Windows Boot Problems: BitLocker Recovery, Boot Loops and BlackLotus

BitLocker asks for a recovery key when the TPM no longer sees the same early boot state it sealed the key to, which happens after firmware updates, boot manager changes, TPM resets and Secure Boot changes. Find the 48 digit key at aka.ms/myrecoverykey or with your IT team, unlock, then repair the boot in Windows RE. Before any firmware or Secure Boot change, back up the key and suspend BitLocker for one restart.

The rest of this post covers the boot problems Windows users and admins actually hit, using only Microsoft's own documentation, including why the BlackLotus mitigations in KB5025885 can make your old USB recovery stick refuse to start.

One honest note first: the boot chain (firmware, Windows Boot Manager, the Secure Boot databases) sits almost entirely outside what Safeguard works on. We say exactly where that line falls near the end.

Key takeaways

• The recovery screen is usually doing its job. Firmware upgrades, boot manager changes, TPM changes and moving a drive are among Microsoft's listed triggers.
• Your key is usually in a Microsoft account, a work or school account, a printout or a USB drive. Microsoft Support cannot recover a lost key.
• Suspend before firmware work, for a set number of restarts. Suspension leaves the key in the clear, so keep the window short.
• Windows RE starts on its own after two consecutive failed starts or two quick crashes after boot.
• Boot loops after an update usually end with Uninstall updates in Windows RE, or DISM for pending packages.
• BlackLotus revocations are permanent while Secure Boot is on. Rebuild boot media and back up keys before you apply them.

How Windows boots, in four phases

Microsoft's startup troubleshooting guide splits a Windows start into four phases, and the first job in any boot problem is working out which one fails.

On a TPM device, firmware and early boot components are measured into the TPM's Platform Configuration Registers (PCRs), and BitLocker releases the key automatically only when they match what it sealed against. Change the firmware, boot manager or Secure Boot configuration and BitLocker asks for the recovery password. Our explainer on Secure Boot, trusted boot and measured boot has more.

Why does BitLocker suddenly ask for a recovery key?

Microsoft's BitLocker recovery overview lists the common triggers. Grouped by cause:

So a prompt right after a firmware update, a dock swap or a Secure Boot change is expected, not a sign of attack. A prompt with no change you can explain deserves a look: Microsoft tells admins to find the root cause before handing over the key, including whether the device was left unattended. KB5025885 also warns that "Some devices may go into BitLocker recovery" when its Secure Boot changes are applied.

If you are still choosing between TPM only and TPM with a PIN, our posts on TPM only versus TPM with PIN and whether you need a TPM for BitLocker cover the tradeoffs.

Where do you find the BitLocker recovery key?

Microsoft's consumer support page lists these places, and you should check them in this order from a different device:

1. Your Microsoft account. Go to aka.ms/myrecoverykey, sign in and look for the entry whose key ID matches the screen. If someone else set up the PC or turned on BitLocker, the key may be in that person's account. Microsoft says that from Windows 11 version 24H2, the recovery screen shows a hint of the associated Microsoft account.
2. Your work or school account. Go to aka.ms/aadrecoverykey, sign in, select Devices, expand the device and choose View BitLocker Keys. Microsoft's admin documentation gives the same path through myaccount.microsoft.com.
3. A printout made when BitLocker was turned on.
4. A USB flash drive. Plug it into the locked PC and follow the prompts. If the key was saved as a text file, read it on another device.

Match the key ID before you type

The recovery screen shows a key ID. Use its first 8 characters to pick the right key when an account holds several. The password itself is 48 digits in groups of six, and Microsoft notes the recovery console checksums each block so you can correct a typo.

For organisations

The recovery overview describes the managed options:

Microsoft warns that backup to Entra ID or AD DS "may not happen automatically" unless policy enables it. Our post on where to store recovery keys for encrypted laptops goes deeper.

If you cannot find it

Microsoft Support "doesn't have the ability to retrieve, provide, or recreate a lost BitLocker recovery key." If the device is managed, ask IT. Otherwise, try undoing the change first: restoring a boot order, re-enabling the TPM or re-docking can bring the measurements back. If nothing works, resetting the device is the remaining path, and Microsoft warns it removes all your files.

After you use the key

Unlocking with a recovery password resets the TPM validation measurements to the current configuration. Microsoft recommends invalidating a used recovery password; the commands are in step 10 below.

How do you suspend BitLocker before a BIOS or UEFI update?

For planned changes, Microsoft says to suspend BitLocker rather than turn it off. The drive stays encrypted, and resuming reseals the key to the new measurements. But the Suspend-BitLocker reference says suspension "makes the encryption key available in the clear" and skips integrity checks at start up, so keep the window short.

The two commands

PowerShell, run as administrator:

# Check the current state first
Get-BitLockerVolume -MountPoint "C:"

# Suspend for exactly one restart
Suspend-BitLocker -MountPoint "C:" -RebootCount 1

Command prompt, run as administrator:

:: Check the current state first
manage-bde -status C:

:: Suspend for exactly one restart
manage-bde -protectors -disable C: -rc 1

The facts behind those lines, from Microsoft's references:

If the device maker says a flash takes two restarts, use a reboot count of 2 or 3 so protection does not resume halfway through. Microsoft's own example uses -rc 3.

Confirm protection came back

Get-BitLockerVolume -MountPoint "C:" | Format-List VolumeStatus, ProtectionStatus, KeyProtector

You want ProtectionStatus : On. In manage-bde -status C: output, look for Protection Status: Protection On. If it still says off after the planned restarts, resume it manually.

Warning: do not use -RebootCount 0 and forget it. Zero means indefinite suspension, which leaves the volume key unprotected on the disk. Microsoft also notes that resuming protection only works on devices that have accepted the Windows license terms, which matters on freshly imaged machines.

What is Windows RE and how do you reach it?

Windows Recovery Environment (Windows RE or WinRE) is a small recovery operating system based on Windows PE. Microsoft says it is preloaded on Windows 10 and Windows 11 desktop editions and on Windows Server 2016 and later. It lives in its own recovery partition so it can still run when the Windows partition is encrypted or damaged.

Ways in

From a working Windows session, Microsoft lists:

• On the sign in screen, select Power, hold Shift and select Restart.
• Settings, System, Recovery, Advanced startup, Restart now (the path on older Windows 10 builds goes through Update and Security).
• Boot from recovery media.
• A hardware recovery button or key combination set by the device maker.

Windows RE also starts automatically when it detects:

• Two consecutive failed attempts to start Windows.
• Two consecutive unexpected shutdowns within two minutes of boot completion.
• Two consecutive reboots within two minutes of boot completion.
• A Secure Boot error, except errors related to Bootmgr.efi.
• A BitLocker error on touch only devices.

What you will be asked for

Microsoft says that when Windows RE starts automatically, the TPM can confirm on supported devices that Windows RE is unmodified and unlock the drive without a key. If you start Windows RE from a repair disk, you must type the recovery key. On the BitLocker screen in Windows RE, Win+Ctrl+Enter starts Narrator.

What is in it

Microsoft's recovery options page adds quick machine recovery (Windows 11 24H2 and later), which checks Windows Update for a Microsoft fix after repeated boot failures. The Windows RE reference says it is off by default on managed devices and on by default on unmanaged ones.

What does Startup Repair do, and when should you use bootrec or bcdboot?

Startup Repair analyses startup logs and tries to fix the cause automatically. Microsoft's BitLocker documentation notes a limit: when it launches automatically, it only repairs operating system and driver files that the boot logs or a crash dump point to. Its log is at %windir%\System32\LogFiles\Srt\SrtTrail.txt and often names the failing file.

Microsoft's troubleshooting guide then maps errors to commands:

bootrec /fixmbr and /fixboot target the BIOS era master boot record. On UEFI machines the boot manager lives on the EFI System Partition, and bcdboot copies fresh boot files there; KB5025885 uses it with /f UEFI.

Step by step: recovering a PC that will not start

This walkthrough follows Microsoft's documentation in the order that is least likely to make things worse. Do not skip the checks between steps.

Step 1: write down what changed

Note what happened just before the failure: firmware update, Windows update, new drive, dock, Secure Boot change, power cut. It decides almost everything below.

Step 2: get the recovery key ready

Find the key on another device before any repair, because Windows RE started from media will ask for it.

Step 3: reach Windows RE

Let Windows fail twice, or boot a recovery drive or install media and choose Repair your computer, then Troubleshoot.

Step 4: try Startup Repair

Troubleshoot, Advanced options, Startup Repair. Restart and test.

Step 5: if an update caused it, uninstall the update

Troubleshoot, Advanced options, Uninstall updates, latest quality update first. Restart and test.

Step 6: open the command prompt and unlock the drive

Troubleshoot, Advanced options, Command Prompt. A locked Windows volume must be unlocked before any tool can read it.

Device path check. Drive letters in Windows RE are often different from normal Windows. List volumes before you run anything that writes:

:: Read only: list volumes and their labels, sizes and file systems
diskpart
list volume
exit

:: Read only: see which volumes are BitLocker protected and locked
manage-bde -status

Identify the Windows volume by size and label. In the examples below it is C:, and the EFI System Partition is assigned S:. Replace these with what you actually see.

Unlock it with the 48 digit recovery password (from Microsoft's operations guide):

manage-bde -unlock C: -recoverypassword 111111-222222-333333-444444-555555-666666-777777-888888

Step 7: check for pending update packages

From Microsoft's troubleshooting guide, for issues after installing updates:

:: Read only: list packages in the offline image and their state
DISM /image:C:\ /get-packages

Look for packages in an Install Pending or Uninstall Pending state.

Warning before the next block. Removing packages and reverting pending actions changes the offline Windows image. Confirm that C:\ is the Windows volume (it should contain Windows, Program Files and Users when you run dir C:\). Copy any files you cannot lose to another drive first if you can.

dir C:\
DISM /image:C:\ /remove-package /packagename:<name from get-packages>
DISM /image:C:\ /cleanup-image /revertpendingactions

Restart and test.

Step 8: check system files and the disk

Warning. chkdsk /f /r can run for hours on a large drive and will try to recover data from bad sectors. If you suspect the drive is failing physically, image it or copy data off first.

:: Offline system file check against the Windows install on C:
sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows

:: Disk check on the Windows volume
chkdsk C: /f /r

Step 9: repair the boot files (UEFI systems)

Only do this if the errors point at the boot manager or BCD, and only after Startup Repair has failed.

Warning before writing boot files. bcdboot copies new boot files to the partition you name with /s. Point it at the wrong partition and you overwrite something else. Assign a letter to the EFI System Partition and confirm it before running anything.

diskpart
list disk
select disk 0
list partition
:: The EFI System Partition is usually FAT32, 100 to 300 MB, type System
select partition 1
assign letter=S
list volume
exit

:: Confirm S: is the EFI partition: you should see an EFI folder
dir S:\
dir S:\EFI\Microsoft\Boot

:: Back up the current BCD store before changing anything
bcdedit /export C:\bcdbackup

:: Copy fresh boot files from the Windows install to the EFI partition
bcdboot C:\Windows /s S: /f UEFI

The disk and partition numbers above are examples. Select the partition whose size and type match the EFI System Partition on your machine.

Step 10: after Windows starts

Check BitLocker status, then replace the recovery password you just used, using the sequence from Microsoft's operations guide:

manage-bde -status C:
manage-bde -protectors -delete C: -type RecoveryPassword
manage-bde -protectors -add C: -RecoveryPassword
manage-bde -protectors -get C: -Type RecoveryPassword
:: Then, for Entra ID or AD DS respectively, using the ID from the previous output:
manage-bde -protectors -aadbackup C: -id {ID}
manage-bde -protectors -adbackup C: -id {ID}

Warning. Run -add straight after -delete, and write down or back up the new password before you restart. Between those two commands the OS drive has no recovery password protector.

How do you get out of a boot loop after an update?

Stuck on the recovery screen. Microsoft documents this command to break the cycle while you work. Set it back to yes afterwards, or you lose automatic Windows RE entry next time:

bcdedit /set {default} recoveryenabled no

Windows starts, crashes, restarts. Use Uninstall updates first. For a driver, Safe Mode lets you disable it, and a clean start with msconfig narrows down third party services.

Update applies, fails, rolls back, repeats. Pending operations can replay at every start; the DISM steps above are Microsoft's fix. Its further steps edit offline registry hives by hand, so follow the article directly and back up the hives first.

Within 10 days of a Windows version upgrade, Go back to the previous version is also available and keeps personal files.

How do you make and use a recovery drive?

Microsoft's steps are short:

1. Search Start for Recovery Drive, or run recoverydrive.exe.
2. Keep "Back up system files to the recovery drive" selected and select Next.
3. Connect a USB drive, select it, select Next, then Create.

Warning. Microsoft says to "Use an empty USB drive because this process will erase any data that's already stored on the drive." Unplug other USB storage before you start so you cannot pick the wrong device in step 3.

The drive holds Windows system files, installed updates and the device maker's customisations, not your personal files. It is meant for the device it was made for, and Microsoft recommends recreating it every year. Microsoft's page now also flags that drives made after the April 2024 updates with the revocation policy applied are affected by KB5025885, covered next. For offline media more broadly, see hardware encrypted USB drives and bootable recovery media.

Admins often also keep a Windows PE (WinPE) stick, the small deployment and repair OS that Windows RE is built on. Microsoft notes it restarts after 240 hours of continuous use and loses all changes at reboot. It is subject to the same Secure Boot revocations.

What was BlackLotus?

BlackLotus is a UEFI bootkit: malicious code that runs at startup before Windows loads. Microsoft's incident response team published investigation guidance on 11 April 2023. Microsoft describes it as "primarily a persistence and defense evasion mechanism" and stresses that it is not an initial access tool. An attacker needs administrative or physical access to the device first. Once installed, Microsoft says it can turn off protections including BitLocker, HVCI and Microsoft Defender Antivirus.

To get around Secure Boot, BlackLotus used a vulnerability Microsoft tracks as CVE-2022-21894. The deeper issue, addressed under CVE-2023-24932, is that older vulnerable boot managers were still signed by a certificate the firmware trusted, so patching the boot manager on disk is not enough. The fix is to stop the firmware trusting the old ones, which is what revocation does. For an infected device, Microsoft's guidance is to take it off the network and reformat both the OS and EFI partitions, or restore a clean backup that includes the EFI partition.

What do the KB5025885 mitigation phases change?

KB5025885 is Microsoft's article on Windows Boot Manager revocations for CVE-2023-24932. As fetched on 23 October 2026, its change log runs to 30 September 2026.

Timeline

Microsoft says that when enforcement comes, the Windows Production PCA 2011 certificate will be added to the DBX automatically on capable devices, with no option to disable it. Until then, the mitigations are not enabled by default.

The four steps

The registry key is HKLM\SYSTEM\CurrentControlSet\Control\Secureboot, and after setting a value Microsoft has you run the \Microsoft\Windows\PI\Secure-Boot-Update scheduled task. Microsoft's June 2026 note says step 1 may already be complete on devices it has marked "High Confidence".

Check before you change anything

Read only checks, from KB5025885:

# Is the 2023 CA already in DB? Expect True after step 1.
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

# Servicing status. Expect Updated after step 1 completes.
(Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing").UEFICA2023Status

Applying step 1

Warning before applying any KB5025885 step. Back up the BitLocker recovery key first (manage-bde -protectors -get %systemdrive% from an admin prompt, as KB5025885 itself suggests), and confirm it is stored off the device. Test on one device of each hardware model before a wider rollout, because Microsoft lists firmware that fails these updates. Steps 3 and 4 cannot be undone while Secure Boot stays on.

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x5944 /f

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Re-run the two checks above and confirm True and Updated before moving on. Follow the KB's own wording for the later steps; it has been revised several times and is the authority on exact order and verification for each.

Side effects Microsoft lists

• Irreversible. Once applied, Microsoft says it "cannot be reverted if you continue to use Secure Boot on that device," and "Even reformatting of the disk will not remove the revocations if they have already been applied."
• BitLocker recovery on some devices.
• Firmware or platforms that fail the update. Microsoft's known issues list covers specific device models, Arm64 devices, some virtual machines and older Windows Server versions. Read the current list before you start.
• Old boot media. Covered in the next section.

For how this sits alongside the 2026 Secure Boot certificate changes, see Secure Boot certificates expire in 2026: what to check and UEFI Secure Boot and the supply chain in 2026.

Why can the mitigations make old boot media unusable?

Every bootable Windows USB stick, ISO, PXE image and recovery drive carries its own copy of the boot manager. Media made before these changes carries a boot manager signed under Windows Production PCA 2011. Once step 3 puts that certificate in the DBX, the firmware refuses to start anything signed by it, including your old recovery stick.

The SVN step tightens this further. Microsoft's 30 September 2026 known issue says that if you deployed a Windows security update released in April 2026 or later and then enabled PCA 2011 revocations, SVN 5.0 was applied to the firmware, which "invalidates older external boot media that was not built with Windows security updates" from January 2025 or earlier.

The practical effect: the day you most need a recovery stick is the day you discover it no longer boots. So rebuild media before you revoke.

Rebuilding media the way Microsoft documents

After the device has the latest updates and step 1 applied, make a new recovery drive (formatted FAT32), then refresh its boot files. In this example the USB drive is D:.

Warning and device path check. These commands write to the drive letter you give. Run diskpart then list volume and confirm that D: is the USB stick by size and label, and that dir D:\EFI\MICROSOFT\BOOT shows a BCD file, before you continue. Pointing bcdboot at your system disk instead would overwrite its boot files.

COPY D:\EFI\MICROSOFT\BOOT\BCD D:\EFI\MICROSOFT\BOOT\BCD.BAK
bcdboot c:\windows /f UEFI /s D: /bootex
COPY D:\EFI\MICROSOFT\BOOT\BCD.BAK D:\EFI\MICROSOFT\BOOT\BCD

The first line backs up the media's BCD, the second copies the updated boot files, the third puts the original BCD back. Microsoft documents the same three lines for media built with Dynamic Update.

Microsoft also documents a repair app, securebootrecovery.efi, for devices whose Secure Boot settings were reset to defaults and lost the 2023 CA. It says not to use it on devices listed in its known issues. Follow the KB rather than a summary for that one.

What should admins stage before rolling out Secure Boot or firmware changes?

Where Safeguard fits, honestly

Most of this post is outside Safeguard's scope. Safeguard does not manage devices, escrow BitLocker keys, scan firmware, inspect boot managers or Secure Boot databases, or provide endpoint protection. None of the recovery steps above involve it.

The connection is narrow. Boot components such as GRUB and shim are packages inside the Linux OS and appliance images many teams build, and those images' SBOMs should list them so you can answer "which images carry this version" when a revocation lands. Safeguard scans repositories, container images and SBOM files, matches components against vulnerability data and shows which projects contain a given component and version. That helps with the software after the machine boots, not with the boot.

Common mistakes

• Typing guesses at the recovery screen. Too many wrong attempts are themselves a trigger. Match the key ID first.
• Turning BitLocker off instead of suspending it. Microsoft says decryption should happen when protection is no longer needed, "and not as a troubleshooting step."
• Suspending with a reboot count of 0 and forgetting. The key sits in the clear until someone resumes protection.
• Keeping the only key copy on the PC, or the key USB in the laptop bag. Microsoft warns against both.
• Running bcdboot or bootrec without checking letters. Windows RE letters differ. Run list volume every time.
• Disabling Secure Boot permanently to "fix" a boot error. It removes protection against the bootkit class BlackLotus belongs to.
• Applying DBX revocation before rebuilding media. Your recovery stick and install USB stop working on that device, permanently while Secure Boot is on.
• Not rotating a used recovery password, or leaving recoveryenabled no in place after troubleshooting.

Fix it without waiting for upstream

A reimaged or recovered machine pulls its development dependencies again from scratch, and the software your team ships keeps its own open source risk whatever happened to the boot chain. Safeguard does not repair a boot loop or a BitLocker prompt; this section is about the dependencies and images you build once the machine runs again.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

FAQ

Why is BitLocker asking for a recovery key after a BIOS update?

A firmware update changes the boot measurements the TPM checks, and Microsoft lists it as a standard trigger. Enter the key once and the validation profile updates. Next time, suspend BitLocker first.

How do I find my BitLocker recovery key without a computer?

On a phone, open aka.ms/myrecoverykey (personal) or aka.ms/aadrecoverykey (work or school) and match the key ID shown on the PC.

Can Microsoft recover my lost BitLocker key?

No. Microsoft Support cannot retrieve or recreate it. IT may hold it in Entra ID or Active Directory; otherwise only a reset that erases the drive remains.

Is it safe to suspend BitLocker?

For a short, planned window, yes; Microsoft recommends it for firmware changes. The key is in the clear while suspended, so use a reboot count of 1 to 3 and confirm protection is back on.

How do I get into Windows Recovery Environment if Windows won't start?

Let Windows fail to start twice and Windows RE should open. Otherwise, boot from a recovery drive or install media and choose Repair your computer.

How do I uninstall a Windows update that causes a boot loop?

In Windows RE, choose Troubleshoot, Advanced options, Uninstall updates. If that fails, use DISM from the Windows RE command prompt to remove pending packages.

What is the difference between bootrec and bcdboot?

bootrec repairs the master boot record, boot sector and BCD, mainly on BIOS systems. bcdboot copies fresh boot files to a system partition, including the EFI System Partition on UEFI machines.

Why won't my old Windows USB drive boot anymore?

If the PC has the Windows Production PCA 2011 revocation applied, firmware refuses boot managers signed under it, including older media. Rebuild the media on an updated PC.

Can I undo the BlackLotus mitigations?

Not while Secure Boot stays on. Microsoft says the revocations cannot be reverted, even by reformatting the disk.

See how Safeguard would help

None of these demos repair a boot problem, unlock BitLocker or touch firmware. They show the software side once a machine runs again.

The first is a real CLI session: it opens the interactive terminal with safeguard, asks it to "fix the lodash CVE in this repo", and shows it asking before each command, editing package.json to lodash 4.17.21, running npm install and npm test with approval, and pushing nothing. On a reimaged developer machine, the same flow brings a freshly cloned project onto fixed versions with a human approving every command.

Click through it at your own pace, or open it full screen.

The second sets up the local runner on your own machine, approves it with its device code and scans from the terminal. If you build OS or appliance images that carry GRUB and shim, this is how you scan those images and their SBOMs on your own hardware. See how the local runner and offline mode work.

Click through it at your own pace, or open it full screen.

The third connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. During a fleet rebuild, it lets someone ask in plain language which projects contain a component and version, with only the access you grant.

Click through it at your own pace, or open it full screen.

To try the CLI yourself, download it from safeguard.sh/download and read the CLI docs.

Quick check

Sources

• Microsoft Learn: BitLocker recovery overview
• Microsoft Learn: BitLocker recovery process
• Microsoft Learn: BitLocker operations guide
• Microsoft Support: Finding your BitLocker recovery key in Windows
• Microsoft Learn: manage-bde
• Microsoft Learn: manage-bde protectors
• Microsoft Learn: Suspend-BitLocker
• Microsoft Learn: Windows Recovery Environment (Windows RE)
• Microsoft Learn: Windows startup issues troubleshooting
• Microsoft Learn: Windows PE (WinPE)
• Microsoft Support: Recovery options in Windows
• Microsoft Support: Create a recovery drive
• Microsoft Support: KB5025885, How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932
• Microsoft Security Blog: Guidance for investigating attacks using CVE-2022-21894, the BlackLotus campaign

Last reviewed: 23 October 2026. Microsoft revises KB5025885 often; check it for the current enforcement date and known issues before any rollout.