Windows 11 BitLocker Recovery Every Reboot: Fix Boot Order First?

If Windows 11 prompts for a BitLocker recovery key on every reboot, the first thing to check is the boot order — yes, fix the boot order first. A misconfigured boot order (e.g., USB or another drive ahead of the Windows Boot Manager) is a common cause of repeated recovery prompts, and correcting it often resolves the issue without touching BitLocker itself.

Why Boot Order Causes BitLocker Recovery Loops

BitLocker ties its encryption to the specific hardware and boot configuration of your PC. When the firmware (UEFI/BIOS) boots from a different device than the one Windows expects, the TPM (Trusted Platform Module) does not release the encryption key, so Windows displays the recovery screen. This is a security feature, not a bug. Common triggers include:

A USB drive left plugged in that appears earlier in the boot order.
A secondary hard drive or SSD that contains a bootable partition.
Boot order changed after a BIOS update or CMOS reset.
Fast Boot or Secure Boot settings toggled unexpectedly.

If the boot order is wrong, Windows may still load (because the Windows Boot Manager is found on the correct disk eventually), but the TPM sees a different boot path and withholds the key. The result: a recovery key prompt every time.

How BitLocker and TPM Work Together

BitLocker uses the TPM to store the encryption key in a way that is bound to the boot configuration. When you turn on the PC, the TPM checks the boot loader, firmware settings, and sometimes the boot order. If any of these change, the TPM assumes the disk may have been tampered with and requires the recovery key. This is called “sealing” the key to the platform state.

On modern Windows 11 PCs, BitLocker is often enabled automatically on the OS drive (device encryption) even if you never manually turned it on. So a simple boot order change can trigger the recovery screen. The recovery key itself is a 48-digit number that you must enter to unlock the drive. Once entered, Windows boots, but the next reboot may prompt again if the boot order remains incorrect.

How to Check and Fix Boot Order

Fixing the boot order is usually straightforward. Here are the steps for most UEFI-based PCs:

Restart your PC and press the key to enter firmware setup (often F2, F10, Del, or Esc — check your manufacturer’s splash screen).
Look for a “Boot” or “Boot Order” menu.
Ensure the drive containing Windows (usually labeled “Windows Boot Manager” or the model name of your SSD) is first.
If a USB drive or another disk is listed above it, move the Windows drive to the top.
Save changes and exit. The PC should reboot normally without a recovery prompt.

If you cannot see the Windows Boot Manager, it may be that the drive is not detected — check SATA/NVMe connections or try resetting the BIOS to defaults (but note that may re-enable BitLocker prompts if other settings change).

When Boot Order Isn’t the Problem

Sometimes the boot order is correct, but BitLocker still prompts every reboot. In that case, the issue is likely a change in the boot configuration data (BCD) or a firmware update that altered the TPM measurement. Other possibilities include:

Secure Boot being disabled or enabled after initial encryption.
Fast Boot being turned on or off.
A Windows update that changed the boot loader.
TPM driver or firmware issues.

If boot order is fine, you can try suspending BitLocker temporarily (via Control Panel > BitLocker Drive Encryption > Suspend Protection), then rebooting and resuming. This re-seals the key to the current boot state. However, this requires administrative rights and you should only do it if you have the recovery key saved.

How to Get the Recovery Key

If you’re already stuck at the recovery screen, you need the 48-digit key. It is usually stored in one of these places:

Your Microsoft account (account.microsoft.com/devices/recoverykey) — most common for consumer PCs.
A file you saved when BitLocker was first enabled (often a .txt or .beu file).
Printed or saved by your IT department (for work/school devices).
In your organization’s Active Directory (for domain-joined PCs).

If you cannot find the key, you may be locked out permanently. That’s why it’s critical to back up the key before making any hardware or firmware changes.

Preventing Future Recovery Prompts

To avoid this happening again, take these precautions:

Always remove USB drives before rebooting.
Set a fixed boot order in BIOS and disable booting from USB if you don’t need it.
After any BIOS update, check the boot order and Secure Boot settings.
Keep a copy of your BitLocker recovery key in a safe place (not on the encrypted drive itself).
Consider disabling BitLocker if you frequently change hardware and don’t need encryption.

Frequently Asked Questions

Will fixing boot order delete my files?

No. Changing the boot order only affects which device the PC tries to boot from first. It does not modify or delete any data on your drives. Once the correct drive is selected, Windows boots normally and your files remain intact.

Do I need to disable BitLocker to fix boot order?

No. You can change the boot order without disabling BitLocker. After the change, the TPM should accept the new boot path and stop prompting for the recovery key. If it still prompts, you may need to suspend and resume BitLocker to re-seal the key.

Why does BitLocker prompt after a BIOS update even with correct boot order?

A BIOS update can change the TPM’s platform measurements, even if the boot order looks the same. The TPM sees a different firmware version and treats it as a potential security breach. In that case, you’ll need to enter the recovery key once, then the system should re-seal and work normally.

Can I disable BitLocker entirely to stop the prompts?

Yes, you can disable BitLocker via Control Panel > BitLocker Drive Encryption > Turn off BitLocker. This will decrypt the drive, which may take some time. Once disabled, you won’t see recovery prompts, but you’ll lose encryption protection. Only do this if you don’t need the security.

Is it safe to enter the recovery key every time?

It’s safe but not practical. Entering the key each reboot means the TPM is not validating the boot state, which defeats the purpose of BitLocker. Fix the underlying cause (boot order or firmware change) to restore normal operation.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →