My Windows installation has Bitlocker protector PIN and TPM. I can enter the pre-boot PIN and the TPM is accessible, but the logon screen does not load properly. The partition is unlocked from my understanding but I see no way to backup the data without the recovery key:

  • If I boot a Windows To Go on the same Laptop (Secure Boot disabled to allow it to boot), Recovery Key is requested
  • If I use a different PC, obviously Recovery Key is requested, because TPM is not available
  • In recovery console manage-bde -unlock C: -Password does not work
  • If I use recovery mode to enable boot options (like safe mode), recovery key is required

As I can unlock the partition in pre-boot, how can I extract the recovery key without logging in in normal non-safe mode?

thank you

  • You can't extract the recovery key. if you could extract the recovery key, outside of Windows, it would make BitLocker insecure. There is a reason that any configuration changes will result in a prompt asking for the recovery key. Without the recovery key, and your inability to boot into Windows, data recovery is not possible.
    – Ramhound
    Mar 26, 2020 at 16:11
  • 1
    I CAN boot into windows, but I cannot login and use the Desktop for whatever reason. Why would it be insecure, I have the TPM and I know the PIN - If this was insecure, why would Windows allow this authentication method at all?! Mar 26, 2020 at 16:49
  • Try the command manage-bde -protectors C: -get and update the question, sanatize the output, if that solves your problem I will submit an answer.
    – Ramhound
    Mar 26, 2020 at 16:55
  • manage-bde returns that the partition needs to be unlocked to execute this command - if I would have shell/cmd access to the half-booted windows I would probably find a solution myself, but I don' see how that would be possible. manage-bde -status lists the following protectors 1. TPM and PIN 2. Numeric Password (Not sure weather Numeric Password is the correct term in English locale) Mar 26, 2020 at 19:21
  • Are you sure you don't have the recovery key? It is automatically uploaded to Microsoft (if you had a MS account) or to Active Directory. Mar 26, 2020 at 21:20

1 Answer 1


As I can unlock the partition in pre-boot, how can I extract the recovery key without logging in in normal non-safe mode?

In order to determine the recovery key for the drive you must unlock the drive with the following command:

manage-bde -unlock C: -Password

If that does not work then you will be unable to unlock the drive, which means you will be unable to display the recovery key for the drive, this limitation is an intentional security measure.

However, if you are indeed able to unlock the drive, then running the following command will display both the password and the recovery key for the drive:

manage-bde -protectors C: -get

If you know the password the to the drive, and you have access to another machine with a fully functional Windows installation, you might be able to unlock the drive and display the recovery key for the drive in question. I would clone the HDD, with a HDD cloner, before I actually attempted that solution.

  • As written before: If I could get a command prompt of the broken windows installation, this would solve my problem. The bitlocker recovery console cannot mount the volume, probably because the TPM can distinguish between the recovery console and the normal Windows installation and the USB-mounted Windows To Go. Mar 27, 2020 at 15:34
  • @dsfsdfdsf23 - I provided the only possible workaround to your problem. The bottom line is that without the recovery key your problem is extremely hard to solve. Microsoft's own documentation indicates it should be possible to solve this problem within WinRE, the fact you are unable to use the commands I suggested to unlock and view the recovery key, indicates a larger problem at play.
    – Ramhound
    Mar 27, 2020 at 15:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .