Jitsumi
Find us on Steam
Back to the blog

BitLocker recovery after a BIOS update: what to do next

BitLocker can ask for its recovery key after a BIOS or UEFI change because the TPM sees a different startup state. Learn what to check now and how to prepare before the next update.

Jitsumi

6 min read

Conceptual illustration linking a firmware chip, a protected laptop and an encrypted drive.
Author
  • Jitsumi
Published
Reading time
6 min

A BIOS or UEFI update finishes, the PC restarts, and Windows asks for a 48-digit BitLocker recovery key. That can happen when firmware or startup settings change what BitLocker checks before unlocking the drive. One prompt does not prove the PC was attacked or that the update failed.

If this is a work or school PC, contact IT before changing firmware or encryption settings. For a personal PC, use the matching recovery key, finish only the update you intended to install, and confirm BitLocker protection is back on. Do not clear the TPM or reset Windows just to dismiss the screen.

This guide covers Windows 11 and encrypted Windows 10 PCs. Standard support for Windows 10 Home and Pro ended on 14 October 2025, so treat those systems as older devices and follow the support route for their exact model.

Why a BIOS update can trigger BitLocker recovery

BitLocker can use a Trusted Platform Module (TPM) to check that the computer starts through the expected boot path. Firmware, Secure Boot settings, boot order and boot files can affect that check. If the measured startup state changes, the TPM may not release the drive’s unlock key automatically, so BitLocker asks for the recovery password.

Microsoft lists firmware changes among the possible causes of a recovery prompt. The prompt cannot tell you on its own whether the change was planned or unauthorised. A one-time prompt after a firmware update you initiated can be a normal consequence of that change; an unexpected or repeated prompt still needs investigation.

On Windows 11 version 24H2, press Alt on the recovery screen to see additional recovery information, if that screen is available. A boot-configuration or TPM error code can help you or your IT team narrow down what changed. It is a clue, not a complete diagnosis.

If the recovery screen is already open

  1. Record the recovery key ID. Note the first eight characters shown on the screen. The ID helps you choose the matching saved key; it is not the 48-digit key itself. Keep the full key private and do not post a photo of it.
  2. Check for boot media only if it applies. If a bootable USB drive is still connected and the firmware update has finished, remove it and try one normal restart. Microsoft lists bootable media as one possible cause of a changed startup measurement. Do not interrupt a firmware update that is still running.
  3. Use the matching recovery key. Check the key ID against the saved recovery record before entering the number. Our guide to finding a BitLocker recovery key covers personal and work or school accounts. Microsoft also explains how to find a BitLocker recovery key .
  4. If the key is accepted, let Windows start and check the update. Confirm that the manufacturer’s update process reported completion. Microsoft says a successful recovery can update BitLocker’s platform validation profile so a legitimate boot change does not trigger recovery at every restart.

If you did not initiate the firmware change, do not recognise the update, or see the prompt again after using the matching key, stop and contact the PC maker or your organisation’s IT team. Do not clear the TPM, turn Secure Boot off, or change several UEFI settings at random. Those actions can change the measured boot state again and make diagnosis harder.

If you cannot find the matching key, check the other likely account or backup and ask IT if the PC is managed. Do not reset or reimage the PC if you need its files: Microsoft says it cannot recreate a lost key, and resetting the device removes files.

Before the next BIOS or UEFI update

A short check before an update can prevent a long recovery session:

  1. Use the update for the exact PC model. Get firmware from the computer maker or the update route it documents. Read the release notes and recovery instructions before restarting.
  2. Make sure you can reach the recovery key without this PC. Check the relevant Microsoft account, work or school recovery route, or approved backup from another device. A copy saved only on the encrypted PC is not useful if that PC cannot start.
  3. Follow the instructions for this update path. Microsoft says updates delivered through Windows Update do not require manual BitLocker action. Some non-Microsoft firmware updates do require protection to be suspended; the answer can depend on what the update changes and whether BitLocker uses Secure Boot for integrity validation. Read the manufacturer’s instructions for your model. For a managed PC, let IT handle the update.
  4. Suspend protection only when the instructions call for it. In Windows Pro, Enterprise or Education, open Manage BitLocker, find the operating system drive and choose Suspend protection. Do not choose Turn off BitLocker. If the update utility says it handles suspension, follow that procedure and verify the result after Windows starts. Suspending does not decrypt the drive, but it temporarily reduces BitLocker’s normal boot protection: the volume key is protected by a clear key while the change is made. Keep that window limited to the firmware update.
  5. Resume and verify protection after the update. When Windows starts and the update is complete, open Manage BitLocker and choose Resume protection if it remains suspended. For an additional status check, run manage-bde -status C: in an elevated Command Prompt. Look for Protection Status: Protection On for the Windows drive. If the update requires multiple restarts, use the manufacturer’s specific instructions for the full restart sequence, then check protection after the final restart.

Microsoft’s BitLocker FAQ explains which update paths need manual action. Its recovery process guide covers firmware changes and recovery prompts, and the BitLocker operations guide shows how to suspend, resume and check protection status.

If Manage BitLocker is missing

The Manage BitLocker Control Panel is available on Windows Pro, Enterprise and Education. Windows Home can use Device Encryption, which uses BitLocker technology but has a different settings surface. Check Settings > Privacy & security > Device encryption if that option is available.

Do not assume encryption is off because the Control Panel applet is missing, and do not turn Device Encryption off as a substitute for suspending protection. Follow the update instructions for your exact model. If they do not explain how to handle encryption on your edition, ask the manufacturer or IT before proceeding.

The safe finish

After a planned firmware update, a matching recovery key can get you through a one-time prompt. The task is finished only when the firmware update has completed and BitLocker protection is on again. If the prompt was unexpected or keeps returning, leave the TPM and Secure Boot settings alone and get help diagnosing the change.

Sources and further reading

Continue reading

The blog