Fix BitLocker Asking for a Recovery Key on Every Boot

Before you begin

Match the environmentUse this guide only for Windows 10, Windows 11 or a clearly compatible setup.

Protect recoveryBack up important data and save encryption or account recovery keys before changing system state.

Know when to stopThis guide includes advanced changes. If the device contains irreplaceable data or belongs to an employer, stop and use a qualified technician.

Problem overview

Windows requests the 48-digit BitLocker recovery key at every startup. This usually means the Trusted Platform Module (TPM) sees a boot measurement that differs from the state recorded when BitLocker protection was enabled.

Critical

Do not clear the TPM, delete BitLocker protectors, disable Secure Boot, or flash firmware until you have verified a working recovery key. Without that key, a wrong change can make the encrypted drive inaccessible.

Common causes

A recent BIOS or UEFI update
Secure Boot, TPM, boot-order, or storage-mode changes
A dock, external boot device, or hardware change affecting startup
TPM or firmware errors
A managed organization policy

Step 1: Verify and preserve the recovery key

On the recovery screen, record the Recovery key ID. This identifier is not the secret key.
Find the matching key in your Microsoft account, work or school account, printed copy, saved USB drive, or through your organization administrator.
Enter the key and confirm Windows starts normally.
Save a second protected copy before changing any protector or firmware setting.

If no matching key exists, stop. FixingBook cannot recover BitLocker encryption, and Microsoft cannot recreate a lost key.

Step 2: Identify what changed

After signing in, open Command Prompt as administrator and run:

manage-bde -status C:
manage-bde -protectors -get C:

Confirm that protection is on and that a TPM-based protector exists. Then review what changed immediately before the first prompt: firmware update, Secure Boot setting, storage controller mode, boot order, hardware replacement, or a newly attached bootable device.

Step 3: Reseal BitLocker after a known legitimate change

Use this only after Windows starts successfully and the current firmware settings are the intended settings.

Suspend protection for one restart:

manage-bde -protectors -disable C: -RebootCount 1

Restart once with unnecessary USB storage and docks disconnected.
Sign in and check status:
```
manage-bde -status C:
```
Confirm that protection automatically resumed and restart once more to test.

Expert Tip

The Control Panel path Manage BitLocker → Suspend protection performs the same temporary operation. Resume protection after the intended firmware or hardware change is complete.

Step 4: If the prompt returns

Restore the previous known-good BIOS settings only if you know which setting changed. Do not guess between AHCI/RAID, UEFI/Legacy, or Secure Boot modes.
Check the computer manufacturer’s support page for a TPM or firmware advisory for the exact model.
On a managed device, contact the organization administrator; policy or centrally stored protectors may control recovery.
If Windows reports TPM errors, preserve the recovery key and use the device manufacturer’s support process before clearing or replacing the TPM.

Sources

Confirm the result

Repeat the exact action that originally triggered the problem.

Confirm the original error or symptom is gone and no new warning has appeared.

If the guide changed a driver, service, package, or system setting, restart once and test again.

If the result is worse or unexpected, stop. Reverse only the last change using its documented restore option; if none is documented, use your backup or qualified support.

Questions about this fix

Where can I find my BitLocker recovery key?

Check the Microsoft account, work or school account, printout, USB drive, or administrator that originally enabled BitLocker. The recovery screen's key ID helps identify the correct key.

Should I clear the TPM to stop the prompt?

No. Clearing the TPM can remove keys used by BitLocker and other security features. Diagnose the changed boot measurement first and keep a verified recovery key available.