Microsoft Releases Device Encryption and BitLocker Key Backup and Recovery Guide for Windows 10/11
Brook.X
Since the era of Windows 8, some OEMs have been defaulting to enabling Microsoft BitLocker device encryption functionality, enhancing device security. However, for some non-professional users, the issue of recovery keys might not be clear.
Normally, if a user logs into the system with a Microsoft online account, the recovery key is automatically saved to the account center. However, there have been instances where the recovery key was not found in the account center, and the only solution provided by Microsoft technical support was to reinstall the system, leading to a loss of all user data.
Starting with the Windows 11 24H2 version, the system will default to enabling device encryption functionality, meaning most devices, whether home or enterprise editions, will be automatically encrypted. This is no longer an optional matter for OEMs.
Therefore, Microsoft has now released a detailed guide explaining where the encryption key is saved after device encryption. In cases of anomalies, such as automatically entering the BitLocker recovery interface, users can decrypt using the recovery key.
If you log into the system with a Microsoft personal account:
- When the system is abnormal and the BitLocker recovery key input interface appears, use another internet-connected device to open: https://account.microsoft.com/devices/recoverykey
- Log in with your Microsoft personal account, then find the device name and corresponding Key ID under BitLocker recovery Keys, and manually enter the key into the problem device to decrypt.
Note: If the device belongs to or was set up by someone else, the recovery key might be saved in that person's account, and you might not see the recovery key in your own account center.
If you log into the system with a work or school account:
- When the system is abnormal and the BitLocker recovery key input interface appears, use another internet-connected device to open: https://account.microsoft.com/devices/recoverykey
- Log in with your work or school account, select the device, and retrieve the recovery key for the device. You can then use this key to unlock the device.
Microsoft recommends users print the recovery key and back it up on a USB drive:
Backing up the recovery key is important. Once the device is encrypted, users can still verify the recovery key's validity through BitLocker. Users can print the recovery key and back it up on a USB drive.
- Click on the Start menu, type BitLocker, and select Manage BitLocker
- In BitLocker, select the option to back up your recovery key next to the disk encryption key
- Choose a backup location: including Microsoft account / Save to file / Save to USB drive
The recovery key only requires a few KB of storage space, allowing you to easily back it up on your USB drive. However, be careful not to format the USB drive and delete the key, as it will be needed for future decryption.
