BitLocker Recovery Methods Registry Key

This article explains how to locate and configure the Windows Registry keys responsible for BitLocker Drive Encryption recovery methods. System administrators and users can manage how recovery passwords, keys, and Active Directory backup options are enforced across operating system, fixed, and removable drives by modifying specific values within the Windows Registry.

Primary Registry Path

The configuration parameters for BitLocker recovery methods are located in the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE

(Note: “FVE” stands for Full Volume Encryption. If the FVE key does not exist, it is typically created automatically when BitLocker Group Policies are defined, or it can be created manually.)

Key Recovery Configuration Parameters

BitLocker separates recovery settings based on drive types: Operating System (OS) Drives, Fixed Data Volumes (FDV), and Removable Data Volumes (RDV).

1. Operating System Drive Recovery (OSRecovery)

To control recovery options on the OS drive, the following DWORD values are configured under HKLM\SOFTWARE\Policies\Microsoft\FVE:

• OSRecovery: Enables or disables recovery options for OS drives (1 = Enabled, 0 = Disabled).
• OSRecoveryPassword: Determines the policy for 48-digit recovery passwords:
  • 0 = Do not allow
  • 1 = Allow recovery password
  • 2 = Require recovery password
• OSRecoveryKey: Determines the policy for 256-bit recovery keys (same 0–2 value structure).
• OSHideRecoveryPage: Set to 1 to prevent users from viewing recovery options during setup.
• OSActiveDirectoryBackup: Set to 1 to require BitLocker recovery information to be backed up to Active Directory Domain Services (AD DS).
• OSActiveDirectoryInfoToStore: Specifies whether to store the recovery password and key package (1 = Password only, 2 = Password and Key Package).

2. Fixed Data Volume Recovery (FDVRecovery)

For non-OS internal drives, parameters use the FDV prefix:

• FDVRecovery: Enables recovery configuration for fixed data drives.
• FDVRecoveryPassword: Policy for recovery passwords (0 = Disallow, 1 = Allow, 2 = Require).
• FDVRecoveryKey: Policy for recovery keys (0 = Disallow, 1 = Allow, 2 = Require).
• FDVActiveDirectoryBackup: Enforces AD DS backup for fixed drive recovery information.

3. Removable Data Volume Recovery (RDVRecovery)

For BitLocker To Go (external USB drives), parameters use the RDV prefix:

• RDVRecovery: Enables recovery configuration for removable drives.
• RDVRecoveryPassword: Policy for recovery passwords (0 = Disallow, 1 = Allow, 2 = Require).
• RDVRecoveryKey: Policy for recovery keys (0 = Disallow, 1 = Allow, 2 = Require).
• RDVActiveDirectoryBackup: Enforces AD DS backup for removable drive recovery information.

How to Modify the Settings

1. Press Windows Key + R, type regedit, and press Enter.
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE.
3. Right-click the right pane, select New > DWORD (32-bit) Value, and enter the appropriate parameter name.
4. Double-click the newly created DWORD value, set its base to Hexadecimal or Decimal, enter the desired configuration number, and click OK.
5. Restart the computer or run gpupdate /force via Command Prompt to apply changes.