You turn on your laptop and instead of the familiar sign-in screen, you see a blue BitLocker recovery prompt demanding a 48-digit key you may never have seen. Or encryption stalls halfway, or Windows insists the drive is locked after a routine update.

On ARM laptops, BitLocker works the same way as on any Windows 11 PC, but the triggers differ slightly. Snapdragon firmware updates, secure boot changes, and platform driver updates can all change the measurements BitLocker trusts, and any change it cannot explain means a recovery prompt.

If you use demanding apps on the same machine and something else broke too, DaVinci AI features not working covers the app side of ARM compatibility. For gaming performance on encrypted drives, see Xbox Cloud Gaming lag for the network side of the story.

Why this happens

  • Firmware or BIOS update: A firmware change alters the boot measurements BitLocker trusts, triggering a recovery prompt.
  • Secure Boot setting changed: Toggling Secure Boot or changing boot order invalidates the trusted boot state.
  • TPM measurement mismatch: The Trusted Platform Module reports different values after a hardware or firmware change.
  • Recovery key never saved: BitLocker enabled automatically during setup, and the key was never printed or backed up.
  • Encryption interrupted: Sleep, shutdown, or a crash during the first encryption pass leaves the drive partly encrypted.
  • Drive or partition changes: Resizing partitions or adding a second drive can confuse BitLocker’s view of the disk.
  • Windows update changing boot files: A major feature update can alter boot components enough to trip BitLocker’s checks.

How to fix it

Work through these in order — diagnose first, then act.

Fix 1: Find and enter your recovery key

Everything else depends on this step, so do it first and do it calmly. The recovery key is a 48-digit number, and it is almost certainly stored in your Microsoft account if you signed in with one during setup. Entering it correctly unlocks the drive and returns you to normal sign-in, usually permanently for that boot change.

  1. On another device, sign in to your Microsoft account and open the BitLocker recovery keys page.
  2. Match the recovery key ID shown on your laptop’s prompt to the key listed in your account.
  3. Type the 48-digit key carefully into the recovery prompt, checking each group of six digits.
  4. If the key is not in your account, check printed copies, saved files, or a USB drive from setup.
  5. After unlocking, back up the key to a second location immediately so this never happens again.
  6. If no key can be found anywhere, the encrypted data cannot be recovered — a clean install is the only path.

Fix 2: Stop repeated recovery prompts after firmware updates

A single recovery prompt after an update is normal; repeated prompts on every boot are not. The usual cause is a firmware setting that keeps changing, or a boot component that never settles into a trusted state. Suspending BitLocker before firmware updates, then resuming it after, lets the new measurements be recorded as trusted instead of tripping the alarm.

  1. Once booted, open an elevated Command Prompt and run manage-bde -protectors -disable C: before any firmware update.
  2. Apply the firmware or BIOS update, then boot into Windows normally.
  3. Re-enable protectors with manage-bde -protectors -enable C: after a successful boot.
  4. If prompts continue, check the BIOS for Secure Boot and TPM settings that may have changed.
  5. Restore Secure Boot to its default enabled state and ensure the TPM is active.
  6. If the TPM itself reports errors, the attestation fixes in related platform guides apply — and for app-side fallout, see DaVinci AI features not working .

Fix 3: Fix encryption stuck or paused

Encryption that stalls, often at a low percentage or in a paused state, is usually caused by sleep settings, disk errors, or a conflicting drive operation. The encryption engine is designed to resume, so the fix is to remove whatever interrupted it and let it finish — not to force it or disable protection mid-stream.

  1. Open an elevated Command Prompt and run manage-bde -status C: to see the encryption state.
  2. If encryption is paused, run manage-bde -resume C: to continue it.
  3. Plug in the charger and set the laptop to never sleep until encryption completes.
  4. Run chkdsk C: /f from an elevated prompt and restart to fix disk errors first if any are found.
  5. Let encryption run to 100 percent before shutting down or restarting again.
  6. If it stalls at the same percentage repeatedly, check the drive’s health in the manufacturer’s diagnostics.

Fix 4: Re-enable the TPM and clear stale measurements

BitLocker trusts the TPM’s measurements of the boot process, and stale or corrupted measurements cause repeated prompts even when nothing has changed. Clearing the TPM forces fresh measurements, but it must be done carefully: back up the recovery key first, because clearing the TPM can itself trigger a recovery prompt on the next boot.

  1. Back up your BitLocker recovery key to your Microsoft account and a printed copy.
  2. Open Settings, go to System, then Recovery, and restart into Advanced startup.
  3. Choose Troubleshoot, then UEFI Firmware Settings, and enter the BIOS setup.
  4. Find the TPM or Security section and confirm the TPM is enabled and active.
  5. If the option exists, clear the TPM, save, and exit — then enter the recovery key at the next prompt.
  6. Once booted, verify BitLocker status with manage-bde -status C: and re-suspend and resume protection once.

Fix 5: Repair BitLocker after a Windows feature update

Major Windows updates replace boot files, and occasionally the updated files do not match what BitLocker recorded. The result is a recovery prompt after every feature update, or a drive that reports itself as locked in Windows. Re-establishing the protectors after the update, and letting Windows re-seal the keys to the new boot state, resolves this cleanly.

  1. Boot with the recovery key if prompted, then sign in normally.
  2. Open an elevated Command Prompt and run manage-bde -protectors -disable C:.
  3. Restart the laptop once, then run manage-bde -protectors -enable C:.
  4. Check for further Windows updates and install them, since a follow-up fix often ships quickly.
  5. Verify the drive shows as fully encrypted with manage-bde -status C:.
  6. If cloud gaming or other network-heavy apps also misbehave after the update, check Xbox Cloud Gaming lag for the connectivity fixes.

Fix 6: Turn BitLocker off safely when you no longer want it

Sometimes the right fix is to remove BitLocker entirely — for example, before selling the laptop or dual-booting another system. Decryption must complete fully, and interrupting it leaves the drive in a half-encrypted state that is worse than either endpoint. Plan for the time it takes and keep the laptop powered throughout.

  1. Back up all important data to an external drive before starting decryption.
  2. Open Control Panel, go to BitLocker Drive Encryption, and choose Turn off BitLocker for the drive.
  3. Confirm, plug in the charger, and set the laptop to never sleep during decryption.
  4. Monitor progress with manage-bde -status C: until it reports Fully Decrypted.
  5. Do not force shutdown or restart during decryption, even if progress seems slow.
  6. If on-screen helper features also broke around the same update, see Click to Do image actions not working for their separate fix path.

Closing

BitLocker problems feel alarming because the stakes are your data, but the fixes are methodical: find the key, stabilize the boot measurements, and let encryption finish. The single most important habit is keeping the recovery key somewhere you can reach from another device — with it, every BitLocker problem is solvable, and without it, none of them are. Microsoft’s BitLocker documentation is available at the Windows support hub .

Frequently asked questions

Why does my ARM laptop keep asking for a BitLocker recovery key?
BitLocker asks for the recovery key when it detects a change it cannot verify, such as a firmware update, a hardware change, or a boot configuration change. Entering the 48-digit key once usually restores normal boot, but repeated prompts mean something keeps changing the boot state.
Where do I find my BitLocker recovery key?
Sign in to your Microsoft account on another device and check the recovery keys page, or look for a printout or USB drive where you saved it during setup. Without the key, an encrypted drive cannot be unlocked by anyone, including Microsoft.
Is BitLocker slower on ARM laptops?
No. Modern Snapdragon chips include hardware encryption acceleration, so BitLocker’s performance impact is negligible in normal use. Slowness during the first encryption pass is normal and temporary.
Can I turn off BitLocker on an ARM laptop?
Yes, from Settings or the Control Panel, but decryption takes time and leaves the drive unprotected. Only disable it if you have a specific reason, and back up your data first.