Policy

Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista)

Windows 11 25H2

Back to categoryOpen picker

Policy overview

Key metadata and intent for this policy.

ClassComputer
CategoryWindows Components > BitLocker Drive Encryption
Supported onWindows Server 2008 and Windows Vista

Supported OS tags: WindowsServer2008, WindowsVista

This policy setting allows you to control whether the BitLocker Drive Encryption setup wizard can display and specify BitLocker recovery options. This policy is only applicable to computers running Windows Server 2008 or Windows Vista. This policy setting is applied when you turn on BitLocker. Two recovery options can be used to unlock BitLocker-encrypted data in the absence of the required startup key information. The user either can type a 48-digit numerical recovery password or insert a USB flash drive containing a 256-bit recovery key. If you enable this policy setting, you can configure the options that the setup wizard displays to users for recovering BitLocker encrypted data. Saving to a USB flash drive will store the 48-digit recovery password as a text file and the 256-bit recovery key as a hidden file. Saving to a folder will store the 48-digit recovery password as a text file. Printing will send the 48-digit recovery password to the default printer. For example, not allowing the 48-digit recovery password will prevent users from being able to print or save recovery information to a folder. If you disable or do not configure this policy setting, the BitLocker setup wizard will present users with ways to store recovery options. Note: If Trusted Platform Module (TPM) initialization is needed during the BitLocker setup, TPM owner information will be saved or printed with the BitLocker recovery information. Note: The 48-digit recovery password will not be available in FIPS-compliance mode. Important: This policy setting provides an administrative method of recovering data encrypted by BitLocker to prevent data loss due to lack of key information. If you do not allow both user recovery options you must enable the "Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)" policy setting to prevent a policy error.

Internal name
ConfigureRecoveryUsage_Name
Policy ID
1d7428e7fc6c
Elements
2

Registry values

How enabled and disabled states update the registry.

No explicit registry values are set for enabled or disabled states.

Policy elements

Inputs and configuration options exposed by this policy.

ElementTypeRegistry mappingConstraints & behavior
Configure 48-digit recovery password:
ID ConfigureRecoveryPasswordUsageDropDown_Name
enum
HKLM\SOFTWARE\Policies\Microsoft\FVE\UseRecoveryPassword
Type REG_DWORD
Options: Require recovery password (default) (1), Do not allow recovery password (0)
Configure 256-bit recovery key:
ID ConfigureRecoveryKeyUsageDropDown_Name
enum
HKLM\SOFTWARE\Policies\Microsoft\FVE\UseRecoveryDrive
Type REG_DWORD
Options: Require recovery key (default) (1), Do not allow recovery key (0)

Other policies in this category

Explore related policies at the same level.