BITLOCKER STALE RECOVERY KEY CLEANUP: NO MORE SILENT ENCRYPTION FAILURES

Summary from the TLDR InfoSec newsletter

The author discusses how they discovered a new unannounced BitLocker feature in a Windows Insider Preview build that automatically cleans up stale recovery keys when the 200-key limit is reached in Microsoft Entra ID. Using IDA Pro to analyze the fveskybackup.dll file, along with Fiddler and ETL traces for monitoring API calls, the author uncovered two critical functions that handle the automatic deletion of stale recovery keys in batches of 16. This discovery points to the resolution of a long-standing issue where silent encryption would fail when hitting the key limit, eliminating the need for manual cleanup by IT administrators once the feature reaches general availability.