Skip to main content

Glossary

BitLocker recovery key

A BitLocker recovery key is a 48-digit numerical password that unlocks an encrypted Windows volume when the normal unlock path fails, usually because the TPM no longer recognizes the machine it is booting. For an IT team the key itself is less interesting than where it is stored: if it lives only on the laptop or on a sticky note, a firmware update can turn a working PC into a brick.

How it works

When BitLocker encrypts a drive, it generates a volume master key and protects it with one or more key protectors. On a managed laptop the usual protector is the TPM, sometimes combined with a PIN. At every boot the firmware measures the components it loads (UEFI code, Secure Boot state, boot configuration) into the TPM's platform configuration registers. If those measurements match what they were at encryption time, the TPM releases the key and Windows starts without asking anyone anything.

The recovery key is the fallback protector. It is printed as eight groups of six digits, and it can be stored in Microsoft Entra ID against the device object, in Active Directory, in a Microsoft account, in a file, or in your MDM. Escrow is the whole point. A key that nobody can look up is the same as no key.

Things that break the TPM measurements and trigger the recovery prompt: a UEFI or firmware update, a Secure Boot setting change, swapping the motherboard, changing the boot order, docking a machine that boots from a different path, or moving the disk to another chassis. None of these are attacks. They are Tuesday. The July 2024 CrowdStrike outage made this painfully visible, because thousands of machines needed their recovery key typed in by hand before they could be repaired.

Why it matters for a fleet

Encryption without key escrow is a support disaster waiting for a firmware release. The questions a CISO should be able to answer in under a minute: which devices are encrypted, which cipher (XTS-AES 128 or 256), and whether a recovery key exists in the directory for every single one of them.

Rotation is the second half. A recovery key that has been read aloud over the phone to a user is burned. Windows 10 version 1909 and later expose a rotation action through the BitLocker CSP, so the management server can ask the device to generate a fresh recovery password and escrow it, invalidating the old one. Do that after every use.

And decide who can read keys. In Entra ID that is a specific permission, and plenty of tenants leave it wider than they think. A help desk agent who can pull any recovery key for any laptop is a credible insider risk.

How Appaloosa handles it

Appaloosa manages Windows devices through the native MDM stack, so encryption status is part of the compliance evaluation: a laptop that reports BitLocker off can be flagged, notified, or cut off from managed apps. Enrollment runs through Windows Autopilot, and the policies applied are listed on the Windows MDM page. For the recovery keys themselves, most fleets keep Entra ID as the escrow of record, which keeps one authoritative place to look when a user calls from an airport with a blue recovery screen.

Explore

See the full platform

Enrollment, apps, security, remote support: all in one place.

Explore Appaloosa →

See Appaloosa run on your fleet Book a demo

Frequently asked questions

Where should we store BitLocker recovery keys for a managed fleet?
In the directory, not on the device and not in a spreadsheet. For cloud-joined Windows devices that means Microsoft Entra ID, where the key is attached to the device object and can be looked up by an authorized admin. Keep one escrow of record so nobody has to guess which system holds the current key, and restrict who holds the permission to read it.
Why does a laptop suddenly ask for the recovery key after an update?
Because the TPM measurements changed. A UEFI or firmware update, a Secure Boot change or a new boot order makes the platform configuration registers differ from what they were when the volume was encrypted, so the TPM refuses to release the key. Once the user enters the recovery key, Windows re-seals against the new measurements and the next boot is silent again.
Does the recovery key change after someone uses it?
Not on its own. You have to rotate it. Windows 10 1909 and later support a rotation command through the BitLocker CSP, so your management server can ask the device for a fresh recovery password and escrow it, which invalidates the one that was read out over the phone. Treat every used key as compromised.