Windows Server 2022 — BitLocker Recovery Key Prompt Appears at Every Boot — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Quick Checks
3. Deep Diagnosis
4. Primary Fix
5. Verification
6. Prevention & Hardening

Symptom & Impact

Servers repeatedly request BitLocker recovery keys on restart, delaying automated patch cycles and remote operations. This often follows firmware, boot order, or TPM measurement changes. Frequent manual intervention increases operational risk.

Quick Checks

Inspect protector types, TPM readiness, and recent boot configuration changes.

manage-bde -status C:
Get-BitLockerVolume -MountPoint C:
Get-Tpm
bcdedit /enum

Deep Diagnosis

Analyze event traces for PCR mismatch and ensure recovery keys are escrowed correctly in AD/Azure AD.

Get-WinEvent -LogName 'Microsoft-Windows-BitLocker-BitLocker Management/Operational' -MaxEvents 120
Get-ADObject -Filter 'objectClass -eq "msFVE-RecoveryInformation"' -SearchBase 'CN=Computers,DC=contoso,DC=local'

Primary Fix

Suspend protection for planned maintenance, update TPM protectors, then resume and rotate recovery passwords.

Suspend-BitLocker -MountPoint C: -RebootCount 1
manage-bde -protectors -delete C: -type TPM
manage-bde -protectors -add C: -tpm
Resume-BitLocker -MountPoint C:

Verification

Subsequent boots should proceed without recovery prompt and protector metadata must show healthy state.

Get-BitLockerVolume -MountPoint C: | Select ProtectionStatus,KeyProtector
manage-bde -protectors -get C:

Prevention & Hardening

Coordinate firmware updates with BitLocker suspension workflow and enforce key escrow auditing.

Get-TpmEndorsementKeyInfo
manage-bde -protectors -adbackup C: -id {REPLACEME}
Get-WinEvent -LogName System -MaxEvents 30 | Where-Object {$_.ProviderName -match 'BitLocker|TPM'}