BitLocker is full‑disk encryption. When Windows detects a possible security change (for example, firmware or hardware changes), it can require the BitLocker recovery key before starting.
To proceed, the 48‑digit BitLocker recovery key for that specific laptop must be found. Without it, the data on that drive cannot be unlocked.
Follow these steps:
- Check where the key might be stored
BitLocker keys are typically saved in one of these places:
- A work or school account (Azure AD / Microsoft Entra ID)
- A personal Microsoft account
- A printout or PDF
- A USB flash drive
- If the device is (or was) joined to a work/school account
- From another device, go to https://aka.ms/aadrecoverykey
- Sign in with the work or school account used to manage or sign in to that laptop.
- Select Devices, expand the affected device, and choose View BitLocker Keys.
- Match the Key ID shown on the blue BitLocker screen with the Key ID in the portal, then use the corresponding 48‑digit recovery key to unlock the laptop.
- If the device used a personal Microsoft account
- BitLocker/device encryption may have automatically saved the key to the Microsoft account of the person who set up the device.
- Sign in to that Microsoft account on another device and check the device list and BitLocker keys as described in BitLocker overview and Find your BitLocker recovery key.
- Check local storage options
- Look for any printouts labeled “BitLocker recovery key” in your practice’s records.
- Check any USB flash drives that might have been used during setup; the key may be stored as a text file.
- If the laptop is managed by an IT provider or organization
- If an external IT company or internal IT department manages the devices, they may have escrowed the recovery key via policy. Contact them and provide the Recovery Key ID shown on the BitLocker screen so they can locate the matching key.
- If the key cannot be found
- If none of the above locations contain the key and the device is not listed under any Microsoft/work/school account, the recovery key cannot be retrieved by Microsoft or anyone else.
- In that case, the only option is to reset/reimage the device using Windows recovery options or a vendor recovery image. This will remove all data on the encrypted drive.
For a healthcare practice, ensure that any reset or disposal of the device complies with internal policies and regulatory requirements for protected health information (PHI), since BitLocker is what protects that data at rest.
On the BitLocker recovery screen itself, once the correct 48‑digit key is found, type it (hyphens optional). If correct, Windows will start normally.
References: