The bitlocker is locked out on shared computer. How can I unlock the bitlocker?

For this shared production computer, record the BitLocker recovery key ID from the blue screen and have your IT/helpdesk retrieve the matching 48-digit recovery key from Microsoft Entra ID, Intune, or Active Directory.

Unlock the computer

1. On the BitLocker recovery screen, record:
   • The computer/device name, if displayed.
   • The first eight digits of the recovery key ID.
   The key ID identifies the correct recovery key; it is not itself the key.^1^
2. Contact your IT/helpdesk and provide:
   • The device name.
   • The recovery key ID.
   • The computer’s production-line location or asset number.
   Treat the recovery key as sensitive security information and do not post it here, email it broadly, or leave it near the computer.^2^
3. Have an authorized administrator retrieve the matching key using the applicable management system: If managed through Intune
   1. Open Microsoft Intune admin center.
   2. Select Devices → All devices.
   3. Select the production computer.
   4. Under Monitor, select Recovery keys.
   5. Select Show Recovery Key.
   6. Match its key ID to the ID displayed on the locked computer.^3^
   If stored directly in Microsoft Entra ID
   1. Open Microsoft Entra admin center.
   2. Go to Entra ID → Devices → All devices.
   3. Find and open the computer.
   4. Select Show Recovery Key.
   5. Copy the recovery key whose ID matches the locked screen.^4^
   Access requires the device owner or an appropriate administrative role, such as Helpdesk Administrator, Cloud Device Administrator, Intune Administrator, Security Administrator, or Security Reader. Viewing a key is audited.^4^ If the computer is domain-joined and its key is stored in on-premises Active Directory IT can retrieve it from the computer object using the BitLocker Recovery Password Viewer in Active Directory Users and Computers. Read access is required; by default, Domain Administrators have access unless it has been delegated.^2^
4. Enter the matching 48-digit recovery key on the locked computer. After Windows starts, IT should investigate why recovery was triggered and confirm that the current key is backed up centrally before returning the computer to production.

If the key is not in the organization’s systems

Check whether it was saved:

• In the work or school account: sign in from another device, select Devices, expand the relevant device, and select View BitLocker Keys.
• In the Microsoft account of the person who originally configured BitLocker.
• As a printed copy.
• On a USB drive or as a saved text file.^1^

The recovery screen cannot be bypassed without the correct key. Microsoft Support cannot retrieve, provide, or recreate a lost key. If no matching key exists, resetting or reinstalling Windows is the remaining option, and it removes the files on the encrypted drive.^1^ Do not reset this production computer until IT has confirmed that its printing software, configuration, certificates, templates, and production data can be restored.

References

1. Find your BitLocker recovery key | Microsoft Support
2. BitLocker recovery process
3. Encrypt Windows devices with BitLocker using Intune
4. Manage device identities using the Microsoft Entra admin center