BitLocker Recovery Key Backup Path Registry Key

This article identifies the specific Windows Registry key that holds configuration parameters for BitLocker Drive Encryption recovery key backup paths. You will learn the exact registry path, the function of the parameters stored within it, and how these settings control where BitLocker recovery information—such as Active Directory Domain Services (AD DS) or Microsoft Entra ID—is stored.

The BitLocker Backup Configuration Registry Path

The configuration parameters for BitLocker Drive Encryption recovery key backup paths are stored under the FVE (Full Volume Encryption) policy key in the Windows Registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE

If BitLocker policies are applied via Group Policy (GPO) or Mobile Device Management (MDM), Windows writes the configuration rules to this location.

Key Registry Values for Recovery Paths

Within the FVE key, specific DWORD values determine whether recovery keys are backed up to Active Directory, Azure AD/Entra ID, or local storage. These parameters are categorized by drive type:

1. Operating System Drives

• OSRecovery: Enables or disables recovery options for the operating system drive.
• OSRecoveryPassword: Determines whether a 48-digit recovery password is required, allowed, or forbidden.
• OSRecoveryKey: Configures the use of a 256-bit recovery key file.
• RequireActiveDirectoryBackup or OSActiveDirectoryBackup: Configures mandatory or optional backup of the recovery key to Active Directory Domain Services before encryption can occur.

2. Fixed Data Drives (FDV)

• FDVRecovery: Enables or configures recovery methods for fixed internal drives.
• FDVRecoveryPassword: Controls the recovery password policy for fixed drives.
• FDVActiveDirectoryBackup: Dictates whether recovery keys for fixed data drives must be backed up to Active Directory.

3. Removable Data Drives (RDV)

• RDVRecovery: Configures recovery settings for BitLocker To Go (removable USB drives).
• RDVActiveDirectoryBackup: Manages the requirement to back up BitLocker To Go recovery keys to Active Directory.

How to Locate the Key in Regedit

1. Press Win + R, type regedit, and press Enter.
2. Navigate to the following path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE
3. Inspect the right-hand pane to view the DWORD entries governing the backup paths and recovery requirements.

(Note: If BitLocker settings have not been configured via Group Policy, the FVE subkey under Policies may not exist until the relevant policies are defined).