BitLocker Recovery Key Registry Location in Windows

This article provides an overview of how the Windows Registry interacts with BitLocker drive encryption and where related configuration settings, policy rules, and recovery metadata are recorded. It covers the specific registry paths used by the Full Volume Encryption (FVE) subsystem and explains why raw recovery keys are not stored directly as plain text in the registry.

BitLocker Policy and Recovery Key Configuration Path

The configuration rules determining how BitLocker generates, enforces, and backs up recovery keys are stored under the Group Policy registry hive:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE

Within this key, administrators can find settings that manage recovery information, including: * OSRecovery: Controls recovery options for operating system drives. * OSRecoveryPassword: Dictates whether a 48-digit recovery password is required, allowed, or forbidden. * OSRecoveryKey: Manages the creation of 256-bit recovery keys. * ActiveDirectoryInfo: Configures whether recovery keys and Key Package backups are automatically backed up to Active Directory Domain Services or Microsoft Entra ID.

BitLocker Driver and Service State

System-level settings and driver configurations for Full Volume Encryption are registered under the system control set:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fve

This location contains driver parameters necessary for the operating system kernel to interact with encrypted volumes during the boot process.

BitLocker Status and Hardware Management

General status records, TPM validation states, and hardware-specific encryption configurations can be found at:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BitLocker

This area tracks hardware readiness, DMA protection policies, and modern standby encryption requirements.

Why Active Recovery Keys Are Not Stored in Plain Text

For security reasons, Windows does not write active, plaintext 48-digit BitLocker recovery keys directly into the Windows Registry. Doing so would expose full disk decryption keys to any local process or user with read access to system hives.

Instead, the actual recovery keys (known as Key Protectors) are stored in the following secure locations: 1. Volume Metadata: Encrypted inside the protected metadata region of the BitLocker-enabled partition itself. 2. Cloud or Domain Directory: Uploaded to Microsoft Entra ID (formerly Azure AD) or Active Directory Domain Services if configured. 3. Microsoft Account: Saved to the personal account used when enabling device encryption on consumer editions of Windows.

To view or retrieve the active BitLocker Key Protector IDs and keys administratively, use elevated PowerShell or the manage-bde utility:

manage-bde -protectors -get C: