Merge pull request #158610 from ejarvi/patch-28

Update disk-encryption-overview.md

Author: PRMerger9

articles/virtual-machines/windows/disk-encryption-overview.md

@@ -62,6 +62,8 @@ Azure Disk Encryption uses the BitLocker external key protector for Windows VMs.
 
 BitLocker policy on domain joined virtual machines with custom group policy must include the following setting: [Configure user storage of BitLocker recovery information -> Allow 256-bit recovery key](/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings). Azure Disk Encryption will fail when custom group policy settings for BitLocker are incompatible. On machines that didn't have the correct policy setting, apply the new policy, force the new policy to update (gpupdate.exe /force), and then restarting may be required.
 
+Azure Disk Encryption does not store recovery keys. If the [Interactive logon: Machine account lockout threshold](/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold) security setting is enabled, machines can only be recovered by providing a recovery key via the serial console. Instructions for ensuring the appropriate recovery policies are enabled can be found in the [Bitlocker recovery guide plan](/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan).
+
 Azure Disk Encryption will fail if domain level group policy blocks the AES-CBC algorithm, which is used by BitLocker.
 
 ## Encryption key storage requirements  
@@ -88,4 +90,4 @@ The following table defines some of the common terms used in Azure disk encrypti
 - [Azure Disk Encryption scenarios on Windows VMs](disk-encryption-windows.md)
 - [Azure Disk Encryption prerequisites CLI script](https://github.com/ejarvi/ade-cli-getting-started) 
 - [Azure Disk Encryption prerequisites PowerShell script](https://github.com/Azure/azure-powershell/tree/master/src/Compute/Compute/Extension/AzureDiskEncryption/Scripts)
-- [Creating and configuring a key vault for Azure Disk Encryption](disk-encryption-key-vault.md)
+- [Creating and configuring a key vault for Azure Disk Encryption](disk-encryption-key-vault.md)