Hi! Ugh. Seriously? This screen again? That BitLocker recovery screen is annoying; but not nearly as
annoying as so-called IT professionals who tell you that when you see that BitLocker screen
all your data is gone. I've recently come across the owner of a computer company doing just that
and telling his customers that their only option was to pay his guys to reset the computer and
then just accept the data loss. Uh, no! There are at least four other things you could try first,
and in most cases you could be back up and running in minutes.
Welcome back to The Pro Tech Show. Let's talk about what's going on here because chances
are some of you hadn't even heard of BitLocker before you saw this screen.
BitLocker is a drive encryption technology that is intended to stop people from stealing your
information. All of the information you access on your computer is saved on your hard drive.
Regardless of whether it's mechanical or SSD your drive has your data. When you start your computer
it's probably protected by a password or a PIN or something; but if somebody gets physical access
all they have to do to bypass that protection is to just access the drive using anything other
than your copy of Windows. They can plug in a USB drive with Linux on it, or they could just
take your hard drive and plug it into a different Windows PC, or even a Mac. It's really not difficult.
BitLocker prevents this by scrambling all the data on your drive into an encrypted mess that can only
be made sense of using a decryption key. If someone tries to read it they can't do it without that key.
This would obviously be a problem for you, too; so what usually happens is the key gets stored
in a security module called a TPM. This is a piece of hardware inside your computer.
It can be a dedicated physical device or it can be a firmware feature. Windows encrypts the
drive and stores the key in the TPM. It is now impossible to read that drive without that key.
When your computer next starts up and the Windows boot manager tries to read the drive it will ask
the TPM for the key and the TPM will hand over the key so the encrypted drive can now be read and
your computer can continue starting. Great! Except if the TPM just hands over the key when anyone
asks it would be pointless, so it protects the key by storing measurements taken as the computer starts
up. The software and configurations being used are all measured and if they differ from what's
stored in the TPM it will not release the key. If you try to boot Linux, the measurements change. If
you transplant the hard drive and the TPM to a different computer, the measurements change.
If you're seeing this BitLocker recovery screen it probably means the measurements have changed.
Windows has asked for the key but the TPM is refusing to give it up because something is
different and it doesn't know if it can trust you. In order to get past this you either need
to enter the key yourself or get the measurements to add up again. There are a couple of places you
might be able to find the key but let's do the easy thing first: turn your computer off and on
again. Sometimes weird things happen during start-up and a reboot is all it takes to make the BitLocker
screen go away. If that didn't work the next step is: "Do you know what changed?" If some hardware
failed and got replaced there's not much you can do about that, but if you changed something in your
BIOS or moved some hardware about: go change it back and that will likely make the problem just go away.
If This gets you back into Windows then stick around to find out how to make a note of your key because
the next time you might not be so lucky. Let's say you weren't lucky, though. You can't figure out what
changed, or you can't revert it because it was a one-way change, or something's just broken. All
is not lost. There are three places you might be able to find your BitLocker recovery key, depending
on whether it's a personal device or a corporate one. The three places are Active Directory Domain
Services, Azure Active Directory, and your Microsoft Account. This one is for corporate devices. This
one is mostly for personal devices. This one could easily apply to either. Let's start with Active
Directory Domain Services. This is one for the IT department, and a lot of my audience work in IT. If
you're not an IT professional that's OK. If it's a corporate device you can point your IT team at
this video and if it's a personal device I'm going to show you other options that are more suited
to you right after this. The easiest way to find out if the BitLocker key was backed up to Active
Directory is to use AD Users and Computers. You'll need an extra RSAT module installed. This is under
"optional features" in Windows 10 or 11 or "Feature Administration Tools" in Windows Server. All you
need to do is find the computer account in AD and double-click it. If you've got that extra feature
installed you'll have a "BitLocker Recovery" tab that will show you the key. You can also search
for the key ID by right-clicking on the root of the domain and choosing "Find BitLocker recovery
password". OK, that was one method for corporate owned-devices. The next method can work for both
corporate and personal devices. Another place your key can be backed up to is Azure Active Directory.
Azure AD is typically owned by an organisation but if you've ever used your computer to log
into your work or your school account there's a chance your computer has been registered with it.
The intention is to let the organisation retain control of any of their data that you access,
but it can also be used to back up BitLocker keys. To get to it, browse to https://myaccount.microsoft.com and
log in with your work or school account. You should see a heading for "Devices". Click on the "Manage
Devices" link. If you can see your computer in the list of devices, click on it to expand it, and if
there's a button to "View BitLocker Keys" you're in luck. Click it, check the key ID here matches the
ID displayed on your recovery screen, and click "Show recovery key". Type that into your computer
and you're good. If you've still not had any luck then don't worry - there's still your Microsoft Account.
Microsoft are trying really hard to force people to sign into Windows using a Microsoft Account
and this time it works in your favour. See, back in the day this BitLocker thing was only in the
Professional and Enterprise versions of Windows and you needed an admin to come set it up for
you. In Windows 8.1 they started enabling it automatically if your hardware supported it
and in Windows 10 they started including a limited version of it in Home editions of windows, too.
Add to that the fact that Windows 11 officially requires a TPM and the situation now is that
any computer you buy today is probably going to encrypt your drive automatically without asking
you! To counter the rather obvious problem with that Microsoft basically bully you into setting
up a Microsoft Account, and when you sign in with it they back up your BitLocker key to that account
so you can recover from this. The process to find the key is similar to the last one but the address
is a little different. This time you need to browse to https://account.microsoft.com/devices. Sign in with your
Microsoft Account, which on a personal device should be the same account you normally log on
to Windows with. Look for your computer in the list (you may need to click on it to expand it
first), then click the See Details link. You should see this "BitLocker data protection" section. Click
"Manage recovery keys" and there you go! Take that key type it in and you've got your computer back.
Now I've shown you a few ways to find your key or get past the recovery screen, it's probably worth
knowing how you can back up this key for future reference so you don't find yourself stuck in
the future. In your Start menu you're looking for "Manage BitLocker" in here there's an option
to "Back up your recovery key" which will give you options like saving it to one of your accounts,
to a file, or printing it. If you can't get to this BitLocker management screen then there
is another way to find the key from within Windows. From your Start menu open a command prompt, making
sure to select "Run as administrator". Then type "manage-bde -protectors -get"
and then the letter of the drive you want the key for and a colon. If you've only got one
drive, the letter is probably going to be "C". Look for the bit that says "Numerical Password". The ID
is the number that will be displayed on the BitLocker recovery screen. The password is the key
you need to type into your computer to get it back if that happens. Make a note of it, but do not store
it on the computer that it unlocks. Don't leave yourself in a position where you need the key to
get to the key. I've seen people do that! Also, don't store it with your laptop because if someone steals your
laptop and gets the key with it your encryption is pointless. Remember, it's there to protect you!
OK, that's it for today. Let me know which method worked for you. Like, subscribe, ring the
notification bell, and check out one of these videos before you go. See you at the next one!