BitLocker recovery keys: the conversation to have before any repair

Here is the most expensive sentence in Windows repair: "It never used to ask for a key." A machine that boots straight into a BitLocker recovery prompt (often exactly after a board repair, a BIOS update or a storage change) is doing what it is designed to do. Whether that machine is an inconvenience or a data loss depends entirely on one thing everyone should check before the repair starts: does someone have the recovery key?

Why it happens, especially around repairs

BitLocker binds the disk to measured parts of the machine: the TPM, the firmware, the boot configuration. Change enough of that (replace a board, flash a BIOS, move the drive) and Windows decides it cannot verify the machine's identity, so it stops and asks for the key. That is the security working. It also means board-level repair is a BitLocker event, and the key conversation is part of intake, not something discovered after the work is done.

Where the key actually lives

• The customer's Microsoft account: account.microsoft.com/devices/recoverykey. This is where personal machines almost always have it, and most customers do not know it.
• Work or school accounts: managed machines often have escrow through Entra/Azure AD; the IT department can retrieve it.
• A printout, a USB stick, a text file: the old-school backups, surprisingly common.
• Nowhere: the scenario this page exists to prevent.

If there is no key: the honest answer

Without the recovery key, modern BitLocker-protected data is cryptographically inaccessible. There is no bypass, no tool, no lab. Anyone claiming otherwise is either confused or lying. The machine itself can still often be repaired and returned running, but the existing Windows installation's data is gone; a fresh install starts over. Saying this plainly, before money changes hands, is the difference between an unhappy customer and a furious one.

The intake ritual for shops

1. Ask before repair: "Is BitLocker on, and do you have your recovery key?" Have the customer find it while the machine is still in front of you.
2. Record it (or note that it exists and where it is) on the job sheet, not because it is secret from the bench, but because "the customer has it" is the fact that decides repair-or-recovery later.
3. If the machine will not boot, this conversation happens on the phone, before it is booked in.

At this bench the same rule applies to our own work: keys are used only when a repair needs them, and they live on your ticket, not in anyone's notebook. The dead laptop data guide covers the Mac-side equivalent (FileVault) and the wider playbook.