BitLocker Recovery Key: Where to Find It After a BIOS Change
Published
On this page
If your PC boots to a blue BitLocker recovery screen after a BIOS update or a TPM or Secure Boot change, the 48-digit recovery key is most likely saved in your Microsoft account: open aka.ms/myrecoverykey on another device, sign in, and pick the key whose ID matches the first 8 characters of the Key ID shown on the screen. This happens because the TPM checks the firmware and boot state before releasing the key, and Microsoft names BIOS/UEFI firmware upgrades and TPM changes as recovery triggers. Gamers hit it most often when flashing a BIOS or enabling TPM and Secure Boot for anti-cheat.
Where the BitLocker recovery key is stored
Check these in order. Microsoft’s “Find your BitLocker recovery key” support article lists the same places.
| Where | How to get it | Most likely if… |
|---|---|---|
| Microsoft account | aka.ms/myrecoverykey → sign in → match the Key ID | You sign in to Windows with a Microsoft account (typical for home PCs) |
| Someone else’s Microsoft account | Same link, signed in as them | Someone else set up the PC or turned on BitLocker |
| Work or school account | aka.ms/aadrecoverykey → Devices → your device → View BitLocker Keys | The PC was ever signed into an organisation account |
| Printout | Find the page you printed | You printed it when you turned BitLocker on |
| USB flash drive | Plug it into the locked PC and follow the prompts | You saved the key to USB |
| Text file | Open it on another device | You saved it as a file somewhere other than the locked drive |
On a managed work PC, ask your IT department; the organisation holds the key.
How to match the Key ID
The recovery screen shows a Key ID. Note its first 8 characters. Your Microsoft account may list several keys (one per PC, or one per time BitLocker was turned on), and only the one with the matching ID unlocks this drive. From Windows 11 24H2, the recovery screen also shows a hint of the Microsoft account that holds the key.
Why a BIOS change triggers BitLocker recovery
BitLocker on most PCs is unlocked by the TPM. At every boot the TPM measures the firmware and the boot path. If those measurements match what was recorded when BitLocker was set up, the TPM releases the key and Windows starts normally. If something it measures has changed, it refuses, and Windows asks for the recovery key instead.
Microsoft’s list of common recovery triggers includes these, which are the ones gamers run into:
| What you changed | Why it triggers recovery |
|---|---|
| BIOS / UEFI firmware update | Microsoft names “a BIOS or UEFI firmware upgrade” directly |
| TPM turned off, disabled or cleared (including fTPM / PTT toggles) | Named directly: the TPM that held the key is gone or reset |
| New motherboard | Named directly: a new board means a new TPM |
| Drive moved to another PC | Named directly: the other PC’s TPM never held the key |
| Boot order / booting a CD, DVD or ISO | Named for some setups (CD/DVD before the hard drive; boot order on TPM 1.2) |
| Docking or undocking a laptop | Named directly |
| Secure Boot turned on or off | Not on Microsoft’s list by name, but it changes the boot state the TPM validates, so expect it |
Many Windows 11 PCs also have device encryption, a form of BitLocker, switched on during setup when you sign in with a Microsoft account. That is why people who “never turned on BitLocker” still see this screen, and why the key is usually in that Microsoft account.
How to stop it happening next time: suspend BitLocker first
Microsoft’s guidance for planned firmware or hardware changes is to temporarily suspend BitLocker. The drive stays fully encrypted; suspending lets Windows reseal the key to the new state instead of locking you out.
Before a BIOS update, or before changing TPM or Secure Boot in the BIOS, open PowerShell as administrator and run:
Suspend-BitLocker -MountPoint "C:" -RebootCount 0-RebootCount 0 keeps protection suspended until you turn it back on. Without a count, BitLocker resumes after one reboot, and a BIOS flash often reboots more than once. When the change is done and Windows has started normally, resume it:
Resume-BitLocker -MountPoint "C:"You can also use Control Panel → BitLocker Drive Encryption → Suspend protection, but that resumes automatically after one restart.
Save your recovery key before you change anything
To see the key from inside Windows, open Command Prompt as administrator and run:
manage-bde -protectors -get C:Under Numerical Password, the ID is the Key ID and the Password line is the 48-digit recovery key. Write it down or print it, and keep it off the PC. Doing this before you flash a BIOS or toggle TPM or Secure Boot turns a recovery screen into a one-minute fix instead of a lost drive.
If you can’t find the key
Microsoft states that its support cannot retrieve, provide or recreate a lost recovery key. Before resetting anything:
- Undo the change. Go back into the BIOS and revert what you just changed (re-enable the TPM/fTPM, set Secure Boot back, restore the boot order). If the TPM sees the old state again, it may unlock the drive on its own. A BIOS update usually can’t be undone this way, but resetting changed settings can still help.
- Check every account. Try every Microsoft account anyone in the household uses, and aka.ms/aadrecoverykey if the PC was ever used for work or school.
- Check for a USB drive or printout from when the PC was set up.
If none of that works, the only option is to reset Windows from the recovery options, which removes all files on the drive.
Anti-cheat, TPM and Secure Boot: do it in the right order
Games with kernel anti-cheat increasingly need TPM 2.0 and Secure Boot, so changing these BIOS settings is a common first step for players. The safe order is:
- Save your recovery key (
manage-bde -protectors -get C:). - Suspend BitLocker with
-RebootCount 0. - Change the BIOS settings: TPM on ASUS or MSI, Secure Boot on MSI or ASUS.
- Boot into Windows, confirm the game launches, then run
Resume-BitLocker -MountPoint "C:".
For why games demand these settings at all, see why anti-cheat needs Secure Boot and TPM. Game-specific walkthroughs: Battlefield 6 Secure Boot and Javelin fix and Modern Warfare 4 Secure Boot / TPM fix.
Related guides
- How to Update Your BIOS Firmware Safely
- Why Anti-Cheat Needs Secure Boot and TPM
- Enable Secure Boot in Gigabyte BIOS
Summary: the BitLocker recovery key is usually at aka.ms/myrecoverykey, matched by the first 8 characters of the Key ID. BIOS updates and TPM or Secure Boot changes trigger the recovery screen, and suspending BitLocker with -RebootCount 0 before the change prevents it.
Frequently asked questions
Where do I find my BitLocker recovery key?
On a personal PC signed in with a Microsoft account, the key is usually saved to that account: open aka.ms/myrecoverykey on another device, sign in, and pick the key whose ID matches the Key ID shown on the recovery screen. If the PC was ever signed into a work or school account, check aka.ms/aadrecoverykey instead. Otherwise look for a printout, a USB flash drive or a text file saved when BitLocker was turned on.
Why is BitLocker asking for a recovery key after a BIOS update?
Microsoft lists BIOS or UEFI firmware upgrades, and turning off, disabling or clearing the TPM, among the events that put a device into BitLocker recovery mode. The TPM checks the firmware at boot; when that changes, it stops releasing the key automatically and Windows asks for the 48-digit recovery key instead. Suspending BitLocker before the change avoids it.
Can enabling Secure Boot or TPM for anti-cheat trigger BitLocker recovery?
Yes, it can. Changing TPM settings is a recovery trigger Microsoft names directly, and toggling Secure Boot changes the boot state the TPM validates, so an encrypted Windows drive may ask for its recovery key on the next boot. Suspend BitLocker before changing those BIOS settings for games like Battlefield 6 or Valorant, then resume it once Windows starts.
What happens if I can't find my BitLocker recovery key?
Microsoft says its support cannot retrieve, provide or recreate a lost BitLocker recovery key. First try undoing the change that triggered recovery, such as reverting the BIOS setting you just changed, because that can let the TPM unlock the drive again. If that fails and no key exists anywhere, the only option is to reset Windows, which removes all files on the drive.
How do I see my BitLocker recovery key from inside Windows?
Open an administrator Command Prompt and run manage-bde -protectors -get C:. The Numerical Password entry shows the ID and the 48-digit recovery password. Save or print it somewhere off the PC before changing BIOS, TPM or Secure Boot settings.