Recovery Key

Introduction

What a recovery key does

A generated 48-bit string is the fallback when a password is forgotten or hardware fails.

Why the recovery key matters

A recovery key is a 48-bit string used to unlock an encrypted hard drive when the password is forgotten. Even if the hardware is severely damaged, the drive's contents can still be recovered by installing it in another computer and providing the correct recovery key.

Once a BitLocker encryption policy is deployed, the configuration process begins during the PC boot, generating a recovery key automatically. Admins can create or modify BitLocker policies to keep the recovery key updated in the domain controller.

Backing up the key to the domain controller

1. Confirm the group policy (GPO) for all managed computers allows the recovery key to be updated in the domain controller — see BitLocker Group Policy Settings for details.
2. In the product console, go to BitLocker → Policy Creation → Create Policy and enable Update recovery key to domain controller. More on this setting in BitLocker policy creation.

Recovery keys can be retrieved two ways: through Endpoint Central's console, or through Active Directory Users and Computers.

Retrieval

Retrieving a key through Endpoint Central

If a user forgets their PIN or passphrase, an admin can look up the key by its identifier.

Find and retrieve the recovery key

1. Find the recovery key identifier under Managed Systems in the console — it identifies the recovery key for a specific computer.
   
2. Enter the recovery key identifier or computer name in the Retrieve Recovery Key section to access the key.
   

Export Recovery Key

Export Recovery Keys creates a secure, password-protected XLSX backup of every machine's recovery key, streamlining retrieval instead of looking each one up individually.

User authentication is required to download the exported file, to keep this sensitive recovery information secure.

Retrieval

Retrieving a key through Active Directory

ADUC works as a Remote Server Administration tool for pulling the key directly.

Retrieve the key via ADUC

Admins can manage Active Directory objects using the Active Directory Users and Computers (ADUC) console, which also works as a Remote Server Administration Tool (RSAT) for retrieving the recovery key from a Windows machine.

1. Open the Active Directory Users and Computers console.
2. Open the Properties tab of the managed computer.
3. Click BitLocker Recovery to display the recovery key and password ID.

Retention

Recovery key retention policy

A key doesn't disappear the moment a computer leaves management.

How long the server keeps a key

Even after the recovery key is retained on the Endpoint Central server, it can also be backed up in the customer's Active Directory — both Azure AD and on-premise AD. If a computer is removed from Scope of Management (SoM), the recovery key stays on the server for up to one year and can still be retrieved using the recovery key identifier.

Toggle recovery key retention on from the Retrieve Recovery Key page.