Event ID 796Normal BitLocker operation event

What to check

None needed. Confirm the recovery key also appears on the device in Entra ID.

Find it with PowerShell

Run on the machine that logs it.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-BitLocker/BitLocker Management'; Id = 796 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-BitLocker/BitLocker Management log to your workspace, where it lands in the Event table.

1
2
3
4
5Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-BitLocker/BitLocker Management" and EventID == 796
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related BitLocker events

• Event ID 853: Compatible TPM not found, or bootable media detected
• Event ID 854: WinRE is not configured
• Event ID 851: Failed to enable silent encryption
• Event ID 846: Failed to back up recovery information to Entra ID
• Event ID 778: Volume reverted to an unprotected state
• Event ID 845: Normal BitLocker operation event

Search all 123 event IDs →