Windows 11 Home - TPM Encryption

Bigs · Apr 29, 2022

Comport Colin said:
Here is my article that shows how to use bitlocker on Win10/11 Home despite the lack of "modern standby" or whatever MS thinks is needed:

How to use Bitlocker on Windows 10 Home | Experts Exchange

Learn more about How to use Bitlocker on Windows 10 Home from the expert community at Experts Exchange

www.experts-exchange.com

Thank you for the comprehensive information.
I followed all your steps to the letter.
After the cmd command "manage-bd -on c: -used",
I had the "Used Space Only encryption is now in progress" come up in the same cmd window.
I then rebooted to Win11 Home, and ran the cmd command "manage-bde c: -protectors -add -rp -tpm".
The following cmd line came up, showing an error:
Microsoft Windows [Version 10.0.22000.613]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\system32>manage-bde c: -protectors -add -rp -tpm
BitLocker Drive Encryption: Configuration Tool version 10.0.22000
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

Key Protectors Added:

ERROR: An error occurred (code 0x8031005a):
This version of Windows does not support this feature of BitLocker Drive Encryption. To use this feature, upgrade the operating system.

C:\Windows\system32>

Would this have anything to with the fact that I'm running Windows 11 Home?
Bear in mind, I have just added a "GC-TPM2.0_S 2.0" module to my existing Gigabyte board.
Apparently I didn't need it, as my system shows TPM is active, and the above cmd of yours verified it was active and working.
But it's the correct module for my board (Z390-UD rev.1).
Any hints on the error message would be greatly appreciated.
Even tho I got the error, would my drive be encrypted (as per the cmd message)?
I assume not, as there'es no LOCK showing over the Drive icon in Folder view.

Bigs · Apr 29, 2022

Also, when I Shift/Restarted and picked "Troubleshoot/Advanced Op/Command Prompt", it didn't ask me for a Admin account password.
Maybe this is because I auto login?
But it took the following "manage-bde -on c: -used" command no problem.
Everything up to adding "Protectors" command went no problems, but produced ther "error" message above.

Comport Colin · Apr 29, 2022

That is weird. As indicated, it works on the current version of Win11 home, tested yesterday. I see no reason, why it would work differently on your machine, since Bitlocker (not device encryption, but Bitlocker) does not care for your hardware capabilities. Please see which TPM is active and see what state it is in: open tpm.msc and share a screenshot.

Bigs · Apr 29, 2022

Comport Colin · Apr 29, 2022

Looks good. I will install win11 home on hardware (that is unsupported for device encryption) now and test again, hang on.

Bigs · Apr 29, 2022

thx, will check back later. Have to go out.
Wouldn't be because my hardware is a few years old? (Z390-UD)

Comport Colin · Apr 29, 2022

I found the glitch.
Took a USB stick to install windows and left it plugged in when entering the recovery environment (as you'll see, that makes a diefference), did manage-bde -on d: -used (since windows PE sees c: as d: when you install in MBR partitioning as I did)
Booted to windows, tried manage-bde -protectors -add c: -rp -tpm and got the same error like you, BUT: the USB stick (d:) was being encrypted :)
So I found what the problem was: winPE and windows had different associations what d: was. Repeated the same without the stick being plugged in - all works.

Please see if that solves it for you.

Comport Colin · Apr 29, 2022

Yep, this just works as indicated in the tutorial, when UEFI partitioning is used (this is a requirement for TPM2.0 as described). With UEFI (=GPT) partioning, c: is seen as c: on WInPE as well and when booting into windows, this problem of yours does not occur, AT LEAST NOT WITH a SINGLE DISK!

When MBR partitioning is used (only possible with TPM 1.2), when no stick (or 2nd hard drive that occupies volume d is attached, it will work as well. Your situation must have occured because c: on WinPE was not the windows OS drive.
So all you need to do is retry and use dir c:/dir d: / dir e: on WinPE to ensure which drive is which.

Bigs · Apr 29, 2022

Thank you so much for your time and effort, very much appreciated.
I won't get to try it out until tomorrow late, but will get back to you with the outcome.

Bigs · Apr 29, 2022

Well, I found H: drive to be my System drive, on running Dir command. (I have a few extra disks and partitions mounted)
So then I tried the "manage-bde -on h: -used" command and received an error saying:
"Bitlocker cannot be enabled on the Volume because it contains a Volume Shadow Copy".
Amongst other text, it then said to use "-RemoveVolumeShadowCopies".
I tried the "H: -RemoveVolumeShadowCopies" syntax, but that isnt the correct way.
Any ideas on how to remove Volume Shadow Copies?
Seem to be getting further now, anyway :)

Bigs · Apr 29, 2022

Got rid of Volume Shadow Copies, and ran commands again.
It worked this time. Thanks for all your help !!!
Only problem now is, the C: Drive does NOT show the LOCK icon in Folder Explorer View.

Bigs · Apr 30, 2022

The only place I can find that tells me I have Encryption on System Drive:
Note the lack of Lock icon on File manager snapshot.

Bigs · Apr 30, 2022

Is this enough to show I have Encryption on?
And should Lock Status show "Unlocked" ?
Still not able to work out why System Drive C: doesn't show Lock icon, tho.

Comport Colin · Apr 30, 2022

That's alright, then. Never saw explorer not showing a lock, though. Did you restart since then?

Bigs · Apr 30, 2022

yes, a few times
is it because I don't actually have Bitlocker?
or I don't actually have Modern Standby?
And it is Win11 Home

cereberus · Apr 30, 2022

Bigs said:
The only place I can find that tells me I have Encryption on System Drive:
Note the lack of Lock icon on File manager snapshot.View attachment 28014 View attachment 28016

That is because this method is bypassing the gui based method for doing encryption.

In the end, you have to recognise this is an unsupported way of using device encryption.

I do not really see point of using encryption on a desktop. It is more geared to laptops.

Bigs said:
yes, a few times
is it because I don't actually have Bitlocker?
or I don't actually have Modern Standby?
And it is Win11 Home

Boot from a windows installation drive, press shift+f10 to get to command prompt at first screen, the see of you can access C drive by typing

dir c:

If it is encrypted, it will not display directory

Bigs · Apr 30, 2022

I've done a WInPE boot, and with an elevated command prompt, it tells me it is Encrypted.
Also a "Dir" shows Folders, which is how I verified it was my System Disc, which is H: drive under WinPE boot.
Also with WinPE boot, and UNelevated command prompt, it says "It's locked with Bitlocker Encryption" and does NOT show drive contents.
Which I guess, is what you were referring to.

cereberus · Apr 30, 2022

Bigs said:
I've done a WInPE boot, and with an elevated command prompt, it tells me it is Encrypted.
Also a "Dir" shows Folders, which is how I verified it was my System Disc, which is H: drive under WinPE boot.
Also with WinPE boot, and UNelevated command prompt, it says "It's locked with Bitlocker Encryption" and does NOT show drive contents.
Which I guess, is what you were referring to.

Did you boot from a usb drive, not via the menus?

I could be wrong but I would be surprised if you could access a bitlocked drive from a usb drive.

Bigs · Apr 30, 2022

I did a Shift/Restart from Win11 Start menu, then picked Troubleshoot/Advanced Options/Command Prompt.
It asked for Recovery key to get Elevated Command Prompt, but last reboot I skipped that, and got normal Command Prompt.

Comport Colin · Apr 30, 2022

The overlay symbol ought to be present. Never seen without. But doesn't make a difference after all

Windows 11 Home - TPM Encryption

Well-known member

Attachments

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Similar threads