Step 1: Sign in and open Manage BitLocker
Once Windows is loaded, press Win and type Manage BitLocker.
You should see the system drive (usually C:) listed with a status of 'BitLocker on'.
Step 2: Suspend BitLocker
Click Suspend protection next to the C: drive. Confirm Yes.
Suspending does not decrypt the drive — it just lets Windows boot without the recovery key while you finish whatever change is upsetting BitLocker.
Tip
If 'Suspend protection' is greyed out, open Command Prompt as administrator and run
manage-bde -protectors -disable C:Step 3: Finish the change that triggered the prompt
Common cases:
- Pending BIOS/UEFI/firmware update — apply it and reboot fully.
- Pending Windows update — install all updates from Settings → Windows Update and reboot.
- Recently changed Secure Boot or boot order — set it back to its original value.
- Replaced motherboard or TPM module — let Windows reboot once with BitLocker suspended so it can re-bind to the new TPM.
Step 4: Resume protection
Open Manage BitLocker again and click Resume protection. The status should return to 'BitLocker on'.
Reboot one more time. If you are not prompted for the recovery key, you are sorted.
Step 5: Verify your recovery key is backed up
Click Back up your recovery key next to the C: drive.
Save it to your Microsoft account, print a copy and store it with important documents, or save to a USB you keep somewhere safe — never on the encrypted drive itself.
Important
Do not skip this step. You will need the key the next time a firmware update happens.
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers