Where Is the BitLocker Recovery Key Stored?
BitLocker recovery keys live outside the encrypted drive: in Entra ID, Active Directory, a Microsoft account, or a saved file.
Last updated
BitLocker never stores the recovery password on the locked volume itself. That would defeat the purpose. Instead Windows backs it up to whichever directory the device trusts: Entra ID for Entra joined PCs, Active Directory for domain joined PCs, or a Microsoft account for personal devices.
People also save it as a file or a printout during setup. Those copies matter when directory backup was skipped. Check the account pages first. Then ask the help desk to search AD by password ID. The eight character ID on the recovery screen identifies the right password when several exist.
Where BitLocker stores this, by platform
https://account.microsoft.com/devices/recoverykey
Personal devices and the default for non domain PCs. Each device entry lists its 48 digit password. Keep these logins separate from the encrypted PC.
Active Directory: computer object > ms-FVE-RecoveryInformation
Domain joined PCs store passwords as child recovery objects under the computer account. Admins read them from the BitLocker Recovery tab or with Get-ADObject.
Frequently asked questions
How do I find a lost BitLocker recovery key?
Sign in at the Microsoft devices recovery key page for personal devices, check Entra admin center or Intune for work devices, or open the computer object BitLocker Recovery tab in AD Users and Computers.
How do I back up a key to AD after encryption?
Run manage-bde with the protectors get flags to list key IDs, then back up with the adbackup flag and the matching ID. That pushes the current password to AD without reencrypting.
Is the key an attribute on the computer object?
No. Recovery passwords are stored as child ms-FVE-RecoveryInformation objects under the computer object, not as a simple attribute. Use the Recovery tab or Get-ADObject to read them.
Notice an outdated path? Let us know.