How can we recover or safely rebuild a BitLocker locked former employee laptop without the recovery key

Hello Raymond Segbedzi-Atroh,

Since the former employee is no longer with the organization, you likely cannot access their personal security info page (myaccount.microsoft.com) without resetting their credentials. As a system administrator, your best route to find that key is strictly through the Microsoft Entra admin center (formerly Azure Active Directory). You should navigate to Identity > Devices > All devices in the portal. The most reliable method here is to search specifically using the Recovery Key ID displayed on the BitLocker screen (the first 8 characters usually suffice for the search filter) rather than the device name, which might have changed or be duplicated. If the device was properly Entra-joined or Intune-managed, the 48-digit recovery key will be listed under the "BitLocker keys" blade of that device object.

If the key isn't present in Entra ID, and given that data recovery is not required, you should proceed immediately to wiping the device to return it to the deployment pool. Because this is a Dell Latitude 7430, the most secure and efficient "best practice" method is to utilize the built-in Dell Data Wipe feature before attempting to reinstall Windows. You can access this by entering the BIOS (press F2 repeatedly at boot), navigating to Security > Data Wipe (or Maintenance > Data Wipe on some firmware versions), checking "Wipe on Next Boot," and confirming. This utilizes the SSD's internal command set to cryptographically erase or overwrite all blocks, effectively destroying the BitLocker container and the data within it instantly.

Alternatively, if you prefer to handle this during the OS deployment phase or if the BIOS wipe is unavailable, you can boot directly from your Windows 10/11 installation media (USB or PXE). When you reach the strictly technical "Where do you want to install Windows?" screen, you will see the drive encrypted with "Unknown" partition types. You must delete every partition listed for Drive 0 until you are left with a single "Unallocated Space" entry. If the drive is stubborn due to the encryption, press Shift + F10 to open a command prompt, type diskpart, then select disk 0, and finally execute the clean command. This strips the GPT partition table and the BitLocker lock, allowing the Windows installer to create a fresh partition structure and TPM binding for the new user.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

VP

To recover or safely rebuild a BitLocker locked laptop without the recovery key, you have a few options:

1. Check for Recovery Key in Azure AD: Since the device was believed to be joined to Azure AD Entra ID, you can check if the BitLocker recovery key is stored there. Users can access their recovery keys by visiting https://myaccount.microsoft.com, selecting the Devices tab, and then choosing the Windows device to view the BitLocker keys. If the device was managed properly, the recovery key should be available there.
2. Helpdesk Recovery: If your organization has a helpdesk or IT support team, they may have access to tools or methods to retrieve the recovery key. They can use the Recovery Key ID displayed on the BitLocker recovery screen to search for the key in your organization's records.
3. Data Recovery Agents (DRA): If your organization has configured Data Recovery Agents, the helpdesk can use these to unlock the drive. This requires the DRA's private key to be available on a device that can access the locked drive.
4. Wipe and Redeploy: If recovery of the data is not a concern and the recovery key cannot be located, you may need to perform a hardware reset or wipe the device. This typically involves using recovery media to boot the device and erase the existing partitions, effectively removing BitLocker protection. Note that this will result in loss of all data on the device.
5. Contact Manufacturer Support: If none of the above options are viable, contacting Dell support may provide additional options for resetting the device or accessing recovery methods specific to their hardware.

It's important to implement policies to prevent similar situations in the future, such as ensuring recovery keys are stored securely and accessible to IT staff.

References:

• BitLocker recovery process
• BitLocker recovery overview