# BitLocker Recovery Mode

> Why update KB5012170 can send endpoints into BitLocker recovery mode, and how to collect recovery keys before it happens.

Source: https://docs.capaone.com/capainstaller/capabitlocker/bitlocker-recovery-mode/  
Product: CapaInstaller — a separate CapaSystems product; do not apply this page to any other.

During patch Tuesday on August 9, 2022, Microsoft released a Windows update that can cause BitLocker to activate recovery mode and prompt the end-user for a recovery key.

With the update **KB5012170**, Microsoft has fixed some security vulnerabilities in Secure Boot by updating Secure Boot DBX — which can cause BitLocker to activate recovery mode.

The prompt is presented only one time, after the update has been installed and the computer has been rebooted.

![BitLocker recovery screen asking the end-user to enter the recovery key for the drive](/attachments/capainstaller/capabitlocker-recovery-mode-prompt.png)

---

Due to the above, CapaSystems recommends that all our customers take the following actions:

1. Ensure that all active BitLocker recovery keys are saved in Active Directory and/or CapaInstaller
2. Consider postponing the installation of **KB5012170**

---

## Collect the recovery keys

We have developed a computer package to collect and save all active BitLocker recovery keys.

**If you already have a subscription for CapaBitLocker and are using Cloud Updater:**

- The package will automatically download to your CapaInstaller environment.

**If you do not have a subscription for CapaBitLocker or you are not using Cloud Updater:**

- Download the package [here](https://download.capainstaller.com/products/CapaFactory/CapaBitLocker/CapaBitLocker%20-%20Collect%20Recovery%20Keys_v2022.08.zip)

---

:::note[Technical Notes]
To validate that the BitLocker recovery keys have been correctly saved in Active Directory and/or CapaInstaller, the settings in the package script must be updated to match your environment.

Our [guide](https://download.capainstaller.com/products/CapaFactory/CapaBitLocker/CapaBitLocker%20v2022.08.pdf) describes how to do it.
:::

---

:::note
Microsoft has confirmed that the update can cause issues with BitLocker and are working on a solution. You can read more about it [here](https://support.microsoft.com/en-us/topic/kb5012170-security-update-for-secure-boot-dbx-august-9-2022-72ff5eed-25b4-47c7-be28-c42bd211bb15)
:::

---

[Read more about BitLocker recovery](https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview)

[Read more about issues with the update](https://www.bleepingcomputer.com/news/microsoft/windows-kb5012170-update-causing-bitlocker-recovery-screens-boot-issues/)