isacco@gianlucaiunco:~$
IT Leggi in italiano

Automatic translation from Italian. The Italian version is the reference text.

guide · series Security for small businesses, part 2

How to encrypt a laptop drive and where to find the recovery key?

Encrypting the drive protects your data if a laptop is lost or stolen. Here is how to check it, turn it on and keep the recovery key safe.

In short

Many laptops signed in with a Microsoft or work account are already encrypted: check Settings → Privacy & security → Device encryption and make sure the recovery key is in the account.

SummaryEncrypted disk, recovery key kept safe
  1. Check whether it is already encryptedwith a Microsoft or work account it often is; with a local account it isn't
  2. Turn on encryptionas an administrator; it needs a TPM chip and Secure Boot
  3. Save the key to the account48 digits Windows asks for when it can't unlock the disk by itself
  4. Keep a copy away from the laptopfor example in the office password manager; without the key, only a reset is left

Settings → Privacy & security → Device encryption · key: aka.ms/myrecoverykey or aka.ms/aadrecoverykey

Why should a laptop be encrypted?

If an office laptop is stolen or left on a train, whoever finds it can remove the drive and read its files without knowing the Windows password. Encryption makes the contents of the drive unreadable without the right key. With client and supplier data on the machine, this is protection worth having on every laptop.

Windows offers two tools. Device encryption is available even on Home editions. BitLocker Drive Encryption is only available on Pro, Enterprise and Education editions and gives you more control.

Is my computer already encrypted?

Often it is. If you first signed in to Windows with a Microsoft account, or a work or school account, encryption starts automatically and the recovery key is linked to that account. With a local account, it does not turn on by itself.

To check, open Settings → Privacy & security → Device encryption. If the switch is on, the drive is already protected.

How do I turn it on if it is off?

  1. Sign in to Windows with an administrator account.
  2. Open Settings → Privacy & security → Device encryption.
  3. Switch it to On.
  4. Follow the prompts to save the recovery key, preferably to the Microsoft or work account.

If the option is missing, you are using a standard user account or the computer does not meet the requirements. The feature needs a TPM chip enabled in the BIOS or UEFI, the Windows recovery environment configured and Secure Boot switched on. To find out which requirement is missing, open System Information as administrator and read the Device Encryption Support line. On Pro editions you can use BitLocker from Control Panel, in the drive encryption section.

Where do I find the recovery key?

Windows asks for the recovery key, a 48-digit sequence, when it cannot unlock the drive on its own. This happens after a BIOS update, a hardware replacement or a change to the startup settings. On the prompt screen, note the first 8 characters of the Key ID: they identify the right key if there is more than one.

Microsoft account

  1. On another device, open a browser and go to aka.ms/myrecoverykey.
  2. Sign in with the Microsoft account and look for the matching Key ID.

If someone else set up the computer, the key may be in their account.

Work account

  1. On another device, go to aka.ms/aadrecoverykey and sign in with the work account.
  2. Choose Devices and expand the computer.
  3. Select View BitLocker keys and compare the Key ID.

Printout or USB drive

If the key was printed or saved to a USB drive when encryption was turned on, look there. For a USB drive, plug it into the locked computer and follow the on-screen instructions.

What happens if I lose the key?

Microsoft support cannot recover or recreate a lost key. Without it, the only way forward is to reset the computer, which erases every file on the drive. For a computer managed by an organisation, the key is requested from whoever administers it.

To avoid getting there, check today that the key for every laptop appears in the right account, and keep a copy somewhere other than the laptop itself, for example in the office password manager. A copy stored inside the encrypted computer is useless when you need it.

What should I check if there are several laptops?

Go round the computers and note three things for each one: whether encryption is on, which account was used for the first sign-in, and where the recovery key is stored. A laptop with a local account is the riskiest, because encryption does not start by itself and the key ends up in no account. For these computers, turn the feature on by hand and save the key somewhere that stays reachable even if the laptop disappears.

Repeat the check when you replace a laptop or when someone leaves the office. The Key ID shown on the computer must match a key present in the account, otherwise the copy you think you have is not the right one.

Sources

Need a hand at your company?

I provide IT and AI consulting for small businesses and professionals, in Apulia and remotely.

Services

Guide written with AI assistance and checked by me before publication.

Share