Where do I find a BitLocker recovery key in Breeze RMM?

Go to Security → Encryption, search for the device, expand its row and click Reveal on the active key. The same Recovery Keys panel is on the device's Security tab.

How do BitLocker recovery keys get into Breeze RMM?

On Windows, the Breeze agent reads the BitLocker recovery passwords during its regular security check and sends them only when they change. Breeze encrypts each key before it is stored. Collect now asks the agent to read them again straight away.

Who can see a recovery key, and is it audited?

Only someone with access to that device and its site, from a session that meets your MFA policy, and each tech is capped at 20 reveals an hour. Every reveal is listed under Recent access on the device and as an Audit Trail entry that records who and which key, never the key itself.

Should I rotate a BitLocker key after reading it out?

The narrator recommends it. Rotate key queues a job for the agent, which adds a new recovery password before removing the old one, and the new key is escrowed on its own. The previous key stays on file marked superseded.

Can Breeze RMM escrow FileVault recovery keys?

Yes, by rotating. macOS only reveals the FileVault personal recovery key when it is rotated, so Rotate key needs a FileVault user's username and password, or the current recovery key. The credentials are used once and not stored.

How to Find a BitLocker Recovery Key in Your RMM

Name: How to Find a BitLocker Recovery Key in Your RMM | Breeze RMM
Uploaded: 2026-10-22
Duration: 3 min 25 s
Description: Breeze RMM escrows BitLocker recovery keys from every Windows machine, so a tech can find a locked laptop's key in under a minute, and every reveal is logged under the tech's name. This demo walks one client's encryption board, reveals and rotates a key, checks the audit trail, and closes the gaps, including FileVault on Macs.

Breeze RMM escrows BitLocker recovery keys from every Windows machine, so a tech can find a locked laptop's key in under a minute, and every reveal is logged under the tech's name. This demo walks one client's encryption board, reveals and rotates a key, checks the audit trail, and closes the gaps, including FileVault on Macs.

3:25 Captions: English Open on YouTube

What's in the demo

Security → Encryption for one client (Acme Manufacturing): Total Devices 32, Fully Encrypted 28, Partial 4, Unencrypted 0; by method BitLocker 25, FileVault 5, LUKS 2, None 0
The Recovery Key column: most rows read Escrowed, ACME-WS-017 reads a red Missing
Search "acme-ws-014" and expand it: volume C:, Encrypted Yes, xtsaes128, FullyEncrypted (100%), an active BitLocker key escrowed 9/29/2026 and an older key marked superseded
Reveal: the 48-digit key shows with "This access has been recorded in the audit trail.", and Recent access gains a new "[email protected] revealed" line on top of the earlier one
Rotate key: the dialog says a new BitLocker recovery password is generated and escrowed and the old one is removed after the new key is in place; the toast reads "Key rotation queued"
Audit Trail: "Device recovery key reveal" and "Device recovery key rotate" rows under Breeze Admin, with the key id and volume C: in the details, never the key
Key escrow filter set to Key missing: ACME-WS-017 and acme-mbp-07.acme.local; Collect now on WS-017 gives "Key collection queued"
The Mac: "No recovery keys escrowed. FileVault keys can only be captured by rotating", and the Rotate recovery key dialog asks for a FileVault username and password, or the current recovery key

Questions this video answers

Where do I find a BitLocker recovery key in Breeze RMM?: Go to Security → Encryption, search for the device, expand its row and click Reveal on the active key. The same Recovery Keys panel is on the device's Security tab.
How do BitLocker recovery keys get into Breeze RMM?: On Windows, the Breeze agent reads the BitLocker recovery passwords during its regular security check and sends them only when they change. Breeze encrypts each key before it is stored. Collect now asks the agent to read them again straight away.
Who can see a recovery key, and is it audited?: Only someone with access to that device and its site, from a session that meets your MFA policy, and each tech is capped at 20 reveals an hour. Every reveal is listed under Recent access on the device and as an Audit Trail entry that records who and which key, never the key itself.
Should I rotate a BitLocker key after reading it out?: The narrator recommends it. Rotate key queues a job for the agent, which adds a new recovery password before removing the old one, and the new key is escrowed on its own. The previous key stays on file marked superseded.
Can Breeze RMM escrow FileVault recovery keys?: Yes, by rotating. macOS only reveals the FileVault personal recovery key when it is rotated, so Rotate key needs a FileVault user's username and password, or the current recovery key. The credentials are used once and not stored.

A note on the demo: all keys, devices and names are fictional demo data, and no agent ran the queued rotation or collection, so no new key appears on screen. The Key missing filter also lists the two Linux (LUKS) machines, which show a dash in the Recovery Key column. The TPM column does not check hardware yet: it reads Yes for every Windows machine and No for every Mac.

Do this on your own fleet

Everything in the video is in the product you get. Start the Cloud Beta in minutes, or self-host the open-source Community edition for free.

Start Cloud Beta Deploy for Free Book a Demo