Padlock on a laptop keyboard — Photo: Closed lock on laptop (49918711713) by Yuri Samoilov, CC BY 2.0, via Wikimedia Commons

You switch on your Lenovo laptop and, instead of Windows, you get a blue screen titled BitLocker recovery asking you to enter a recovery key. Many people have never knowingly turned BitLocker on, so this comes as a shock. The good news is that it is usually not a fault, and your files are still there. The bad news is that you need the recovery key to get in, and nobody, including Lenovo, Microsoft or a repair shop, can bypass it. Here is where to find the key and why the screen appears.

Why your laptop is encrypted

Most recent Lenovo laptops ship with Windows 11, which turns on encryption automatically on supported hardware when you sign in with a Microsoft account or a work or school account. On Windows 11 Home this is called Device encryption; on Windows 11 Pro it is full BitLocker. Either way, the drive is encrypted and the key is stored in the laptop’s security chip, called the TPM. Normally the TPM unlocks the drive silently every time you start up, so you never see it.

The recovery screen appears when the TPM sees something that could mean the laptop has been tampered with, and refuses to unlock the drive on its own.

Where to find the recovery key

The key is 48 digits long, in eight groups of six. The recovery screen shows a Key ID; the key you enter must have a matching ID.

Your Microsoft account. On another device, go to aka.ms/myrecoverykey and sign in with the Microsoft account you use on the laptop. If encryption was turned on automatically, the key is usually saved here.
Work or school laptops. If the laptop belongs to your employer, the key is normally stored by your IT department in Microsoft Entra ID (formerly Azure AD) or Active Directory. Contact them, and give them the Key ID shown on the screen.
A printout, file or USB stick. If you or whoever set up the laptop turned BitLocker on manually, Windows will have asked where to save the key. Check for a printed page, a text file named BitLocker Recovery Key on another computer or in cloud storage, or a USB stick.
Another Microsoft account. If the laptop was set up by a family member, or you have more than one account, check each of them.

Type the key using the number keys along the top row, or turn on Num Lock if your laptop has a number pad. The screen accepts digits only.

Common reasons the screen appears

A BIOS or firmware update. Updating the BIOS changes what the TPM measures at start-up. Windows usually suspends BitLocker during an update, but not always.
Changes in the BIOS settings. Turning Secure Boot off, changing the boot order, clearing the TPM or resetting the BIOS to defaults can all trigger it. On most Lenovo laptops the BIOS is reached with F1 (ThinkPad) or F2 (IdeaPad, Yoga, Legion) at start-up.
Booting with a USB stick or dock connected. A USB drive or docking station left plugged in can change the boot path. Unplug everything and restart.
Hardware changes or repairs. Replacing the motherboard always triggers recovery, because the TPM is part of the board. Some other repairs can trigger it too.
A flat battery or a power cut during an update.

Once you have entered the key, Windows normally starts as usual and the TPM takes over again. If the screen comes back on every start-up, something is still different, such as a USB device or a BIOS setting, or the system needs a BIOS or Windows update.

If you cannot find the key

We get asked this a lot, so it is worth being clear. BitLocker has no back door. Without the recovery key, the data on the drive cannot be read, by us or by anyone else. Removing the SSD and connecting it to another computer does not help either.

Your only option at that point is to reset the laptop: erase the drive and reinstall Windows. The laptop will then work normally, but the files on it are lost unless you have a backup in OneDrive or elsewhere. We can reinstall Windows with the correct Lenovo drivers for you as part of our software repair service.

How to avoid it next time

Check that encryption is on and where the key is. In Windows, go to Settings, then Privacy & security, then Device encryption, or search for Manage BitLocker on Pro.
Visit aka.ms/myrecoverykey now, while the laptop works, and make sure the key is there. Print a copy and keep it somewhere safe, away from the laptop.
Before a BIOS update or a change to BIOS settings, choose Suspend protection in Manage BitLocker. It resumes automatically after a restart.
Before any repair, tell the technician the laptop is encrypted and have the key ready. This is especially important for motherboard repairs and SSD upgrades.

When it is a hardware fault

If the recovery screen keeps appearing even after you enter the right key, or it started alongside other symptoms such as random restarts, the laptop not recognising the SSD, or error messages about the TPM, there may be a fault with the drive or the motherboard. We can diagnose this without erasing anything, and if the SSD itself is failing, our data recovery service can help, provided you have the recovery key.

Book a Lenovo repair

Bring your laptop to our London SE1 workshop (Monday to Saturday, 9am to 6pm), or we can arrange a courier collection from anywhere in the UK. Tell us the model and when the BitLocker screen started appearing, and we agree the price with you before any work starts.

Call 020 7394 2525, email info@creativeit.tv, or book a repair online.

‹ All Lenovo news