BitLocker recovery key escrow

Keep every computer’s BitLocker recovery key in Lavawall, sealed to your organization’s own escrow key, and show it only to administrators, with each view logged.

Open Agent keys in your console

Where to find it
Devices › Agent keys
Who can use it
Super Admins manage escrow; administrators can view recovery keys
For
Administrators of organizations that use the Lavawall agent
Plan
Every plan that includes the Lavawall agent. See pricing

What BitLocker recovery key escrow is

Screenshots of this page are coming soon. The steps below use the labels you see in the console.

BitLocker encrypts a Windows computer’s drives. When something changes, such as a new motherboard, a firmware update or a forgotten PIN, BitLocker asks for the drive’s recovery key before Windows will start. Without that key, the data on the drive is out of reach.

The Lavawall® agent reports the recovery keys of each encrypted drive, so your team can find them in the console when a user calls. Escrow means each recovery key is sealed to your organization’s own escrow key as soon as it is reported. Only the Lavawall console can open it, and a sealed key opens only for the computer it came from.

Before escrow, recovery keys were protected with the shared company key, a copy of which was on every computer. Escrow removes that dependency, and it is a required step before you retire the shared company key.

Why use it

  • Recovery when it counts. Unlock a computer that is stuck at the BitLocker screen without hunting for a printout or a Microsoft account.
  • Recovery keys stay out of reach of the computers themselves. No computer in the organization holds anything that opens another computer’s recovery key.
  • Only the people who should see them can. Recovery keys are shown only to administrator roles, and every view is recorded.
  • Audit evidence. The activity log shows who viewed which computer’s recovery key and when, which supports encryption and key-management controls in SOC 2, ISO 27001, HIPAA and PCI DSS assessments.

How to set up escrow

  1. In the console, go to Devices › Agent keys and choose the Organization.
  2. Under BitLocker recovery key escrow, click Create escrow key and then Continue. Recovery keys reported from now on are sealed to the new key.
  3. Click Re-escrow now to move recovery keys already in Lavawall to the escrow format. Each click moves a batch; repeat until the page shows that no drives are left in the old format.

The page shows when the escrow key was created and how many drives are in the escrow format and how many are still in the old format.

Replacing the escrow key

Click Replace escrow key if your policy calls for a new key, or if you believe the old one may be exposed. Recovery keys reported after that are sealed to the new key. Recovery keys already in escrow stay readable.

How to view a recovery key

  1. Go to Devices › Computers and open the computer.
  2. Open the Storage tab. In the Drives list, each encrypted drive has a Bitlocker Key button. Drives that are not encrypted show NO.
  3. Click Bitlocker Key. Lavawall reminds you that every BitLocker decryption is logged and asks you to confirm.
  4. Confirm to show the recovery key. Read it to the user or type it at the BitLocker screen, then close the page.

If the console says the key is unavailable in the current agent version, the computer has not reported a recovery key yet. Update the Lavawall agent and wait for its next check-in.

Who can see and change it

  • Viewing a recovery key: a Super Admin or Admin; an MSP Client Administrator for the client organizations they manage; Client Local IT for their own organization. Other roles, such as Read Only, Billing and report-only roles, are refused, and the refusal is recorded.
  • Managing escrow (creating or replacing the escrow key, re-escrowing): only a Super Admin of the organization or of the organization that manages it.
  • Lavawall checks the role and the organization on every request, not just when the page opens.

What is recorded in the activity log

  • Every recovery key that is shown: who viewed it, for which computer and organization, and when.
  • Every refused attempt to view a recovery key.
  • Creating or replacing an escrow key.
  • Each re-escrow run.

Frequently asked questions

What is BitLocker recovery key escrow in Lavawall?
Lavawall keeps each encrypted drive’s BitLocker recovery key, sealed to your organization’s own escrow key, so administrators can unlock a computer that is stuck at the BitLocker recovery screen.
Where do I find a computer’s BitLocker recovery key?
Open the computer from Devices › Computers, go to the Storage tab and click Bitlocker Key next to the encrypted drive, then confirm.
Who can see BitLocker recovery keys?
Super Admins and Admins, MSP Client Administrators for their clients, and Client Local IT for their own organization. Every view and every refused attempt is recorded in the activity log.
Do I need to create an escrow key?
Recovery keys are kept either way. Creating an escrow key moves their protection away from the shared company key, and it is required before you retire the shared company key.
What happens to recovery keys already stored when I replace the escrow key?
They stay readable. Only keys reported after the change use the new escrow key.
Why does the console say the key is unavailable?
The computer has not reported a recovery key yet, usually because its Lavawall agent is out of date. Update the agent and wait for its next check-in.

Still need help?

Search the support centre, or contact our support team and tell us which page you were on:

We use privacy-friendly, cookieless analytics to count visits, and one cookie to run our live chat. Both load only if you accept. We do not use advertising trackers, and we do not profile you across other websites. The essential cookies that keep the site working are always on. See our privacy policy.