Only one recover key is listed after manage-bde.exe -protectors -get c:

Question

I have a TPM module on HP probook local machine (not AD member) I follow tenforums guide to backup recovery key. and discover only one recover key after manage-bde.exe -protectors -get c: BitLocker Drive Encryption: Configuration Tool version 10.0.17134 Copyright (C) 2013 Microsoft Corporation. All rights reserved.

  Volume C: []
  All Key Protectors

     TPM:
     ID: {8C58CE07-ХХХХ-ХХХХ-ХХХХ-ХХХХХХХХХХХХ}
     PCR Validation Profile:
         0, 2, 4, 11

     Numerical Password:
     ID: {CBA7AE98-ХХХХ-ХХХХ-ХХХХ-ХХХХХХХХХХХХ}
    Password:
      475651-000000-000000-000000-000000-000000-000000-000000

why the numerical pass is listed and not a TPM one?

UPD: Does it mean that drive can be unlocked by pass for TPM ID?

Answer 1

Your output shows two key slots or "protectors":

1. one key stored inside the TPM (or sealed using the TPM), with ID {8C58CE07…},
2. one key used for recovery, which is revealed in numeric form, with ID {CBA7AE98…}.

Windows deliberately does not reveal the actual key data (except the recovery key).

To unlock the disk, you need only one of the listed keys – they work as alternatives (all of them just decrypt the same "master" disk key). The disk can be unlocked using just the TPM-sealed key, with no user input at all – or, if the TPM breaks down, the disk can be unlocked using just the recovery key.

So you don't need to extract anything from the TPM – it is fully enough to back up just the numeric password that's shown.

Answer 2

You don't have a recovery key protector. You need to add it:

manage-bde -protectors C: -add -RecoveryPassword

Then you can retrieve it.

Answer 3

Numerical Password: is the recovery key. you DO need this in case your TPM chip fails or the system changes to recovery key mode, for example if you update the BIOS it may stop the TPM from being able to unlock the disk and ask you for the recovery key.