If BitLocker asks for recovery on every restart, first use the recovery key that matches the recovery key ID on screen. Once Windows starts, check what changed and whether the device is trying to boot from the network before its local Windows Boot Manager. A single recovery prompt after an update is different from a prompt that returns on every boot; neither, by itself, proves the PC was attacked.
Get past the recovery screen with the matching key
- Record the recovery key ID. Note the first eight digits shown on the recovery screen. The ID helps distinguish the correct saved key from other keys; the recovery key itself is a 48-digit number. See Microsoft’s instructions for finding a BitLocker recovery key.
- Check existing storage locations. Depending on how the PC was set up, look in the Microsoft account associated with setup, a work or school account, a USB drive, a saved text file, or a printout. If another person enabled encryption or configured the device, check with them: the key may be saved in their account. Microsoft also describes how to back up a BitLocker recovery key.
- Enter only the key matching the ID. If it unlocks Windows, note what changed shortly before the prompt began. If the computer belongs to an employer or school, contact its IT department for help locating the organization-managed key.
Why Windows may ask for recovery
BitLocker can request recovery authentication after detecting a possible unauthorized-access attempt or a change to hardware, firmware, or software. A prompt is a security measure, not evidence on its own that an attack occurred. Microsoft explains the mechanism in its BitLocker overview.
As an Amazon Associate I earn from qualifying purchases.
Think about recent changes such as a BIOS or UEFI update, Secure Boot settings, new or replaced hardware, boot-order changes, or a software update. The timing can help identify the trigger, but do not assume every recovery screen has the same cause.
Does the prompt happen once or on every restart?
It appeared once after an update or change
Enter the matching key and let Windows finish starting. A one-time prompt may not recur on later boots. Microsoft recommends checking for applicable device firmware updates in the Secure Boot recovery scenarios it documents; use guidance for your specific PC model rather than changing firmware settings at random. See the Secure Boot troubleshooting guide.
#1 Best Overall
- [MISSING OR FORGOTTEN PASSWORD?] Are you locked out of your computer because of a lost or forgotten password or pin? Don’t’ worry, PassReset USB will reset any Windows User Password or PIN instantly, including Administrator. 100% Success Rate!
- [EASY TO USE] 1: Boot PC from the PassReset USB drive. 2: Select the User account to reset password. 3: Click “Remove Password”. That’s it! Your computer is unlocked.
- [COMPATIBILITY] This USB will reset any user passwords including administrator on all versions of Windows including 11, 10, 8, 7, Vista, Server. Also works on all PC Brands that have Windows as an operating system.
- [SAFE] This USB will reset any Windows User password instantly without having to reinstall your operating system or lose any data. Other Passwords such as Wi-Fi, Email Account, BIOS, Bitlocker, etc are not supported.
The key works, but recovery returns after every restart
Check the boot path, especially on a device configured to start from a network (PXE) before its internal drive. Microsoft documents a scenario in which firmware tries network boot and then falls back to Windows Boot Manager. The different Secure Boot trust chains can prevent BitLocker from settling on stable TPM measurements, so the recovery prompt returns.
- If network boot is not needed, set the local Windows Boot Manager ahead of PXE in the firmware boot order, or disable PXE.
- If the organization requires PXE, ask its administrator to check that the required PXE infrastructure uses a compatible 2023-signed Windows boot loader.
- Follow instructions for the exact device and Secure Boot scenario. Do not reset Secure Boot or alter multiple firmware settings as a generic first fix.
The Secure Boot guide also recommends checking for available firmware updates in relevant recovery cases. Firmware menus and suitable updates vary by manufacturer and model.
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
A managed Windows 10 PC shows a one-time prompt after the July 2026 update
Microsoft’s notes for KB5099539, released July 14, 2026, describe a specific configuration that can trigger a recovery prompt. The documented conditions include BitLocker on the operating-system drive; a Group Policy validation profile that explicitly includes PCR7; “PCR7 Binding” reported as “Not Possible” in System Information; the Windows UEFI CA 2023 certificate in the Secure Boot database; and a device not yet using the 2023-signed Windows Boot Manager. Microsoft says the key should be needed only once if the Group Policy configuration remains unchanged. This narrow managed-device case does not explain every recurring prompt; ask your organization’s IT team to verify whether it applies.
If you cannot find the recovery key
Microsoft says it cannot retrieve, provide, or recreate a lost BitLocker recovery key. Check the accounts and backups associated with setup, and ask the device’s organization or the person who configured encryption if applicable. Microsoft’s guidance says that if the key is unavailable and the change that caused recovery cannot be undone, you must reset the device using a Windows recovery option. Resetting removes files. Do not proceed unless you understand the data-loss consequence and have checked whether the key can still be found.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
When a USB recovery procedure is appropriate
A USB procedure is not a general cure for a BitLocker recovery loop. Microsoft documents one narrow case: resetting Secure Boot to firmware defaults removed a certificate needed to trust the installed Windows boot manager. For that specific certificate-recovery scenario, its guide describes using SecureBootRecovery.efi from another Windows PC, placing it on a FAT32-formatted USB drive as EFIBOOTbootx64.efi, and booting the affected device from the drive. Follow the guide and device-specific instructions only if this is the identified failure scenario. After recovery, Microsoft advises installing available OEM firmware and avoiding a Secure Boot reset to defaults unless updated firmware defaults trust the required certificates.
Quick Recap
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-A & NFC): The Thetis PRO-A features integrated USB Type A and NFC for a near-instant account unlock. Simply unfold the key and hold it to your smartphone’s NFC antenna to authenticate on the go.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Rank #4
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
