iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If BitLocker keeps asking for its recovery key, first match the prompt’s recovery key ID to the correct 48-digit key. If the key unlocks Windows but the prompt returns after every restart, investigate recent firmware or hardware changes and the device’s boot order—especially whether it tries network boot before Windows Boot Manager. A recovery prompt alone does not mean the PC was attacked.
Get past the recovery screen with the matching key
- Write down the recovery key ID. Note the first eight digits displayed on the BitLocker recovery screen. The ID helps identify which saved recovery key belongs to this device; it is not the key itself. Microsoft’s key-finding instructions explain how to use it.
- Look for the corresponding 48-digit recovery key. Depending on how BitLocker was set up, check the Microsoft account associated with the PC, a work or school account, the organization’s IT department, a USB drive, a saved text file, or a printout. If another person configured the device or enabled encryption, check with them: the key may be saved in their account. See Microsoft’s guides to finding a key and backing one up.
- Enter the key that matches the ID. Avoid trying unrelated keys. If Windows starts, note what changed shortly before the prompt appeared so you can investigate why recovery was triggered.
Why BitLocker can ask for recovery
BitLocker may request recovery authentication when it detects a possible unauthorized access attempt or a change to hardware, firmware, or software. Such a prompt is a security check, not proof that someone attacked or accessed the computer. Microsoft’s BitLocker overview describes why recovery can be required after changes.
How often the prompt appears matters. A prompt immediately after an update that goes away after you enter the key is different from one that returns at every restart. Microsoft’s Secure Boot troubleshooting guide treats these as distinct scenarios.
If the key works once but Windows asks again after restart
Start with the timing: did this begin after a BIOS or firmware update, a Windows or other software update, or a hardware change? A one-time recovery prompt after an update may allow Windows to complete startup; later boots may proceed normally. Microsoft recommends checking for available firmware updates in its documented Secure Boot recovery scenarios. Use guidance for the exact device model and scenario rather than changing several firmware settings at once.
#1 Best Overall
- [MISSING OR FORGOTTEN PASSWORD?] Are you locked out of your computer because of a lost or forgotten password or pin? Don’t’ worry, PassReset USB will reset any Windows User Password or PIN instantly, including Administrator. 100% Success Rate!
- [EASY TO USE] 1: Boot PC from the PassReset USB drive. 2: Select the User account to reset password. 3: Click “Remove Password”. That’s it! Your computer is unlocked.
- [COMPATIBILITY] This USB will reset any user passwords including administrator on all versions of Windows including 11, 10, 8, 7, Vista, Server. Also works on all PC Brands that have Windows as an operating system.
- [SAFE] This USB will reset any Windows User password instantly without having to reinstall your operating system or lose any data. Other Passwords such as Wi-Fi, Email Account, BIOS, Bitlocker, etc are not supported.
If the prompt returns on every boot, check the boot path. Microsoft documents a PXE-related case in which firmware tries network boot before the local disk, then falls back to Windows Boot Manager. The different Secure Boot trust chains can leave BitLocker without stable TPM measurements to use when resealing protection.
Check for network-first boot
In the firmware setup, check whether PXE or network boot is ahead of the local Windows boot option. If network boot is not needed, set Windows Boot Manager on the local disk first or disable PXE. If an organization requires PXE, ask its administrator to verify that the infrastructure uses a compatible 2023-signed Windows boot loader. Menu names and available settings vary by device; follow the manufacturer’s instructions for the specific model.
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Consider recent firmware or Secure Boot changes
If the issue followed a firmware or Secure Boot change, use the device maker’s instructions and Microsoft’s scenario-specific guidance. Do not reset Secure Boot or restore firmware defaults as a general first fix: the right step depends on what changed, and a reset can create a separate certificate-trust problem.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →A documented 2026 Windows 10 update case is narrow
Microsoft’s July 14, 2026 notes for KB5099539, Windows 10 builds 19045.7548 and 19044.7548, describe a particular update-related recovery prompt. The documented conditions include BitLocker on the operating-system drive; a Group Policy validation profile that explicitly includes PCR7; System Information reporting PCR7 Binding as “Not Possible”; the Windows UEFI CA 2023 certificate in the Secure Boot database; and a device not yet using the 2023-signed Windows Boot Manager.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Microsoft says the key should be needed only once if the Group Policy configuration remains unchanged. This applies to that specified managed configuration; it is not a general explanation for every BitLocker loop. If the PC is managed by work or school, ask IT to check whether those conditions apply before changing policy or firmware settings.
Use USB recovery media only for the matching Secure Boot failure
Microsoft describes a separate, specific recovery procedure for a case where resetting Secure Boot to firmware defaults removes a certificate needed to trust the installed Windows boot manager. It is not a general remedy for a recovery prompt or PXE-first boot.
Rank #4
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
For that certificate-reset scenario, Microsoft’s guide describes obtaining SecureBootRecovery.efi on a second Windows PC, putting it on a FAT32-formatted USB drive under EFIBOOT with the filename bootx64.efi, then booting the affected device from the drive. Follow the guide and device-maker instructions for the exact case. After recovery, Microsoft advises installing available OEM firmware and avoiding another Secure Boot reset unless updated firmware defaults trust the required certificates.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If you cannot find the recovery key
Microsoft says it cannot retrieve, provide, or recreate a lost BitLocker recovery key. If the computer belongs to or is managed by an organization, contact its IT department; it may hold the recovery key. Otherwise, check the accounts and backups associated with the device, including those belonging to the person who configured it.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-A & NFC): The Thetis PRO-A features integrated USB Type A and NFC for a near-instant account unlock. Simply unfold the key and hold it to your smartphone’s NFC antenna to authenticate on the go.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
If the key is missing and you cannot undo the change that triggered recovery, Microsoft’s guidance is to reset the device using a Windows recovery option. Resetting removes files. Do not proceed unless you understand and accept the data-loss consequence; consult Microsoft’s recovery-key guidance for the applicable options.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
