Troubleshooting playbook · Reviewed 2026-10-23
BitLocker recovery playbook
A safe path for a Windows device requesting a BitLocker recovery key after a hardware, firmware, boot, or security change.
When to use this
This playbook helps distinguish normal BitLocker recovery from a storage or account-access problem. It does not bypass encryption.
Protect data and access first
- Never share a recovery key in a screenshot, chat, or public post.
- Do not clear TPM or reinstall Windows until the correct recovery key has been located or data-loss consequences are understood.
Before you change anything
- Record the recovery-key ID shown on the screen.
- Use a separate trusted device to access the Microsoft account or organization account.
- Keep the affected device connected to power.
Decision path
Match the displayed key ID
Use the recovery-key ID to identify the corresponding key in the account or IT-managed inventory.
Check: The identifier matches before any key is entered.
Check the trigger
Note recent BIOS, TPM, boot order, disk, dock, or security-policy changes.
Check: You can explain why recovery may have been requested.
Enter the matched key once
Enter only the key associated with the displayed ID, then allow Windows to finish booting.
Check: Windows either boots or reports a new specific error.
Stabilize the configuration
After a successful boot, review the recent change before repeating it or changing encryption settings.
Check: Recovery does not recur without a known trigger.
Stop and escalate when
- No recovery key can be matched to the displayed ID.
- The device belongs to work or school and is centrally managed.
- The disk is failing or cannot be detected.