Give the Windows recovery response to someone who cannot use their phone

When someone cannot use their phone on Windows (even without a network), the panel shows a 10-digit challenge. The technician works out the response in the console and reads it to the person.

First: check the identity

«Check who is calling first.» Use a channel that does not depend on the account concerned (in person, or a call to a number you already know). Never ask for the password or the phone's codes.

How do I get the response?

1. Open «Manage» › «Computers» and the «Details» of the computer the person names.
2. In the «Helpdesk recovery» section, fill in:
   • «Windows account SID»: the person's account;
   • «Situation»: sign-in or unlock;
   • «Challenge (10 digits)»: the code the person reads to you.
3. Choose «Get the answer». The console asks for a recent confirmation.
4. «Read this answer to the person; it is shown only here.» The response has 10 digits.

What happens next?

• The challenge works once and expires.
• Each response is audited (desktop.recovery.issued), and so is its use when the computer is back online (desktop.recovery.used).
• The computer gets a new recovery key at its next sync, so the response cannot be reused.

Why does it work offline?

The response is computed from the recovery key the computer stored with the service, sealed to the organization and that computer. No password is shared.

The computer has not stored its key yet

The details show «The computer has not escrowed its recovery key yet.» This happens right after enrolment; the key arrives at the first sync.

After the recovery

If the person lost their phone, also remove it or do an authenticator reset. See Reset authenticators.