitimate maintenance, the mere fact that the recovery screen appeared does not prove that “we were attacked” or that “the hardware failed”. Conversely, if it keeps happening for no apparent reason, you need to look into the update history, configuration changes, and the state of the hardware.³

There are also configurations that combine the TPM with a startup PIN, and configurations that use a startup key. Encrypting the OS drive on a machine with no TPM is possible too, under a supported edition and the right policy. However, the password method for an OS drive with no TPM has problems standing up to brute force and is disabled by default. Do not confuse it with password protection for a fixed data drive. The TPM is covered in detail in “What Is the TPM in Windows?”.⁶

3. The Difference Between Home and Pro, and Automatic Encryption in Windows 11

3.1. “Device Encryption” Also Uses BitLocker Technology

“BitLocker Drive Encryption” and “Device Encryption” are not unrelated encryption products. The latter uses BitLocker technology and makes it easier to turn encryption on for PCs that qualify. The settings screens and the range of what can be managed differ.⁹

Device Encryption covers the OS drive and internal fixed drives; removable drives such as USB flash drives are out of scope. If you want fine-grained management of pre-boot authentication and policy on company PCs, check the required edition and the requirements of the management service first.⁶⁹

3.2. What Changed in 24H2 Is the Set of Eligible Devices, Not Blanket Activation on Every PC

In Windows 11 version 24H2, the conditions relating to HSTI/Modern Standby and some DMA conditions were dropped from the requirements for automatic device encryption. As a result, the range of qualifying hardware has widened. Even so, conditions such as the TPM and UEFI Secure Boot, the setup method, and configuration by the organization or the manufacturer all still matter. It does not mean that “every PC updated to 24H2 is necessarily encrypted and protected on the spot”. This relaxation of requirements also does not apply to Windows IoT editions.⁸

With automatic activation after a clean install, initializing the encryption and enabling protection are separate stages. In the initial state a clear key is present, and although the drive is encrypted, protection is not yet enabled. Once the conditions for the applicable path are met — backup to a Microsoft account, to Entra ID, or to AD DS with a recovery policy configured — TPM-based protection is enabled and the clear key is removed.⁶

flowchart TB
        accTitle: Starting automatic encryption and enabling protection
        accDescr: On a qualifying PC, automatic encryption runs from an initial state with a clear key through saving the recovery information to protection being enabled.
        A["PC that meets the automatic encryption conditions"] --> B["Initialize the encryption"]
        B --> C["Clear key present, protection not yet enabled"]
        C --> D["Save the recovery information through the applicable path"]
        D --> E["Enable TPM protection"]
        E --> F["Remove the clear key"]

Figure 5: Encryption making progress and the drive ending up protected from third parties are not the same thing.

The statement that protection is not enabled with a local account alone is about this automatic activation flow. It does not mean that “you cannot encrypt with a local account” when an administrator configures BitLocker manually on Pro or a similar edition. A PC may also have been enabled in the past and then switched to a local account, so do not infer the protection status from the current account name; check it with the commands in the next section.⁶²

If you cannot find the setting, start msinfo32.exe as an administrator and look at the “Device Encryption Support” information. Note that this display exists to tell you whether the machine meets the requirements. Read it separately from a display that tells you whether the drive is protected right now.⁹

4. When Checking Status, Separate Encryption Percentage, Protection Status, and Lock Status

4.1. Start With Commands That Do Not Print Secrets

With Windows able to boot, open a terminal as an administrator. To begin with, the following status check is enough. Adjust C: to the OS drive you are targeting.¹⁰

manage-bde -status C:

Where the BitLocker PowerShell module is available, you can display only the fields you need. This does not print the value of the recovery password.¹¹

Get-BitLockerVolume -MountPoint 'C:' -ErrorAction Stop |
    Select-Object MountPoint, VolumeStatus, EncryptionPercentage,
        ProtectionStatus, LockStatus, EncryptionMethod

For example, FullyEncrypted, 100%, and ProtectionStatus: Off is not treated as “encrypted, therefore finished”. Find out whether protection is suspended, whether activation is pending after initialization, or whether the organization’s settings have not been applied yet. Conversely, ProtectionStatus: On does not go so far as to prove that the recovery key can be retrieved from the management location.²¹¹

flowchart TB
        accTitle: Checking encryption, protection, and recoverability
        accDescr: The encryption process, the protection status, and whether the recovery key can be retrieved each have to be checked.
        A["Check the status"] --> B["Has the encryption process finished"]
        B --> C["Is protection set to On"]
        C --> D["Can the recovery key be retrieved from another device"]
        D --> E["Record the result in the inventory"]

Figure 6: Confirm not only the encryption percentage but also that protection is enabled and that the recovery method is under management.

On PCs that keep business data on D: or another volume, include that volume as well. Use manage-bde -status to check the whole picture and find out whether you have encrypted only the OS drive and overlooked a data drive.¹⁰

4.2. Treat Displaying the Recovery Key as Separate From Checking Status

If a recovery password is configured and you can manage the target drive from Windows, the following command shows information about the protectors. However, the 48-digit secret may be displayed verbatim. Do not paste the whole output into a public chat, a GitHub issue, a support request, a screen share, or collected logs.¹²

:: Caution: the recovery password value is displayed. Do not share the output as is
manage-bde -protectors -get C:

If you only need the type and the ID, limit the displayed fields in PowerShell. This is an example of keeping the recovery key value apart from the identifier you record in your inventory.¹¹

(Get-BitLockerVolume -MountPoint 'C:' -ErrorAction Stop).KeyProtector |
    Select-Object KeyProtectorType, KeyProtectorId

This operation is not a trick for extracting an unknown key from a PC that will not boot. It tells you which protection methods are configured on a volume you can currently access. If there is no recovery password, or if backup to the storage location is unconfirmed, follow your organization’s procedure to add it, save it, and confirm retrieval.²

5. For Company PCs, Manage Not “It Is Encrypted” but “It Can Be Recovered”

5.1. Decide the Storage Location and the Retrieval Rights Together

For an Entra ID-joined PC the typical management location is Entra ID, and for an AD domain-joined PC it is AD DS. Even so, do not assume that the key you expect is stored simply because the device is joined. Check the AD DS storage policy, the configuration on the Entra ID and Intune side, and whether the backup operation succeeded. With hybrid join too, if the design uses both storage locations, you have to confirm that the key really exists in both.¹³¹⁴

In a small organization that does not use a domain or Entra ID, another approach is to configure it manually on a supported edition and manage an access-controlled storage location or paper copies. What matters is not to depend on one staff member’s personal Microsoft account, and to make sure that someone with the right permissions can retrieve the key after that person leaves, and even when the PC will not boot. Avoid storage that amounts to keeping the key in the same bag as the PC.⁴

flowchart TB
        accTitle: Storing recovery keys and confirming retrieval
        accDescr: Besides saving from the PC to the management location, confirm that a staff member with permission can retrieve the key from another device.
        A["Managed PC"] --> B["Back up to an approved storage location"]
        B --> C["Staff member with permission"]
        C --> D["Match the ID and retrieve from another device"]
        D --> E["Confirm a stand-in for when that person is away"]

Figure 7: The operation is not “it should have been saved” but confirmed retrieval by a staff member who has the permission.

An inventory is easier to work with if it records the asset number, the target volume, the recovery key ID, the storage location, who can retrieve it, and the date last verified. Keep the 48 digits themselves out of the ordinary asset inventory and store them as secret information. Also check whether access to the backup location requires the very PC that can no longer boot. These are operational check items this article recommends.

5.2. For New Rollouts, Make Saving the Recovery Information a Prerequisite for Enabling

When you use AD DS, policies such as “Choose how BitLocker-protected operating system drives can be recovered” let you configure what recovery information is stored and the setting that does not enable BitLocker until the information has been saved to AD DS. Check the corresponding policy for fixed data drives as well. When you use Entra ID and Intune, choose the join state of the devices and the matching policies, including the setting that requires backup.¹³¹⁴

flowchart TB
        accTitle: The order for rolling out BitLocker in an organization
        accDescr: Decide the storage location and the policy for recovery information first, and do not treat a device whose backup failed as complete.
        A["Decide the storage location, retrieval rights, and method"] --> B["Apply the mandatory backup policy"]
        B --> C["Run the activation procedure on the device"]
        C --> D{"Was the recovery information confirmed as saved"}
        D -- "No" --> E["Investigate the cause and do not complete the rollout"]
        D -- "Yes" --> F["Confirm that encryption and protection are complete"]

Figure 8: Rather than rushing the encryption, give priority to not creating devices that have no recovery method.

On a standalone PC, you can work through enabling BitLocker, saving the recovery key, and choosing the encryption scope in order from “Manage BitLocker” in Control Panel. A script for an organization-wide rollout has to be designed for the cases where it fails partway through as well. Avoid an operation that hands every PC the single line Enable-BitLocker -TpmProtector and treats “we can save the key later” as good enough. First verify the mandatory-storage policy and retrieval of the recovery information on a small number of test devices.²

5.3. An Example of Backing Up an Existing Recovery Password Afterward

The following example only backs up a recovery password that already exists to Entra ID. It does not start encryption, create a new recovery password, or delete old protectors. Run it as an administrator on a device whose join state and configuration allow backup to Entra ID.¹⁵

$mountPoint = 'C:'
$volume = Get-BitLockerVolume -MountPoint $mountPoint -ErrorAction Stop
$recoveryProtectors = @(
    $volume.KeyProtector |
        Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' }
)

if ($recoveryProtectors.Count -eq 0) {
    throw 'There is no recovery password. Add and save one using the procedure defined by your organization.'
}

foreach ($protector in $recoveryProtectors) {
    BackupToAAD-BitLockerKeyProtector -MountPoint $mountPoint `
        -KeyProtectorId $protector.KeyProtectorId -ErrorAction Stop | Out-Null
}

Write-Output 'The backup operation finished. Check the recovery key for each ID at the management location.'

If your configuration stores keys in AD DS, replace the backup operation inside the loop above with the following. This is not an example of running both one after the other for no reason. Check the prerequisites, such as the target domain and the policy.¹⁶

Backup-BitLockerKeyProtector -MountPoint $mountPoint `
    -KeyProtectorId $protector.KeyProtectorId -ErrorAction Stop | Out-Null

When the command succeeds, match the key ID at the management location and confirm that a staff member with the permission can retrieve it. Output is suppressed so that recovery keys do not flow into ordinary operational logs. Do not let one success message stand in for all three checks — the encryption percentage, the protection status, and where the recovery information is stored.

6. For BIOS Updates, Do Not Confuse “Suspend” With “Turn Off”

6.1. While Protection Is Suspended, It Is Weaker Even Though the Drive Is Encrypted

Suspending BitLocker protection keeps the data encrypted while letting the machine boot using a clear key. Turning it off, by contrast, decrypts the drive and removes BitLocker protection. When maintenance calls for the former and you run the latter, you invite a long decryption process and the loss of protection. Microsoft likewise explains that turning it off should not be used as a general troubleshooting step.¹⁷²

flowchart TB
        accTitle: The difference between suspending and turning off
        accDescr: Suspending keeps the encryption and stops protection temporarily, while turning off decrypts the drive.
        A["Change the BitLocker state"] --> B["Suspend protection"]
        A --> C["Turn it off"]
        B --> D["Encryption kept, clear key used"]
        C --> E["Decrypt the drive"]

Figure 9: Suspending is not decryption, but it also does not mean that a suspended machine is as safe as usual.

Do not leave a suspended PC lying around just because it no longer asks for the recovery key, and do not hand it to an outside party in that state. Because the clear key weakens offline protection, limit the working time and the physical handling, and resume protection when the work is done.¹⁷

6.2. Check the Key First, and After the Work Confirm It Is Back to On

Not every Windows update requires a manual suspend. How it is handled changes with the content of the update, the PC manufacturer’s update tool, and the TPM validation profile in use. Check the manufacturer’s procedure first, and for work that does require a suspend, carry it out after confirming that the recovery key can be retrieved from another device.⁸

flowchart TB
        accTitle: Procedure for a planned firmware update
        accDescr: Confirm the recovery method, suspend protection only where needed, apply the update, then finish with resume and a status check.
        A["Confirm retrieval of the recovery key"] --> B["Check the manufacturer update procedure"]
        B --> C["Suspend protection where required"]
        C --> D["Apply the update and any required restarts"]
        D --> E["Resume protection and confirm it is On"]

Figure 10: Finish the maintenance by confirming that protection has resumed, not merely that the machine restarted.

The following is an example for work that completes with a single restart. -RebootCount 1 specifies automatic resume after the given number of restarts.¹⁷

# Run after confirming retrieval of the recovery key and the manufacturer procedure
Suspend-BitLocker -MountPoint 'C:' -RebootCount 1 -ErrorAction Stop | Out-Null

The update work and the restart happen here. This is not a case of running the resume command straight afterward with no update work in between. After the work, if protection has not resumed automatically, confirm that the required work finished in line with the manufacturer’s procedure and then resume protection.¹⁸

Resume-BitLocker -MountPoint 'C:' -ErrorAction Stop | Out-Null
Get-BitLockerVolume -MountPoint 'C:' -ErrorAction Stop |
    Select-Object MountPoint, VolumeStatus, ProtectionStatus

For updates that restart several times, protection coming back after the first restart may lead to the recovery screen on a later change. Match the count to the manufacturer’s procedure. -RebootCount 0 does not mean “do not restart”; it specifies that automatic resume based on a restart count is not performed. If you adopt it, write the manual resume check and the person carrying out the work into the procedure. Even when automatic resume is specified, do not skip the final check that ProtectionStatus: On.¹⁷¹⁹

7. What to Do for Repair, After Recovery, and After a Loss

7.1. Once You Have Used a Recovery Key, Replace It Where Necessary

After a recovery password has been used, invalidating and updating that password is recommended. The same applies when the PC has been handed to a repair vendor. To avoid creating a window with no recovery method, this article recommends the order add a new recovery password, confirm the backup and retrieval, then delete the old one by ID. A procedure that deletes all the old ones first risks losing the recovery method if a later step fails.²

flowchart TB
        accTitle: The order for replacing a recovery password
        accDescr: Confirm that the new recovery password is saved and can be retrieved before deleting only the old protector concerned.
        A["Add a new recovery password"] --> B["Back up to an approved storage location"]
        B --> C["Confirm retrieval with the new ID"]
        C --> D["Delete only the old protector"]
        D --> E["Check the inventory and the protection status"]

Figure 11: Secure the new recovery method first, and identify what to delete by ID rather than by protector type as a whole.

In Entra ID-joined and hybrid-joined configurations there are also policies that automatically rotate a recovery password after it has been used. They come with prerequisites, though, such as a supported join state and the setting that makes backup of recovery information mandatory. Do not think “it is a company PC, so it must change automatically”; check the applied policy and the storage of the new key.¹³

Replacing a key is also not a feature that pulls back data already copied or disk images taken in the past. If you suspect that a recovery key has leaked, do not treat updating the key as the end of the response; consider the extent of what could have been accessed as well.

7.2. Even When an Encrypted PC Is Lost, Do Not Declare Zero Exposure

When a PC is lost, use your routine management records to confirm whether protection was enabled. On top of that, find out which state it was in — powered off, asleep, or signed in — whether protection had been suspended, and whether the recovery key was being carried around with the PC. BitLocker is an important control, but the single item “it was encrypted” cannot rule out every possibility of exposure.⁷

flowchart TB
        accTitle: Protection conditions to check after a loss
        accDescr: Besides whether it was encrypted, check the protection status, the power state, and the chance that the key leaked in order to assess the impact.
        A["PC lost"] --> B["Check the management records for the protection status"]
        B --> C["Check the power state and how it was being used"]
        C --> D["Check whether the recovery key could have leaked"]
        D --> E["Assess the impact under the organization incident response procedure"]

Figure 12: Whether a machine was encrypted is one important input for judging the impact of a loss.

For departures and PC returns as well, avoid a state where the key remains only in a personal account. When a returned PC is redistributed, treating recovery information management, handover of the data that is needed, and re-kitting as one procedure makes it easier to keep operations running when staff change.

8. Decide the Encryption Method and Performance Before Rollout, and Measure Them

8.1. Changing the Method Does Not End With Rewriting a Setting

With ordinary software encryption, the default when policy does not change it is XTS-AES 128. There are exceptions in implementations and defaults, though, such as hardware acceleration from certain combinations of supported hardware and Windows. So do not assume that “with BitLocker the current method is always 128-bit” — check EncryptionMethod on the real machine. Choose the method and key length in light of your organization’s requirements and the performance of the devices.¹³²⁰

The method on an already-encrypted drive does not switch just because you changed a policy. Changing it requires decryption and re-encryption, so plan for the period of weakened protection, the backups, and the downtime you can afford. Settling on it before the initial kitting is easier to handle than changing it partway through operations.¹³

flowchart TB
        accTitle: When to decide the encryption method
        accDescr: For a new rollout decide the method first, and for existing devices check the current method and the decryption step that a change involves.
        A["Check the requirements for method and key length"] --> B{"Is it already encrypted"}
        B -- "No" --> C["Decide the policy before rollout"]
        B -- "Yes" --> D["Check the method on the real machine"]
        D --> E["Plan decryption and re-encryption if needed"]

Figure 13: Changing a policy and changing the encryption method on an existing drive are not the same job.

When judging performance, keep the impression that “encryption will probably be slow” apart from actual measurements. Measure processing time, read and write volume, and CPU load with production-equivalent data volumes, storage, and applications, and distinguish the temporary load while encryption is running from the ongoing effect after it finishes. Confirming that the requirements are met is more practical than declaring “there is no impact” or “it is always N% slower” without stating the device conditions.²⁰

8.2. With “Used Space Only”, Watch Out for Data Deleted in the Past

On a new drive, “encrypt used space only” shortens the initial processing. On a drive that has held confidential data in the clear in the past, on the other hand, the areas of deleted files become a problem. Space that the file system treats as free may still hold traces of data, and encrypting used space only does not cover those areas.²

flowchart TB
        accTitle: What to watch for when encrypting used space only
        accDescr: Deleted data can remain in free space, and encrypting used space only leaves it outside the protected scope.
        A["Confidential data stored in the clear in the past"] --> B["The files are deleted"]
        B --> C["Traces may remain in free space"]
        C --> D["Out of scope with used space only"]
        D --> E["Consider full encryption or proper erasure"]

Figure 14: Deleting a file and its contents disappearing from the medium are different things.

Do not choose on the speed of the first pass alone; check the drive’s usage history as well. Note that full-drive encryption is not proof of erasure at disposal time. For disposal and transfer, define a separate erasure procedure as in Section 10.

9. Points to Watch for Business Applications, Unattended Devices, and Clone Deployment

9.1. Application Secrets Need Separate Measures Too

Normally, on an unlocked BitLocker volume, applications use the file APIs exactly as they always do. That is precisely why the problem of putting connection strings or API keys in plaintext files is not solved by enabling BitLocker. Information that a running application, or anyone with the same user’s permissions, can read has to be considered at a different boundary.⁷

flowchart TB
        accTitle: Drive encryption and application secrets
        accDescr: Even with the storage medium protected by BitLocker, secrets handled by applications after boot need their own storage design and access rights.
        A["Protect the medium with BitLocker"] --> B["The drive is unlocked after Windows boots"]
        B --> C["Applications read and write according to their permissions"]
        C --> D["Design secret storage and permissions separately"]

Figure 15: BitLocker and application-side protection of secrets combine, they do not replace each other.

When you use DPAPI and similar mechanisms, think about which user or computer the protection is tied to. Using DPAPI does not mean that an attacker holding the same user’s permissions can never read the data. Concrete examples are explained in “Storing Secrets in Windows Apps”.²¹

9.2. Being Able to Restart Unattended and Being Able to Recover Are Different

A TPM-only configuration cuts down the input needed at a normal boot, but it does not remove recovery prompts caused by changes in the boot environment. If you choose TPM+PIN, input is normally required at boot. For unattended equipment, check both the security requirements and whether there is someone who can type the PIN on site. Dedicated configurations such as Network Unlock have to be designed separately; simply enabling a PIN does not let unattended operation carry on.⁶²²

flowchart TB
        accTitle: Normal boot and recovery readiness for unattended devices
        accDescr: Even when normal restarts can be automated, you still need a responsible person and a key retrieval procedure for when a recovery prompt appears.
        A["Choose the boot method for the unattended device"] --> B["Check whether a normal restart works"]
        B --> C["Assume it may stop at the recovery screen"]
        C --> D["Prepare on-site staff and a retrieval procedure"]

Figure 16: Prepare not only the unattended restart test but also the operations for when the machine stops at the recovery screen.

When you keep a startup key on a USB drive, make it both available when needed and not stolen together with the PC. Also, do not conclude that Windows IoT devices are not encrypted just because they are outside the scope of the 24H2 relaxation. Include an actual status check in the kitting. For locking down the device as a whole, “Locking Down Business Terminals with Kiosk Mode” is also a useful reference.⁸²

9.3. Do Not Build a Master Image That Reuses One Recovery Key

Do not assume that the state of a reference machine with protection enabled can be copied as is to many PCs. BitLocker does have a pre-provisioning mechanism for deployment, but that separates the preparation stage that uses a clear key from enabling protection on each device. It is neither “an encrypted image is always forbidden” nor “the reference machine’s recovery key may be shared by every unit”.²³

flowchart TB
        accTitle: A deployment procedure that establishes per-device protection
        accDescr: After deploying the image, configure per-device protectors and recovery information, and check the storage location and protection status individually.
        A["Place the image following the deployment method"] --> B["Configure per-device protectors"]
        B --> C["Save per-device recovery information"]
        C --> D["Check the ID, retrievability, and protection status"]

Figure 17: What you standardize is the setup procedure, not the recovery key of every PC.

Even with automation such as “Automating PC Provisioning With winget + PowerShell”, keep a final step that checks not only the result of the encryption process but also the per-device recovery information and protection status.

10. At Disposal, Treat Encryption and Erasure as Separate Jobs

BitLocker helps lower the risk of information leaking through improper disposal. However, the facts that the drive is “encrypted” and that “the key was deleted from the Microsoft account” are not by themselves enough to conclude that the medium has been erased. Other unlocking methods or copies of keys may remain.⁶³

This article recommends the order of preserving the data you need, choosing an erasure or destruction method that suits the medium and your organization’s standards, confirming the result, and then tidying up the asset inventory and the recovery key records. Rushing to delete the key records first risks losing access to data you still needed.

flowchart TB
        accTitle: The order for disposing of an encrypted PC
        accDescr: Secure the data you need and confirm the erasure result for the medium before tidying up the keys and the inventory in line with the organization retention policy.
        A["Preserve the data you need"] --> B["Erase or destroy in a way suited to the medium"]
        B --> C["Confirm the result and the evidence"]
        C --> D["Tidy up the key records in line with the retention policy"]
        D --> E["Update the asset inventory"]

Figure 18: Tidy up the recovery key records after confirming that the needed data is preserved and the medium has been processed.

Records in AD DS and Entra ID are also subject to your organization’s retention and audit policies. Do not make deleting every old key on the spot a blanket procedure; tidy them up through the administrator’s process. The overall check, covering accounts, licenses, and asset management, is collected in “What to Do Before Disposing of a Windows PC”.

11. Summary — Make “The Recovery Key Can Be Retrieved” Part of Operations

The first thing to confirm with BitLocker is not “should we turn encryption off” but what is encrypted, whether protection is enabled, and who can retrieve which recovery key.

At the recovery screen, use the key ID as your clue for finding the storage location. If Windows still runs, finish the status check and the confirmation that the recovery key can be retrieved. Before maintenance, secure a recovery method, suspend protection only where it is needed, and confirm it is back to On after the work. Building these into your procedures for deploying, updating, and returning PCs turns “encryption that only the person who enabled it understands” into protection that can be handled even when staff change.

References

Related Articles

Recent articles sharing the same tags. Deepen your understanding with closely related topics.

Related Topics

These topic pages place the article in a broader service and decision context.

Where This Topic Connects

This article connects naturally to the following service pages.

Frequently Asked Questions

Common questions about the topic of this article.

Where is the BitLocker recovery key?

Check a personal Microsoft account, the management location used for a work or school account, a printed paper copy, and files saved on a USB drive or somewhere else. The way you sign in today does not by itself settle where the key is stored, and it may sit in the account of the person who first set the PC up. Use the first 8 characters of the recovery key ID on the recovery screen as your clue and look for the key that matches. On a company PC where the user cannot display it, ask the IT administrator.

If the recovery key cannot be found, is resetting the PC right away the only option?

Before resetting, check with your organization's administrator, with the person who set the PC up, and for any copy already saved. The organization may also have configured another recovery method. If every valid unlocking method has been lost, not even Microsoft Support can re-create the recovery key. Decide by keeping restoration from a data backup separate from a reset or reinstall that loses local files.

If the encryption percentage is 100%, is the PC safe?

The encryption percentage alone is not enough to judge. While protection is suspended, or while automatic encryption is still waiting to enable protection, ProtectionStatus can be Off even though the drive is already encrypted. Check VolumeStatus and ProtectionStatus separately, and confirm as well that the recovery key really can be retrieved from the management location. LockStatus being Unlocked while Windows is in use is not in itself abnormal.

Can BitLocker be used on Windows 11 Home?

On qualifying PCs, Home can also use Device Encryption, which is built on BitLocker technology. Enabling BitLocker Drive Encryption and managing it in detail, on the other hand, requires an edition in the Pro, Enterprise, or Education family. Windows 11 version 24H2 relaxed the hardware conditions for automatic encryption, but that does not mean every 24H2 PC is necessarily protected automatically.

Do I need to turn BitLocker off before a BIOS update?

Normally you consider suspending protection, in the way the model and the update procedure call for, rather than the turn-off that decrypts the entire drive. Confirm first that you can retrieve the recovery key, and follow the PC manufacturer's procedure. Because offline protection is weaker while protection is suspended even though the data stays encrypted, resume protection after the work and confirm that ProtectionStatus is On. This does not mean that every Windows update requires a manual suspend.

Author Profile

Profile page for the article author.

Go Komura

Representative of KomuraSoft LLC

Focused on Windows software development, technical consulting, and investigations into failures that are difficult to reproduce.