Error:

Javascript is disabled in this browser. This page requires Javascript. Modify your browser's settings to allow Javascript to execute. See your browser's documentation for specific instructions.

hp-support-head-portlet

Actions

HP Customer Support - Knowledge Base

hp-contact-secondary-navigation-portlet

Actions

hp-share-print-widget-portlet

Actions

Information

Need Windows 11 help?
Check documents and videos on compatibility, FAQs, upgrade information and available fixes. Windows 11 Support Center

Feedback

hp-concentra-wrapper-portlet

Actions

HP PCs - Using BitLocker or Finding the Recovery Key (Windows 10)

This document is for HP computers that support BitLocker Drive Encryption or Device Encryption.

Device encryption prevents unauthorized individuals from accessing your device and data. Your computer might support BitLocker Drive Encryption (in English) or Device Encryption (in English).

You can check whether your device supports standard BitLocker encryption or Device Encryption.

Be sure to save your recovery key, because it might be required after certain actions, such as a BIOS update.

Data protection with BitLocker Drive Encryption

BitLocker Drive Encryption is also known as standard BitLocker encryption.

BitLocker Drive Encryption is available on supported devices running the Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education operating systems.

note:
BitLocker Drive Encryption is not available on devices running the Windows 10 Home operating system.

If your device uses BitLocker Drive Encryption to encrypt your data, you must activate BitLocker.

During the activation process, you can select where to store the recovery key. This manual recovery key backup process is initiated when BitLocker is turned on.

Data protection with Device Encryption

Device Encryption is a feature-limited version of BitLocker that encrypts the entire system. Device Encryption is also known as BitLocker Device Encryption or BitLocker Automatic Device Encryption.

Device Encryption is available on supported devices running any Windows 10 operating system. It requires a TPM and Modern Standby support.

Windows automatically enables Device Encryption on devices that support Modern Standby (in English). Microsoft offers Device Encryption support on a broad range of devices, including devices that run Windows 10 Home edition. See Overview of BitLocker Device Encryption.

Device Encryption is enabled automatically when you either sign into your device with a Microsoft account or join with a corporate domain account.

The recovery key is uploaded to the Microsoft account or the corporate domain automatically.

Enabling BitLocker Drive Encryption or Device Encryption

Enabling BitLocker Drive Encryption

Sign in to Windows with an administrator account.
In Windows, search for and open Manage BitLocker.
Click Turn on BitLocker, and then follow any on-screen instructions.
When prompted, select an option to back up your recovery key.

note:
You can back up the recovery key later, if necessary. In Windows, search for and open Manage BitLocker, and then click Back up your recovery key.
Follow the onscreen instructions for your selected backup method. The options might vary depending on your BitLocker type.

note:
Microsoft does not recommend printing recovery keys or saving them to a file. Instead, Microsoft recommends using an Active Directory backup or a cloud-based backup. Cloud-based backup includes Azure Active Directory (Azure AD) and your Microsoft account.
- Save to your Microsoft account: Save the recovery key to your Microsoft account, to be accessed online.
- Save to your cloud domain account: Save the recovery key to your company's cloud domain.
- Save to a USB flash drive: Save the recovery key to a removable USB flash drive.
- Save to a file: Save the recovery key to a .txt file stored on your computer hard drive.
- Print the recovery key: Print a copy of the recovery key and store it in a safe location.
After saving the recovery key, follow the on-screen instructions to finish the BitLocker Drive Encryption process.

Enabling Device Encryption

Device Encryption can be enabled during your initial computer setup or any time after by signing in with your Microsoft account or by joining a domain.

Enabling Device Encryption during computer setup using a Microsoft account

Follow the on-screen instructions to set up your computer.
After agreeing to the End-User License Agreement (EULA), you are prompted to add or create your Microsoft account. Enter the email, phone number, or Skype username associated with your Microsoft account and then click Next, or click Create account and follow the on-screen instructions.
Enter your password, and then click Next.
Follow the on-screen instuctions to complete your computer setup.
After your computer setup is complete, you can verify that Device Encryption is enabled. In Windows, search for an open Settings.
Select Update & Security, and then select Device encryption. Device encryption is on and encrypting all present files and any files added to the system.

note:
In addition, if you search for an open File Explorer, a lock icon is displayed on the operating system drive.

Enabling Device Encryption after computer setup using a Microsoft account

Sign in to Windows with an administrator account.
In Windows, search for and open Settings, select Update & Security, and then select Device encryption.
Click Sign in with a Microsoft account instead. The Accounts page opens.

note:
If Device Encryption is enabled but has been turned off, click Turn on.
On the Accounts page, click Sign in with a Microsoft account instead.
Enter the email, phone number, or Skype username associated with your Microsoft account and then click Next, or click Create account and follow the on-screen instructions.
Enter your password, and then click Next.
Follow the on-screen instructions to finish your account setup, and then sign in to your Microsoft account.
After your computer setup is complete, you can verify that Device Encryption is enabled. In Windows, search for an open Settings.
Select Update & Security, and then select Device encryption. Device encryption is on and encrypting all present files and any files added to the system.

note:
In addition, if you search for an open File Explorer, a lock icon is displayed on the operating system drive.

Using the recovery key

Computers encrypted with BitLocker Drive Encryption or Device Encryption might require the entry of a recovery key after one of the following events:

BIOS update
A Microsoft Push Button reset
Disabling Secure Boot or Trusted Platform Module (TPM)
Hardware changes such as adding or removing video or network cards

Example of the recovery key request screen

For more examples, go to the BitLocker Recovery Guide Plan (in English).

Normally, you back up your recovery key when BitLocker is enabled. If you are enabling BitLocker Drive Encryption, manually select where to store the recovery key during the activation process. If you are enabling Device Encryption and you log in to your computer using a Microsoft account, the encryption starts automatically and the recovery key is backed up to your Microsoft account.

Retrieve, and then enter the recovery key to start continue using your computer again.

Retrieving the recovery key from your Microsoft account

When you sign in using a Microsoft account, Device Encryption starts automatically. If you use BitLocker Drive Encryption, you must have manually saved the recovery key to your Microsoft account to use this procedure. If there is a problem and you are unable to sign in, you must use the recovery key to sign in.

Using another computer or mobile device, go to https://windows.microsoft.com/recoverykey (in English).
In the Microsoft account option, click Sign in.
Follow the on-screen instructions to log in to your Microsoft account.
If you have multiple computers, you can identify the correct key by matching the Device Name.
Your recovery key is the recovery key with a Device Name that matches the Recovery key ID on the recovery prompt.
Type the recovery key into the Enter the recovery key... field in Windows, and then click Continue.

You can also access your recovery key by signing in to your Microsoft account through https://account.microsoft.com/account (in English).

Sign in with the Microsoft account you use on the computer that requires a recovery key.
Click All Devices, locate the device name that matches the computer with the encryption issue, and then click Show details.
Click Manage, and then select Get BitLocker recovery keys to get the key.
Your recovery key is the recovery key with a Device Name that matches the Recovery key ID on the recovery prompt.

Other options to retrieve your recovery key

Finding your recovery key depends on the method you used to back up the key. You can use the following backup options as a guide to locate your recovery key.

For more information, see Find my BitLocker recovery key (in English).

Use a cloud domain account

If your computer is connected to a domain, such as a school or work computer, your recovery might be saved to your school or work's cloud domain. If you cannot locate your recovery key, ask your system administrator assistance to find your recovery key. Be sure to tell your administrator your Recovery key ID from the recovery prompt on the computer.

Use a USB flash drive

If you saved your BitLocker recovery key to a USB flash drive, insert the USB flash drive into a USB port on your computer and follow the on-screen instructions.

If your instructions for the recovery key do not display automatically, you might have saved the recovery key as a text file. Insert the USB flash drive into a USB port on a different computer to open the text file (.txt).

Open a local file

The key might be saved as a local text (.txt) file stored on a non-encrypted hard drive on a different device. If the key is stored on your encrypted drive, you cannot access it.

Use a printed copy of the key

You might have printed out the recovery key when you set up device encryption. Check the location where you store computer-related information for a printout of your recovery key.

Use an Azure Active Directory account

If you ever used a work or school email account to sign into an organization with an Azure Active Directory (AD) account on your computer, your computer recovery key might be saved in that organization's Azure AD account associated with your email. You might be able to access your recovery key through that account, or you might be able to ask a system administrator to find your recovery key.

Access another Microsoft account

If there are multiple Microsoft accounts used on the same computer, such as when multiple users share one computer, sign in to another account with administrator privileges to unlock the computer with the recovery key.

hp-feedback-input-portlet

Actions

hp-feedback-banner-portlet

Actions

hp-country-locator-portlet

Actions

Country/Region: Middle East

hp-detect-load-my-device-portlet

Actions

hp-hero-support-search

Actions

Examples: "DeskJet Ink Advantage 4530 paper jam", "HP 240 G5 bluetooth"