# How to Fix the BitLocker Recovery Key Loop in Windows 11 URL: https://www.mytechnician.tech/tips/fix-bitlocker-recovery-key-loop-windows-11/ Published: 2026-08-05 | Author: Ankit Kumar Tags: Windows 11, Security, Troubleshooting, Fix, Data Recovery Summary: Windows keeps asking for a BitLocker recovery key at every boot? Here is where to find your key, how to get back in, and how to stop the prompt returning. ## The Problem You power on and get a blue **BitLocker recovery** screen asking for a 48-digit key instead of your desktop. You find the key, type it in, Windows starts — and the next boot asks again. BitLocker seals its decryption key inside the TPM chip, and the TPM only releases it when the boot environment measures exactly as it did when encryption was switched on. Change anything in that measurement and the TPM refuses, so BitLocker falls back to asking a human. Common triggers: a BIOS or firmware update, toggling Secure Boot or CSM, changing the boot order, adding or removing hardware, docking or undocking, a flat CMOS battery, or a Windows update that touched the boot manager. Windows 11 also turns on **device encryption automatically** on many machines during setup, so plenty of people meet this screen without ever having chosen to use BitLocker. > **Be clear about one thing before you start:** there is no way to bypass this screen without the recovery key. Microsoft cannot recover it for you, and neither can anyone else. The key exists in one of the places in Step 1 or it does not exist at all — so work through that list carefully. ## Symptoms * A blue **"Enter the recovery key to get going again"** screen at every boot. * A **Key ID** shown on screen — the first eight characters of the identifier you need to match. * Prompts started right after a BIOS update, a hardware change, or a Windows update. * The same key works each time, but the prompt keeps coming back. ## Step 1: Find Your Recovery Key Note the **Key ID** shown on the recovery screen first — if more than one key is stored, that is how you pick the right one. 1. **Microsoft account** — on a phone or another PC, go to `account.microsoft.com/devices/recoverykey` and sign in with the same account used on the locked PC. This is where personal machines almost always have it. 2. **Work or school account** — sign in at `myaccount.microsoft.com`, open **Devices**, find the PC, and choose **View BitLocker keys**. Your IT team can also retrieve it. 3. **Printed or saved** — check for a printout, or a `BitLocker Recovery Key .txt` file on a USB stick or in your OneDrive files. 4. **Another PC signed into the same account** — open **Terminal (Admin)** there and run `manage-bde -protectors -get C:` for keys stored locally. 5. Type the 48 digits carefully. The screen accepts them in groups; the hyphens are added for you. ## Step 2: Check Whether the Drive Is Even Meant to Be Encrypted Once you are back in Windows, find out what is actually enabled. 1. Right-click **Start** → **Terminal (Admin)**. 2. Run: ``` manage-bde -status ``` 3. Read **Conversion Status** and **Protection Status** for each volume. `Protection On` means BitLocker is active. 4. Also check **Settings** → **Privacy & security** → **Device encryption**. If that toggle exists and is on, this is automatic device encryption rather than BitLocker you configured. 5. Background on the feature: [enable BitLocker drive encryption](https://www.mytechnician.tech/tips/enable-bitlocker-drive-encryption-windows-11/). ## Step 3: Save a Fresh Copy of the Key Somewhere You Control Do this before changing anything else. If a later step goes wrong, this is what gets you back in. 1. **Settings** → **Privacy & security** → **Device encryption** → **BitLocker drive encryption** → **Back up your recovery key**. 2. Save it to your Microsoft account **and** to a printout or a file on a different device. 3. Or from **Terminal (Admin)**: ``` manage-bde -protectors -get C: ``` Copy the full 48-digit **Numerical Password** and the ID beside it. 4. Do not store the only copy on the encrypted drive itself — you cannot read it when locked out. 5. Somewhere safe means an actual password manager: [use a password manager safely](https://www.mytechnician.tech/tips/use-a-password-manager-safely/). ## Step 4: Reseal the Key to the Current Boot State This is the fix for a loop caused by a legitimate change you have already made. Turning protection off and on again re-measures the boot environment and stores a fresh seal in the TPM — it does not decrypt the drive. 1. In **Terminal (Admin)**: ``` manage-bde -protectors -disable C: ``` 2. Reboot to confirm it starts without prompting. 3. Turn protection back on: ``` manage-bde -protectors -enable C: ``` 4. Reboot again. The prompt should now be gone. 5. Check with `manage-bde -status` that **Protection Status** reads `Protection On` — if you stop after step 1, the drive stays encrypted but unprotected. ## Step 5: Undo the Firmware Change That Triggered It 1. Enter firmware setup: [how to enter BIOS or UEFI](https://www.mytechnician.tech/tips/how-to-enter-bios-uefi-windows-11/). 2. Confirm **Secure Boot** is **Enabled** and **CSM / Legacy Support** is **Disabled** — matching how Windows 11 was installed. See [enable TPM and Secure Boot](https://www.mytechnician.tech/tips/enable-tpm-secure-boot-windows-11-upgrade/). 3. Confirm the **TPM** is enabled and set to the same mode as before (fTPM/PTT on, not cleared). 4. Put the boot order back with **Windows Boot Manager** first. 5. If the PC keeps losing these settings between boots, the CMOS battery is flat — replacing it stops the loop. ## Step 6: Suspend BitLocker Before Future Firmware Updates This is the habit that prevents the whole problem returning. 1. Before a BIOS update, a TPM firmware update, or a motherboard change, run: ``` manage-bde -protectors -disable C: -RebootCount 2 ``` 2. `-RebootCount 2` suspends protection for the next two restarts and then re-enables it automatically — no need to remember. 3. Or use the graphical route: **Control Panel** → **BitLocker Drive Encryption** → **Suspend protection**. 4. Do the same before enabling or disabling Secure Boot, or clearing the TPM. 5. Keep the machine updated in a controlled way: [keep your devices updated safely](https://www.mytechnician.tech/tips/keep-your-devices-updated-safely/). ## Step 7: Check the TPM Is Healthy 1. **Windows + R** → `tpm.msc` → Enter. 2. **Status** should read *"The TPM is ready for use"*. If it reports the TPM is not found, the firmware setting was turned off — go back to Step 5. 3. Confirm the **Specification Version** is **2.0**, which Windows 11 requires. 4. ⚠️ **Do not use "Clear TPM" while BitLocker is on.** Clearing the TPM destroys the sealed key, and the only way back in is the 48-digit recovery key. If you must clear it, first fully decrypt the drive or suspend protection with Step 6 *and* confirm you have the recovery key saved elsewhere. ## Step 8: Decide Whether to Keep Encryption On 1. If the PC is a laptop or leaves the house, keep it on. Encryption is what makes a stolen machine useless to the thief. 2. If you decide to turn it off entirely, run: ``` manage-bde -off C: ``` Decryption runs in the background and can take hours. Keep the PC plugged in and let it finish. 3. Check progress with `manage-bde -status` until **Conversion Status** reads `Fully Decrypted`. 4. Consider re-enabling it afterwards with the key backed up properly: [enable BitLocker drive encryption](https://www.mytechnician.tech/tips/enable-bitlocker-drive-encryption-windows-11/). 5. Either way, keep real backups — encryption protects against theft, not against drive failure: [set up automatic backups](https://www.mytechnician.tech/tips/set-up-automatic-backups/). ## What Not to Do * **Don't clear the TPM to "reset" the prompt.** It permanently destroys the sealed key and locks you out unless you have the 48 digits. * **Don't run BitLocker "recovery key generators" or "bypass tools".** None of them work; the encryption is sound. They exist to install malware on people who are locked out and desperate. * **Don't leave protection suspended** after a firmware update. `manage-bde -status` showing `Protection Off` means the drive is encrypted but the key is stored unprotected. * **Don't store the recovery key only on the encrypted machine.** It is unreadable exactly when you need it. ## Still Not Working? If you genuinely cannot locate the key in any of the Step 1 locations, the data on that drive is not recoverable — that is by design. The remaining path is a clean install, which erases the drive: [how to clean install Windows 11](https://www.mytechnician.tech/tips/how-to-clean-install-windows-11/). Before doing that, check every Microsoft account you have ever used on the machine, and any work account, since the key is stored per-account. Related: [fix Windows Hello "PIN is not available"](https://www.mytechnician.tech/tips/fix-windows-hello-pin-not-available-windows-11/), [fix "Boot Device Not Found (3F0)"](https://www.mytechnician.tech/tips/fix-boot-device-not-found-3f0-windows-11/), and [set up account recovery options](https://www.mytechnician.tech/tips/set-up-account-recovery-options/). --- Source: https://www.mytechnician.tech/tips/fix-bitlocker-recovery-key-loop-windows-11/ — My Technician, free Windows 10/11 troubleshooting guides. More guides: https://www.mytechnician.tech/llms.txt