Skip to main content

Bitlocker and FileVault Recovery and Password Resets

For macOS users, device recovery can be used if a user forgot their device password and is locked out via FileVault encryption.

For Windows users, this recovery action can help a user get back into their device in the case of a disaster or BSOD (blue screen of death) via BitLocker encryption.

 

Prerequisites

First, the device must be compliant with the Disk Encryption control and the Device is Recoverable control. This means the device is encrypted and the encryption key is escrowed.

 

BitLocker and FileVault Recovery

As long as the device is encrypted and recoverable, you can proceed with the following steps to get the user back into their device:

  1. Navigate to the ‘Device’ tab on the left sidebar
  2. Select the impacted device from the table
  3. Click the ‘Actions’ button on the right hand side
  4. Select ‘Recover Device’
  5. This will reveal the encryption key. Copy it, and share it with the user. Make sure you are sharing with the correct person over a trusted communication channel.
  6. To use the key to regain access to the device,
    1. macOS: The user will need to start their macOS device in recovery mode (https://support.apple.com/en-us/HT201255) and then paste the recovery key during login.
    2. Windows: The user will need to enter the 48-digit key where prompted for BitLocker recovery.

Password resets for Windows devices

There are two ways to reset a password for a Windows Device, depending on if a user is logging in with a local account or an Azure account. Ask the user what account they log in to (if it's an email address, it's an Azure account) or check on the list of accounts for the device to figure it out!

 

For local accounts: You'll need to generate a temporary password to share with the user. This will allow them to log back in and then change their password to something only they know:

  1. Navigate to the Devices tab on the left sidebar
  2. Click into the impacted device from the table
  3. Click the Action button --> Reset Local Account Password. This will generate a temporary password to share with the impacted user
    aHR0cHM6Ly93d3cubm90aW9uLnNvL2ltYWdlL2h0dHBzJTNBJTJGJTJGcHJvZC1maWxlcy1zZWN1cmUuczMudXMtd2VzdC0yLmFtYXpvbmF3cy5jb20lMkYxMzY3YjQxNy0wYzcyLTRkNTQtYTNmMC00NzgyNjA5MGYyZTYlMkY1ZmQ1NzhjMC0wZTFkLTQzZjYtYThiYS1lMTgzMDM3Y2I5ZjMlMkZTY3JlZW5zaG90XzIw.png
  4. Remind the user to reset their password to something secret once they regain access to their account

For Azure/EntraID accounts:

  1. Get the account name that the user logs in with. This can be done by asking the user or by going to the device's page and copying the name of the email shown in the Accounts section.
  2. Navigate to the Accounts tab on the left sidebar
  3. Click into the impacted account from the table
  4. Click the Action button --> Reset Password. This will generate a temporary password to share with the impacted user
    aHR0cHM6Ly93d3cubm90aW9uLnNvL2ltYWdlL2h0dHBzJTNBJTJGJTJGcHJvZC1maWxlcy1zZWN1cmUuczMudXMtd2VzdC0yLmFtYXpvbmF3cy5jb20lMkYxMzY3YjQxNy0wYzcyLTRkNTQtYTNmMC00NzgyNjA5MGYyZTYlMkY1ZmQ1NzhjMC0wZTFkLTQzZjYtYThiYS1lMTgzMDM3Y2I5ZjMlMkZTY3JlZW5zaG90XzIw.png
  5. Remind the user to reset their password to something secret once they regain access to their account
Was this article helpful?