Page History

To enable BitLocker Encrypted systems to export a .BEK recovery key it's necessary to ensure that some settings are enabled in the Windows Group Policy Editor

1. Navigate to ‘Start’ and type in 'gpedit.msc'. In the editor navigate to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
   
   Ensure that 'Require additional Authentication at startup' is enabled 
   
   
2. Select 'Choose how BitLocker protected operating system drives can be recovered'.
   
   
   Set the settings as shown below to enable creation of a .BEK recovery key.