Windows · Windows Server · critical · Security, BitLocker & identity

BitLocker asks for the recovery key at every boot

The TPM measured the boot and the result no longer matches what BitLocker sealed the key against, so it refuses to release it automatically.

What you see

The blue BitLocker recovery screen at every boot, asking for a 48-digit key. Frequently starts after a firmware update, a hardware change, or a docking station being connected.

What is actually wrong

Anything that changes the measured boot path: a BIOS or firmware update, Secure Boot being turned on or off, a boot order change, adding or removing a bootable device, or a failing TPM.

Codes and articles

BitLocker recovery0x80310000Event 24620recovery keyTPM measurement

Fixes (3)

Find the recovery key

Another device20 minuteslow riskreversible

You are locked out. Work through every place it could have been escrowed before considering the data lost.

Check the Microsoft account it may have been saved to, at account.microsoft.com/devices/recoverykey — this is where a consumer machine with a Microsoft account sign-in stores it automatically.
On a work machine, check Entra ID: the device's page in the admin centre, or the user's My Account → Devices page.

In an on-premises domain, check Active Directory if escrow was configured.

PowerShell

Get-ADObject -Filter { objectClass -eq 'msFVE-RecoveryInformation' } -SearchBase (Get-ADComputer LAPTOP01).DistinguishedName -Properties msFVE-RecoveryPassword | Format-List Name,msFVE-RecoveryPassword

Check for a printed copy or a saved .txt on a USB stick, which is where the setup wizard offers to put it.
If none of these have it, the data is not recoverable. That is the design of the feature and there is no bypass — the honest answer at this point is restore from backup and rebuild.
It is worth saying plainly rather than sending someone round a loop of hopeful tools. Encryption without an escrowed key and without the key is exactly as strong as it claims to be.

Confirm it workedThe 48-digit key unlocks the volume and Windows boots.

If you need to undo itNot applicable.

Re-seal the key against the current boot configuration

Elevated PowerShell, once booted25 minuteshigh riskreversible

You can get in with the key but it asks again every time.

Record the key somewhere safe first, and confirm it is escrowed. Everything below can be undone with the key and cannot be undone without it.
PowerShell
```
manage-bde -protectors -get C:
```

Check what BitLocker thinks is wrong.

PowerShell

Get-BitLockerVolume -MountPoint C: | Format-List MountPoint,VolumeStatus,ProtectionStatus,KeyProtectorGet-WinEvent -LogName Microsoft-Windows-BitLocker/BitLocker\ Management -MaxEvents 20 -ErrorAction SilentlyContinue | Format-Table TimeCreated,Id,Message -Wrap

Suspend protection, apply whatever firmware or boot change is outstanding, then resume — this is the supported way to make a change without triggering recovery.
PowerShell
```
Suspend-BitLocker -MountPoint C: -RebootCount 2
```
RebootCount 2 suspends for two restarts, which is enough for a firmware update to complete, and then protection resumes automatically. Suspending indefinitely and forgetting is how machines end up unencrypted for months.
If the TPM protector is missing or stale, remove and re-add it so the key is sealed against the current measurements.
PowerShell
```
manage-bde -protectors -delete C: -type tpmmanage-bde -protectors -add C: -tpm
```
Resume protection and restart twice to confirm.
PowerShell
```
Resume-BitLocker -MountPoint C:
```

Confirm it workedTwo consecutive restarts reach the sign-in screen with no recovery prompt.

PowerShell

Get-BitLockerVolume -MountPoint C: | Format-List ProtectionStatus,VolumeStatus,KeyProtector

If you need to undo itThe recovery key still unlocks the volume throughout. Re-adding the TPM protector can be repeated.

Check the TPM itself

Elevated PowerShell30 minuteshigh risknot reversible

Re-sealing does not hold, or the TPM reports a fault.

Read the TPM state.

PowerShell

Get-Tpm | Format-List TpmPresent,TpmReady,TpmEnabled,TpmActivated,LockedOut,ManufacturerVersion

LockedOut true means too many failed attempts; it clears itself after a timeout, or can be reset with the owner authorisation.
Update the TPM firmware from the machine manufacturer if a fault is reported. Suspend BitLocker first — a TPM firmware update always changes the measurements.
Clearing the TPM destroys every key sealed to it. With BitLocker enabled and no recovery key escrowed, that means the data is gone.
PowerShell
```
Get-Tpm | Format-List LockoutCount,LockoutMax
```
The Clear-Tpm command is widely suggested for this fault and it is the one action here that can lose the data outright. It is safe only with protection suspended and the recovery key confirmed in hand.
With BitLocker suspended and the key confirmed, clear the TPM from the firmware settings, then resume BitLocker so it re-seals cleanly.

Confirm it workedGet-Tpm reports TpmReady true, and BitLocker boots without prompting.

If you need to undo itNone — a cleared TPM cannot be restored. The recovery key is the only route back in.

Related faults

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.