A warning for all Windows users about an issue that can lock you out of your computer

Yesterday, I received an email from a wonderful Windows tech support guy, Alan - someone I refer people to when they have hardware or very 'techie' issues with their Windows computer.

I had only recently referred an iTandCoffee client to him after she encountered a problem after she entered the wrong PIN/password for her computer too many times and was being asked for an encryption key to unlock it.

Alan has recently been contacted by more and more people who are encountering this same issue with their Windows computer, where they are locked out of their computer and asked to provided such an encryption key (one that they don't have recorded anywhere) to re-gain access. 

Apparently, this encryption - called Bitlocker - is being enabled under Windows 11 (and sometimes Windows 10) without the user realising.

Unfortunately, if your computer is locked by Bitlocker and no encryption key is provided, no tech support person will be able to unlock your computer. The computer will need to be wiped and Windows re-installed, with all data on the computer lost (unless is is stored by a cloud storage service).

Here is some more information about Bitlocker, how it can lock you out, how to (potentially) find your Bitlocker encryption key, and how to turn off this feature if you decide you don't want it.

What is Bitlocker

BitLocker is a security feature built into Windows that scrambles (encrypts) everything on a drive so nobody can read your files without the right key. Think of it like putting all your files into a locked safe that only opens with the right combination. If someone steals your computer or the drive, they can’t access your files without that key.

How Bitlocker can 'lock' your computer

If BitLocker is protecting your system drive (the drive that Windows boots from), Windows will ask for a PIN, password, or automatically unlock using a tiny secure chip on the motherboard called TPM. 

If something changes the computer’s startup environment (for example a wrong passcode/password entered too many times, a BIOS/UEFI update, changing boot settings, moving the drive to another PC, clearing the TPM, or sometimes a big Windows update), BitLocker may think the machine is no longer trusted and will ask for the recovery key before it will start Windows.

If you don’t have the recovery key, the drive stays locked and you can’t get to your files.

Common reasons you might see a recovery key prompt

• You entered the wrong computer PIN/password too many times.
• Rarely, a Windows update can trigger the prompt.
• You updated the UEFI/BIOS or changed a firmware setting.
• You moved the internal drive to another computer.
• You changed the boot order or attached different hardware.
• The TPM chip was cleared or reset.

How to unlock a computer when Bitlocker asks for a recovery key

You may be able to find your recovery key in one of these places (the place depends on how BitLocker was set up):

• Your Microsoft account online (if you saved it there): sign in at https://account.microsoft.com/devices/recoverykey and look for the key for that device.
• A printed copy you saved when you turned on BitLocker.
• A .txt or .bek file saved to a USB stick or another drive. Plug that USB into the locked computer and follow the prompts.
• Your organisation’s IT department (if the computer was set up by work or school — they may have the key).

Enter the recovery key exactly as shown. Once accepted, Windows will start and you’ll be able to get your files.

After unlocking, check why BitLocker asked for the key (e.g., recent BIOS update) and consider saving the recovery key somewhere safe if you don’t already have it.

⚠ IMPORTANT: If you cannot find the recovery key, the data on that drive may be unrecoverable. BitLocker’s whole purpose is to prevent access without the key.

How to check Bitlocker status and turn Bitlocker on or off

To check your computer's Bitlocker status, use the Search function of the Start menu and search for “Manage BitLocker”, then open the Bitlocker settings.

To Turn BitLocker ON:

1.  Go to Control Panel → System and Security → BitLocker Drive Encryption.
2.  Click Turn on BitLocker next to your drive.
3.  Choose how to unlock it (password or USB key).
4.  Save your recovery key somewhere safe — this is crucial!
5.  Follow the prompts to start encryption.

To Turn BitLocker OFF:

1.  Go to the same BitLocker Drive Encryption menu.
2.  Click Turn off BitLocker next to your drive.
3.  Windows will decrypt your drive — this may take time.

(Note that you can also do a search for Bitlocker settings in Settings. If you can't find it, use Control Panel, as described above.)

What to do before enabling Bitlocker

• Ensure you have a backup of important files.
• Choose where to store the recovery key (Microsoft account is convenient; printing and storing in a safe is also good).
• If it’s a work/school device, check with IT — they may require management of keys.
• Plug the device into power and do not interrupt the encryption process.

Some final tips

• Always save the recovery key in at least two safe places before encrypting.
• If you use a Microsoft account to save the key, you can retrieve it at https://account.microsoft.com/devices/recoverykey.
• If the computer is owned by your workplace or school, they may store the key for you — ask IT.
  
• Keep firmware (BIOS/UEFI) updates and hardware changes in mind — these can trigger a recovery prompt. If you plan a major change, save the recovery key first.
  
• If you get a recovery screen after a Windows update, use the recovery key — it usually resolves the issue.

Need help to check your Bitlocker status or find the key?

If you need help to check if your computer is impacted by this encryption or to find your encryption key, iTandCoffee can help.

​Here's where to look an appointment.