Device Encryption Failures

[paledin]

Device Encryption Support    Reasons for failed automatic device encryption: TPM is not usable, PCR7 binding is not supported, Hardware Security Test Interface failed and device is not InstantGo, Un-allowed DMA capable bus/device(s) detected, TPM is not usable

Can someone offer any suggestions?

[Nathanv]

I've run into this same problem on my laptop. I don't think HP includes any form of drive encryption. I tried enabling Bitlocker provided by Windows 10 and it tells me that my laptop doesn't even contain a TPM.

However, it did suggest a way of enabling Bitlocker without a TPM. In the search bar at the bottom left of your desktop next to the windows logo type "Manage Bitlocker." A window will pop up and you can try searching through the TPM Administrator or Disk Management in the bottom left corner of the window. I'd start there. Passed that I can't help.

However, while HP doesn't offer free technical support (why the heck not absolutely baffles me),  you know who does offer free technical support? Microsoft!!! So I would call or online chat their technical support for help. They're amazing.

[SHIELD2]

This should work Now people are trying this when there computer was compatable Microsoft soft screwed it up

but they kepted trying to it didn't now you can follow these instructions or have some skilled to do it for you

''''''''''''https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-bitlocker ''''this what I just found and a few years using windows 10 

BitLocker drive encryption in Windows 10 for OEMs
03/23/2018
3 minutes to read
BitLocker drive encryption provides offline data and operating system protection by ensuring that the drive is not tampered with the operating system is offline. BitLocker drive encryption uses a TPM, either discrete or firmware, that supports the Static Root of Trust Measurement as defined by the Trusted Computing Group.

BitLocker drive encryption hardware requirements
BitLocker drive encryption uses a system partition separate from the Windows partition. The BitLocker system partition must meet the following requirements.

The BitLocker system partition is configured as the active partition.
The BitLocker system partition must not be encrypted.
The BitLocker system partition must have at least 250 MB of free space, above and beyond any space used by required files. This additional system partition can be used to host Windows Recovery Environment (RE) and OEM tools (provided by the OEM), so long as the partition still meets the 250 MB free space requirement.
For more information see System.Client.SystemPartition, and Hard Drives and Partitions.

BitLocker automatic device encryption
BitLocker automatic device encryption uses BitLocker drive encryption technology to automatically encrypt internal drives after the user completes the Out Of Box Experience (OOBE) on InstantGo or HSIT compliant hardware.

Note: BitLocker automatic device encryption is enabled only after users sign in with a Microsoft Account or an Azure Active Directory account. BitLocker automatic device encryption is not enabled with local accounts, in which case BitLocker can be manually using the BitLocker Control Panel.

BitLocker automatic device encryption hardware requirements
BitLocker automatic device encryption is enabled when:

The device contains a TPM (Trusted Platform Module), either TPM 1.2 or TPM 2.0.
UEFI Secure Boot is enabled. See Secure boot for more information.
Platform Secure Boot is enabled
Direct memory access (DMA) protections is enabled
The following tests must pass before Windows 10 will enable Automatic BitLocker device encryption. If you want to create hardware that supports this capability, you must verify that your device passes these tests.

TPM: Device must include a TPM with PCR 7 support. See System.Fundamentals.TPM20.TPM20.
Secure boot: UEFI Secure Boot is enabled. See System.Fundamentals.Firmware.UEFISecureBoot.
InstantGo (AOAC) requirements or HSTI validation. This requirement is met by one of the following:
InstantGo (AOAC) requirements are implemented. These include requirements for UEFI secure boot and protection from unauthorized DMA.
Starting with Windows 10, version, 1703, this requirement can be met through HSTI test:
Platform Secure Boot self-test (or additional self-tests as configured in the registry) must be reported by HSTI as implemented and passed.
Excluding Thunderbolt, HSTI must report no non-allowed DMA busses.
If Thunderbolt is present, HSTI must report that Thunderbolt is configured securely (security level must be SL1 – “User Authorization” or higher).
You must have 250MB of free space on top of everything you need to boot (and recover Windows, if you put WinRE on the system partition). For more information, see System.Client.SystemPartition.
When the requirements as listed above are met, System Information indicates the system supports BitLocker automatic device encryption. This functionality is available in Windows 10, version 1703 or after. Here's how to check System Information.

Click Start, and type System information
Right-click System Information app and click Open as Administrator. Allow the app to make changes to your device by clicking Yes. Some devices might require elevated permissions to view the encryption settings.
In System Summary, see Device Encryption Support. The value will state if the device is encrypted, or if not, reasons why it is disabled.
Un-allowed DMA capable bus/device(s) detected
This System Information status in Device Encryption Support means Windows detected at least one potential external DMA capable bus or device that may expose a DMA threat.

To resolve this issue, contact the IHV(s) to determine if this device has no external DMA ports. If confirmed by the IHVs that the bus or device only has internal DMA, then the OEM can add this to the allowed list.

To add a bus or device to the allowed list, navigate to registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DmaSecurity\AllowedBuses

Add string (REG_SZ) name/value pairs for each flagged DMA capable bus that is determined to be safe:

Key: device friendly name /description
Value: PCI\VEN_ID&DEV_ID.
Ensure the IDs match the output from the HLK test. For example, if you have a safe device with a friendly name of “Contoso PCI Express Root Port”, vendor ID 1022 and Device ID 157C, you would create the following Registry entry as REG_SZ data type:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DmaSecurity\AllowedBuses!Contoso PCI Express Root Port

Where the value = "PCI\VEN_1022&DEV_157C"

Disable BitLocker automatic device encryption
OEMs can choose to disable device encryption and instead implement their own encryption technology on a device. To disable BitLocker automatic device encryption, you can use an Unattend file and set PreventDeviceEncryption to True. Alternately, you can update this registry key:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BitLocker Value: PreventDeviceEncryption equal to True (1).

Related topics
Windows 10 S security features and requirements for OEMs

[SHIELD2]

 also would Like HP to to alsp Put this and SP"# version so it can find what it need's from you're computer ad do the adding to save time for those who don't under stand how the system regedit works  also it's shouldn't be touched unless they know what there doing ,so this will aloow any version of MS win 10 after 1503-1703-1709 qand the new faller crators that put on hold cause bug microsft say's they found a Bug in no news on when it's gonna be releated it was supposto be released april 10th 2018 but it's ON -HOLD NOW do a But from insider's report's.,

[SHIELD2]

Plus I have the new released version that was supposted be released to the general Public on April 10 2018 

it's Stripped ver's with out Cortanna No Windows Defender Security it's all gone in NO xbox eaither and few other Bloatware feature "REMOVED" it runn's a heck of lot faster then all the previsors ver's of windows 10 you don't need all that BLOAT ware Microsoft put into windows 10 to cause False Pos and errors alowing down you're PC Labtop Note books tabbles ec.

[SHIELD2]

'''''''''''''''''''''''''''''''''''''''https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-bitlocker'''''''''''''''' this what I just found and a few years using windows 10

BitLocker drive encryption in Windows 10 for OEMs
03/23/2018
3 minutes to read
BitLocker drive encryption provides offline data and operating system protection by ensuring that the drive is not tampered with the operating system is offline. BitLocker drive encryption uses a TPM, either discrete or firmware, that supports the Static Root of Trust Measurement as defined by the Trusted Computing Group.

BitLocker drive encryption hardware requirements
BitLocker drive encryption uses a system partition separate from the Windows partition. The BitLocker system partition must meet the following requirements.

The BitLocker system partition is configured as the active partition.
The BitLocker system partition must not be encrypted.
The BitLocker system partition must have at least 250 MB of free space, above and beyond any space used by required files. This additional system partition can be used to host Windows Recovery Environment (RE) and OEM tools (provided by the OEM), so long as the partition still meets the 250 MB free space requirement.
For more information see System.Client.SystemPartition, and Hard Drives and Partitions.

BitLocker automatic device encryption
BitLocker automatic device encryption uses BitLocker drive encryption technology to automatically encrypt internal drives after the user completes the Out Of Box Experience (OOBE) on InstantGo or HSIT compliant hardware.

Note: BitLocker automatic device encryption is enabled only after users sign in with a Microsoft Account or an Azure Active Directory account. BitLocker automatic device encryption is not enabled with local accounts, in which case BitLocker can be manually using the BitLocker Control Panel.

BitLocker automatic device encryption hardware requirements
BitLocker automatic device encryption is enabled when:

The device contains a TPM (Trusted Platform Module), either TPM 1.2 or TPM 2.0.
UEFI Secure Boot is enabled. See Secure boot for more information.
Platform Secure Boot is enabled
Direct memory access (DMA) protections is enabled
The following tests must pass before Windows 10 will enable Automatic BitLocker device encryption. If you want to create hardware that supports this capability, you must verify that your device passes these tests.

TPM: Device must include a TPM with PCR 7 support. See System.Fundamentals.TPM20.TPM20.
Secure boot: UEFI Secure Boot is enabled. See System.Fundamentals.Firmware.UEFISecureBoot.
InstantGo (AOAC) requirements or HSTI validation. This requirement is met by one of the following:
InstantGo (AOAC) requirements are implemented. These include requirements for UEFI secure boot and protection from unauthorized DMA.
Starting with Windows 10, version, 1703, this requirement can be met through HSTI test:
Platform Secure Boot self-test (or additional self-tests as configured in the registry) must be reported by HSTI as implemented and passed.
Excluding Thunderbolt, HSTI must report no non-allowed DMA busses.
If Thunderbolt is present, HSTI must report that Thunderbolt is configured securely (security level must be SL1 – “User Authorization” or higher).
You must have 250MB of free space on top of everything you need to boot (and recover Windows, if you put WinRE on the system partition). For more information, see System.Client.SystemPartition.
When the requirements as listed above are met, System Information indicates the system supports BitLocker automatic device encryption. This functionality is available in Windows 10, version 1703 or after. Here's how to check System Information.

Click Start, and type System information
Right-click System Information app and click Open as Administrator. Allow the app to make changes to your device by clicking Yes. Some devices might require elevated permissions to view the encryption settings.
In System Summary, see Device Encryption Support. The value will state if the device is encrypted, or if not, reasons why it is disabled.
Un-allowed DMA capable bus/device(s) detected
This System Information status in Device Encryption Support means Windows detected at least one potential external DMA capable bus or device that may expose a DMA threat.

To resolve this issue, contact the IHV(s) to determine if this device has no external DMA ports. If confirmed by the IHVs that the bus or device only has internal DMA, then the OEM can add this to the allowed list.

To add a bus or device to the allowed list, navigate to registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DmaSecurity\AllowedBuses

Add string (REG_SZ) name/value pairs for each flagged DMA capable bus that is determined to be safe:

Key: device friendly name /description
Value: PCI\VEN_ID&DEV_ID.
Ensure the IDs match the output from the HLK test. For example, if you have a safe device with a friendly name of “Contoso PCI Express Root Port”, vendor ID 1022 and Device ID 157C, you would create the following Registry entry as REG_SZ data type:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DmaSecurity\AllowedBuses!Contoso PCI Express Root Port

Where the value = "PCI\VEN_1022&DEV_157C"

Disable BitLocker automatic device encryption
OEMs can choose to disable device encryption and instead implement their own encryption technology on a device. To disable BitLocker automatic device encryption, you can use an Unattend file and set PreventDeviceEncryption to True. Alternately, you can update this registry key:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BitLocker Value: PreventDeviceEncryption equal to True (1).

Related topics
Windows 10 S security features and requirements for OEMs