BitLocker Recovery Key on Boot: Fix in 3 Steps

1. TPM Changed or Was Reset (Most Common)

Your PC's TPM (Trusted Platform Module) holds a secret key that matches your BitLocker encryption. If the TPM gets reset, updated, or replaced, Windows doesn't recognize the PC anymore. So it asks for the recovery key. This happens a lot after a BIOS update, a motherboard swap, or even a weird shutdown.

What to do:

1. Find your recovery key first. Don't start messing with settings until you have it. The key is usually saved in your Microsoft account. Go to https://account.microsoft.com/devices/recoverykey on your phone or another computer. Sign in with the same Microsoft account you use on the locked PC. You'll see a 48-digit number. Write it down or take a picture.
2. On the locked PC, when you see the blue BitLocker screen, type that 48-digit key. Press Enter. Windows will boot normally.
3. Once you're in Windows, open a Command Prompt as administrator. Click Start, type cmd, right-click Command Prompt, choose "Run as administrator."
4. Type this command and press Enter:
   

   manage-bde -status

   You'll see a list of drives. Check the C: drive says "Protection On" and "Used Space Only Encryption."
5. Now tell Windows to trust this TPM again. Type this and press Enter:
   

   manage-bde -protectors -disable C:

   It'll ask for confirmation. Type Y and press Enter.
6. Restart your PC. It should boot without asking for a key.
7. After the restart, open Command Prompt as admin again and type:
   

   manage-bde -protectors -enable C:

   This re-enables BitLocker with the current TPM.

What you'll see: After step 5, the PC boots without the recovery screen. After step 6, BitLocker is active but won't ask for a key again unless the TPM changes again.

2. BIOS Update or Reset Changed Boot Settings

BIOS updates often reset your boot mode from UEFI to Legacy, or disable Secure Boot. BitLocker requires Secure Boot and UEFI mode to work right. If these get turned off, you'll get the recovery key prompt.

What to do:

1. Enter your BIOS setup. Restart your PC and press the key that opens BIOS—usually F2, F10, Del, or Esc. Look for "Boot" or "Security" menu.
2. Check that Secure Boot is set to Enabled or Standard. Not Disabled. Save changes and exit.
3. Check that Boot Mode is set to UEFI, not Legacy (sometimes called CSM). Save and exit.
4. If you changed anything, save and restart. Your PC should boot without the recovery key now.
5. If it still asks for the key, enter the recovery key from your Microsoft account (same as above). Once booted, open Command Prompt as admin and run:
   

   manage-bde -protectors -disable C:

   Restart. Then enable it with:
   

   manage-bde -protectors -enable C:

Real trigger: This happens a lot after a Windows update that also updates the BIOS. People wake up, see the recovery screen, and panic. But it's just the BIOS resetting a setting.

3. Boot Order Changed (USB or CD Left In)

If you left a USB drive, external hard drive, or DVD in your PC when you restarted, the BIOS might try to boot from that instead of your main drive. BitLocker sees the boot attempt from a different device and throws the recovery key prompt.

What to do:

1. Unplug any USB drives, external hard drives, SD cards, or remove any CDs/DVDs from your PC.
2. Restart the PC. If it boots normally, you're done. The fix was that simple.
3. If it still asks for the key, enter the recovery key from your Microsoft account.
4. Once booted, open Command Prompt as admin and run:
   

   manage-bde -protectors -disable C:

   Restart. Then enable protectors again with:
   

   manage-bde -protectors -enable C:

Why this works: BitLocker locks the boot process when it sees a different boot device. Removing the extra device and restarting clears the condition. But if the key was already triggered once, you'll need to enter it that one time.

Quick-Reference Summary Table