A BitLocker recovery key is a 48-digit numerical password generated automatically when BitLocker encryption is turned on for a drive. Each BitLocker-protected drive has its own recovery key. When BitLocker cannot verify the normal boot environment, it enters recovery mode and prompts the user for this key before mounting the drive.
The key is tied to the encrypted drive or volume, not the machine. Moving a BitLocker-protected disk to another computer still requires the same recovery key that was generated when encryption was first enabled.
BitLocker is the full-volume encryption feature built into Windows. When BitLocker is active on a drive, Windows generates a unique 48-digit numeric recovery key that can unlock the drive if normal authentication fails (for example, after a firmware update, a Trusted Platform Module (TPM) change, or other changes to the device's environment).
The BitLocker recovery key ID is an identifier that Windows displays on the BitLocker recovery screen. It is shown as a portion of a GUID (for example, 4C0B4B27-...). Its purpose is to help you identify the correct recovery key when multiple keys are stored in the same account or directory, such as a Microsoft account or Active Directory (AD).
The recovery key ID does not unlock the drive. The 48-digit recovery key is what you need to unlock a BitLocker-protected drive, so it should be kept secure.
This article covers every method for finding or retrieving a BitLocker recovery key: through a Microsoft account; from local storage; using PowerShell on the local device or against AD; using Windows' built-in tools, such as Active Directory Users and Computers (ADUC), Active Directory Administrative Center (ADAC), and the command line; and using ManageEngine ADManager Plus for enterprise-scale BitLocker recovery key reporting.
Open PowerShell as an administrator. Ensure the AD module is installed. If it is not, install the Remote Server Administration Tools package for your Windows version and import the module:
Import-Module ActiveDirectory
Run the following command to retrieve the recovery key for all BitLocker-protected volumes on the local machine:
$BitLockerVolumes = Get-BitLockerVolume
$BitLockerVolumes | ForEach-Object {
$MountPoint = $_.MountPoint
$RecoveryKey = ($_.KeyProtector |
Where-Object { $_.KeyProtectorType -eq "RecoveryPassword" }).RecoveryPassword
if ($RecoveryKey) {
Write-Output "Drive $MountPoint recovery key: $RecoveryKey"
}
}
This retrieves all BitLocker-protected volumes on the local machine and outputs the recovery password for each. The filter on KeyProtectorType ensures that only recovery passwords are returned, excluding other protector types such as a TPM or PIN.
When Group Policy has escrowed the recovery key to AD, the key is stored as an msFVE-RecoveryInformation child object on the computer object. Run the following command, replacing WORKSTATION01 with the target computer name:
$ComputerName = "WORKSTATION01"
$ComputerDN = (Get-ADComputer -Identity $ComputerName).DistinguishedName
Get-ADObject -Filter { objectClass -eq "msFVE-RecoveryInformation" } `
-SearchBase $ComputerDN `
-Properties msFVE-RecoveryPassword, msFVE-RecoveryGuid, whenCreated |
Select-Object Name,
@{N="RecoveryKey";E={$_."msFVE-RecoveryPassword"}},
@{N="KeyID";E={$_."msFVE-RecoveryGuid"}},
whenCreated
This queries AD for all recovery objects stored under the specified computer's distinguished name (DN) and returns the recovery password, key GUID, and creation date.
Run the following command to retrieve recovery keys for all computers across the domain and export them to a CSV:
Get-ADObject -Filter { objectClass -eq "msFVE-RecoveryInformation" } `
-SearchBase (Get-ADDomain).DistinguishedName `
-Properties msFVE-RecoveryPassword, msFVE-RecoveryGuid, whenCreated |
Select-Object @{N="ComputerDN";E={($_.DistinguishedName -split ",",2)[1]}},
@{N="RecoveryKey";E={$_."msFVE-RecoveryPassword"}},
@{N="KeyID";E={$_."msFVE-RecoveryGuid"}},
whenCreated |
Export-Csv -Path .\ADbitLockerKeys.csv -NoTypeInformation
This queries the entire domain for all BitLocker recovery objects and exports the computer DN, recovery key, key ID, and creation date to a CSV. Run this from a domain controller or a machine with the AD PowerShell module and sufficient read rights.
When the user can report the key ID shown on the locked machine's recovery screen, use it to locate the specific key in AD:
$KeyID = "4C0B4B27-1234-5678-ABCD-1234567890AB"
Get-ADObject -Filter { objectClass -eq "msFVE-RecoveryInformation" } `
-Properties msFVE-RecoveryPassword, msFVE-RecoveryGuid |
Where-Object { $_."msFVE-RecoveryGuid" -eq $KeyID } |
Select-Object Name,
@{N="RecoveryKey";E={$_."msFVE-RecoveryPassword"}}
Replace the $KeyID value with the GUID shown on the locked machine. This returns only the matching recovery key object.
The following essential parameters can be used when retrieving BitLocker recovery information from AD:
| Parameter | Description |
|---|---|
| -Identity | Specifies the identity of the AD computer from which to retrieve BitLocker recovery information |
| -Filter | Specifies a query to find BitLocker recovery objects that match specified conditions, such as objectClass -eq "msFVE-RecoveryInformation" |
| -SearchBase | Limits the search to a specific AD container, OU, or computer object |
| -Properties | Specifies the additional AD attributes to retrieve, such as msFVE-RecoveryPassword, msFVE-RecoveryGuid, and whenCreated |
| -Path | Specifies the location and file name where the retrieved BitLocker recovery information is exported |
| -NoTypeInformation | Prevents PowerShell from adding type information to the exported CSV file |
ADUC lets administrators view BitLocker recovery information stored on a computer object, provided the key was escrowed to AD by Group Policy.
If the BitLocker Recovery tab doesn't appear, the computer's recovery key was not escrowed to AD. Check the other storage locations described above.
ADUC provides the same BitLocker recovery lookup as ADUC with a more modern interface, and it supports a global search that can be faster than navigating the directory tree.
Command Prompt does not include a utility that retrieves the 48-digit recovery password directly. However, manage-bde.exe can display key protector types and IDs, which is useful for confirming a key ID before retrieving the full password through another method.
Open Command Prompt as an administrator and run the following:
manage-bde -protectors -get C:
This lists all key protectors on the C: drive, including the recovery password protector ID. It does not display the 48-digit recovery password. To retrieve the actual password, use PowerShell or one of the AD-based methods described above.
Note: There is no net command that retrieves BitLocker recovery keys. Queries to AD for BitLocker recovery objects must go through PowerShell (Get-ADObject) or an LDAP-capable tool.
ADManager Plus provides a built-in BitLocker Recovery Keys report under Computer Reports. The report queries AD for all msFVE-RecoveryInformation objects across the selected domain and OUs and presents them in a filterable, exportable table without requiring PowerShell scripting or command-line access.
Retrieving and managing BitLocker recovery keys across multiple computers can be time-consuming when you're using PowerShell and other native AD tools. ADManager Plus provides prebuilt reports and recovery key management capabilities that simplify common BitLocker-related tasks without requiring scripting. Using ADManager Plus, you can:
BitLocker may ask for a recovery key when it detects a change to the device's hardware, firmware, software, or boot environment that it cannot distinguish from a potential security risk. Changes such as a firmware update, TPM changes, Secure Boot changes, or boot configuration changes can trigger BitLocker recovery.
If you forgot your BitLocker password, you may still be able to unlock the drive using its 48-digit recovery key. Check your Microsoft account or contact your organization's IT administrator if the device is managed by your organization.
You can also retrieve the recovery key using PowerShell, Active Directory Users and Computers (ADUC), Active Directory Administrative Center (ADAC), or ADManager Plus, as shown here.
Yes, you can reset a Windows PC using Windows Recovery options if you cannot find the BitLocker recovery key. However, resetting the PC removes your files, so you should first try to locate the recovery key using any of the methods mentioned here.
The BitLocker Recovery tab in Active Directory Users and Computers (ADUC) is available when Advanced Features is enabled and BitLocker recovery information has been stored for the computer object in Active Directory.
If the tab is not visible, the recovery key may not have been escrowed to Active Directory, or the required BitLocker recovery information may not be available for that computer.
Yes. Using ManageEngine ADManager Plus, you can retrieve BitLocker recovery keys for multiple computers through its built-in BitLocker Recovery Keys report. Navigate to Reports > Computer Reports > BitLocker Recovery Keys, select the required domain and OU scope, and generate the report as shown here.
The report displays information such as computer names, recovery key IDs, and recovery passwords. You can also export the results to a CSV, PDF, or XLSX file, or you can schedule the report for recurring delivery.
You can export BitLocker recovery information from Active Directory using PowerShell.
Alternatively, ADManager Plus provides a centralized reporting approach without requiring PowerShell scripts. Navigate to Reports > Computer Reports > BitLocker Recovery Keys, select the required domain and OUs, generate the report, and click Export As to download the recovery key information in CSV, PDF, or XLSX format.
This can be particularly useful when administrators need to report on recovery keys across multiple computers or OUs. You can explore more about the reporting capabilities of ADManager plus here.