Where Are BitLocker Recovery Keys Stored?
BitLocker recovery key locations: Microsoft account, AD, USB and printouts.
Last updated
BitLocker recovery keys escrow to Microsoft accounts, Active Directory, USB sticks or printed pages depending on setup choices, never into a single local file by default. Protectors on the volume reference whichever escrow exists.
Verify escrow with manage-bde before TPM or motherboard changes. Recovery screens accept only the 48-digit key, not passwords or PINs.
Where Windows stores this, by platform
manage-bde -protectors -get C:
Command revealing protector IDs and escrow status per volume. Keys themselves live in Microsoft accounts, AD, USB files or printouts chosen at enable time. Back up numerical passwords to a second location before hardware changes.
Frequently asked questions
How do I find my BitLocker recovery key?
Check Microsoft account devices, AD admins, saved USB files or printouts from setup. The command above shows which protectors exist, not the key itself.
Why does BitLocker ask for recovery after BIOS updates?
Measured boot changed PCR values. Enter the 48-digit key once, then suspend and resume protection to reseal.
Notice an outdated path? Let us know.