Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista)
Verified with Windows 11 25H2 — updated on July 12, 2026
Supported on: Windows Server 2008 and Windows Vista
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption Description
This policy setting allows you to control whether the BitLocker Drive Encryption setup wizard can display and specify BitLocker recovery options. This policy is only applicable to computers running Windows Server 2008 or Windows Vista. This policy setting is applied when you turn on BitLocker. Two recovery options can be used to unlock BitLocker-encrypted data in the absence of the required startup key information. The user either can type a 48-digit numerical recovery password or insert a USB flash drive containing a 256-bit recovery key. If you enable this policy setting, you can configure the options that the setup wizard displays to users for recovering BitLocker encrypted data. Saving to a USB flash drive will store the 48-digit recovery password as a text file and the 256-bit recovery key as a hidden file. Saving to a folder will store the 48-digit recovery password as a text file. Printing will send the 48-digit recovery password to the default printer. For example, not allowing the 48-digit recovery password will prevent users from being able to print or save recovery information to a folder. If you disable or do not configure this policy setting, the BitLocker setup wizard will present users with ways to store recovery options. Note: If Trusted Platform Module (TPM) initialization is needed during the BitLocker setup, TPM owner information will be saved or printed with the BitLocker recovery information. Note: The 48-digit recovery password will not be available in FIPS-compliance mode. Important: This policy setting provides an administrative method of recovering data encrypted by BitLocker to prevent data loss due to lack of key information. If you do not allow both user recovery options you must enable the "Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)" policy setting to prevent a policy error.
Registry
SOFTWARE\Policies\Microsoft\FVE Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista)
; State: Enabled
; Supported on: Windows Server 2008 and Windows Vista
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE]
"UseRecoveryPassword"=dword:00000001
"UseRecoveryDrive"=dword:00000001More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista)
# State: Enabled
# Supported on: Windows Server 2008 and Windows Vista
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\FVE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'UseRecoveryPassword' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'UseRecoveryDrive' -Value 1 -Type DWordIntune XML
No direct Policy CSP / OMA-URI mapping for this policy. Use the Intune Remediation tab, or ingest the ADMX in Intune.Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista)
# State: Enabled
# Supported on: Windows Server 2008 and Windows Vista
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE' -Name 'UseRecoveryPassword' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE' -Name 'UseRecoveryDrive' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista)
# State: Enabled
# Supported on: Windows Server 2008 and Windows Vista
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\FVE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'UseRecoveryPassword' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'UseRecoveryDrive' -Value 1 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista)
# State: Enabled
# Supported on: Windows Server 2008 and Windows Vista
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista)
# State: Enabled
# Supported on: Windows Server 2008 and Windows Vista
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE' -Name 'UseRecoveryPassword' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE' -Name 'UseRecoveryDrive' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista)
# State: Enabled
# Supported on: Windows Server 2008 and Windows Vista
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\FVE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'UseRecoveryPassword' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'UseRecoveryDrive' -Value 1 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.