BitLocker preboot recovery screen

• Şunlara uygulanır:

  ✅ Windows 11, ✅ Windows 10, ✅ Windows Server 2022, ✅ Windows Server 2019, ✅ Windows Server 2016

During BitLocker recovery, the preboot recovery screen is a critical touchpoint for users, offering a custom recovery message tailored to the organization's needs, a direct recovery URL for additional support, and strategic hints to assist users in locating their recovery key.

This article delves into the various elements displayed on the preboot recovery screen, detailing how policy settings and the status of recovery keys influence the information presented. Whether it's a personalized message or practical guidance, the preboot recovery screen is designed to streamline the recovery process for users

Default preboot recovery screen

By default, the BitLocker recovery screen displays a generic message and the url https://aka.ms/recoverykeyfaq.

Custom recovery message

With BitLocker policy settings, you can configure a custom recovery message and URL on the BitLocker preboot recovery screen. The custom recovery message and URL can include the address of the BitLocker self-service recovery portal, the IT internal website, or a phone number for support.

BitLocker policy settings configured with a custom recovery message.

BitLocker policy settings configured with a custom recovery URL.

For more information how to configure a custom recovery message with policy settings, see Configure preboot recovery message and URL.

Recovery key hints

BitLocker metadata includes information about when and where a BitLocker recovery key was saved. This information isn't exposed through the UI or any public API. It's used solely by the BitLocker recovery screen in the form of hints to help a user locate a volume's recovery key. Hints are displayed on the recovery screen and refer to the location where the key was saved. The hints apply to both the boot manager recovery screen and the WinRE unlock screen.

There are rules governing which hint is shown during the recovery (in the order of processing):

1. Always display custom recovery message, if configured via policy settings
2. Always display generic hint: For more information, go to https://aka.ms/recoverykeyfaq
3. If multiple recovery keys exist on the volume, prioritize the last-created (and successfully backed up) recovery key
4. Prioritize keys with successful backup over keys that have never been backed up
5. Prioritize backup hints in the following order for remote backup locations:
   • Microsoft account
   • Microsoft Entra ID
   • Active Directory
6. If a key has been printed and saved to file, display a combined hint Look for a printout or a text file with the key, instead of two separate hints
7. If multiple backups of the same type (remove vs. local) were done for the same recovery key, prioritize backup info with latest backup date
8. There's no specific hint for keys saved to an on-premises Active Directory. In this case, a custom message (if configured) or a generic message, Contact your organization's help desk, is displayed
9. If two recovery keys are present and only one backed up, the system asks for the backed up key, even if the other key is newer

Example: single recovery password saved to file and single backup

In this scenario, the recovery password is saved to a file

Important

It's not recommend to print recovery keys or saving them to a file. Instead, use Microsoft account, Microsoft Entra ID or Active Directory backup.

Example: single recovery password for Microsoft account and single backup

In this scenario, a custom URL is configured. The recovery password is:

• saved to Microsoft account
• not printed
• not saved to a file

Result: the hints for the custom URL and the Microsoft account (https://aka.ms/myrecoverykey) are displayed.

Example: single recovery password in AD DS and single backup

In this scenario, a custom URL is configured. The recovery password is:

• saved to Active Directory
• not printed
• not saved to a file

Result: only the custom URL is displayed.

Example: single recovery password with multiple backups

In this scenario, the recovery password is:

• saved to Microsoft account
• saved to Microsoft Entra ID
• printed
• saved to file

Result: only the Microsoft account hint (https://aka.ms/myrecoverykey) is displayed.

Example: multiple recovery passwords with sinlge backup

In this scenario, there are two recovery passwords.

The recovery password #1 is:

• saved to file
• creation time: 1PM
• key ID: 4290B6C0-B17A-497A-8552-272CC30E80D4

The recovery password #2 is:

• not backed up
• creation time: 3PM
• key ID: 045219EC-A53B-41AE-B310-08EC883AAEDD

Result: only the hint for the successfully backed up key is displayed, even if it isn't the most recent key.

Example: multiple recovery passwords with multiple backups

In this scenario, there are two recovery passwords.

The recovery password #1 is:

• Saved to Microsoft account
• Saved to Microsoft Entra ID
• creation time: 1PM
• key ID: 4290B6C0-B17A-497A-8552-272CC30E80D4

The recovery password #2 is:

• Saved to Microsoft Entra ID
• creation time: 3PM
• key ID: 045219EC-A53B-41AE-B310-08EC883AAEDD

Result: the Microsoft Entra ID hint (https://aka.ms/aadrecoverykey), which is the most recent key saved, is displayed.

Additional recovery information screen

Starting in Windows 11, version 24H2, the BitLocker preboot recovery screen enhances the recovery error information. The recovery screen provides more detailed information about the nature of the recovery error, empowering users to better understand and address the issue.

Users have the option to review additional information about the recovery error by pressing the Alt key.

The Additional recovery information screen contains an error category and a code, which you can use to retrieve more details from the next section of this article.

The next sections describe the codes for each BitLocker error category. Within each section there's a table with the error message displayed on the recovery screen, and the cause of the error. Some tables include possible resolution.

The error categories are:

• Initiated by user
• Code integrity
• Device lockout
• Boot configuration
• TPM
• Protector
• Unknown

Initiated by user

Error code	Error cause	Resolution
E_FVE_USER_REQUESTED_RECOVERY	The user explicitly entered recovery mode from a screen with the option to ESC to recovery mode.
E_FVE_BOOT_DEBUG_ENABLED	Boot debugging mode is enabled.	Remove the boot debugging option from the boot configuration database.

Code integrity

Driver signature enforcement is used to ensure code integrity of the operating system.

Error code	Error cause
E_FVE_CI_DISABLED	Driver signature enforcement is disabled.

Device lockout

Device lockout threshold functionality allows an administrator to configure Windows sign in with BitLocker protection. After the configured number of failed Windows sign in attempts, the device reboots and can only be recovered by providing a BitLocker recovery method.

To take advantage of this functionality, you must configure the policy setting Interactive logon: Machine account lockout threshold located in Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. Alternatively, use the Exchange ActiveSync MaxFailedPasswordAttempts policy setting, or the DeviceLock Configuration Service Provider (CSP).

Error code	Error cause	Resolution
E_FVE_DEVICE_LOCKEDOUT	Device lockout triggered due to too many incorrect sign in attempts.	A BitLocker recovery method is required to return to the sign in screen.
E_FVE_DEVICE_LOCKOUT_MISMATCH	The device lockout counter is out of sync.	A BitLocker recovery method is required to return to the sign in screen.

Boot configuration

The Boot Configuration Database (BCD) contains critical information for the Windows boot environment.

Error code	Error cause	Resolution
E_FVE_BAD_CODE_ID E_FVE_BAD_CODE_OPTION	BitLocker entered recovery mode because a boot application changed. BitLocker tracks the data inside the BCD and BitLocker recovery can occur when this data changes without warning. Refer to the recovery screen to find the boot application that changed.	To remediate this issue, restore the BCD configuration. A BitLocker recovery method is required to unlock the device if the BCD configuration can't be restored before booting.

For more information, see Boot Configuration Data settings and BitLocker.

TPM

The Trusted Platform Module (TPM) is cryptographic hardware or firmware used to secure a device. BitLocker creates a TPM protector to manage protection of the encryption keys used to encrypt your data.

At boot, BitLocker attempts to communicate with the TPM to unlock the device and access your data.

Error code	Error cause
E_FVE_TPM_DISABLED	A TPM is present but is disabled for use before or during boot.
E_FVE_TPM_INVALIDATED	A TPM is present but invalidated.
E_FVE_BAD_SRK	The TPM's internal Storage Root Key is corrupted.
E_FVE_TPM_NOT_DETECTED	The booting system doesn't have or doesn't detect a TPM.
E_MATCHING_PCRS_TPM_FAILURE	The TPM unexpectedly failed when unsealing the encryption key.
E_FVE_TPM_FAILURE	Catch-all for other TPM errors.

For more information, see Trusted Platform Module Technology Overview and BitLocker and TPM.

Protector

TPM protectors

The TPM contains multiple Platform Configuration Registers (PCRs) that can be used in the validation profile of the BitLocker TPM protector. The PCRs are used to validate the integrity of the boot process, that is, that the boot configuration and boot flow hasn't been tampered with.

BitLocker recovery can be the result of unexpected changes in the PCRs used in the TPM protector validation profile. Changes to PCRs not used in the TPM protector profile don't influence BitLocker.

Error code	Error cause	Resolution
E_FVE_PCR_MISMATCH	The device's configuration changed. Possible causes include: - A bootable media is inserted. Removing it and restarting your device might fix this problem - A firmware update was applied without updating the TPM protector	A recovery method is required to unlock the device.

For more examples, see BitLocker recovery scenarios.

Special cases for PCR 7

If the TPM protector uses PCR 7 in the validation profile, BitLocker expects PCR 7 to measure a specific set of events for Secure Boot. These measurements are defined in the UEFI spec. For more information, see Static Root of Trust Measurements

Error code	Error cause	Resolution
E_FVE_SECUREBOOT_DISABLED	Secure Boot has been disabled. To access the encryption key and unlock your device, BitLocker expects Secure Boot to be on.	Re-enabling Secure Boot and rebooting the system might fix the recovery issue. Otherwise, a recovery method is required to access the device.
E_FVE_SECUREBOOT_CHANGED	The Secure Boot configuration unexpectedly changed. The boot configuration measured in PCR 7 changed. This may be either because of: - An additional measurement currently present that wasn't present when BitLocker updated the TPM protector - A missing measurement that was present when BitLocker last updated the TPM protector but now isn't present - An expected event has a different measurement	A recovery method is required to unlock the device.

Unknown

Error code	Error cause	Resolution
E_FVE_RECOVERY_ERROR_UNKNOWN	BitLocker entered recovery mode because of an unknown error.	A recovery method is required to unlock the device.