Windows 11 Home - TPM Encryption

Bigs · Apr 26, 2022

First time post here, excuse any lack of Protocols.

I've been running Windows 11 Home edition on a Gigabyte Z390-UD mainboard (3yr old) for well over 6 months with no problems.
My mainboard never had a TPM module, but my Bios settings let me install Win11, and have allowed me to run Secure Boot.
I have just now installed a TPM module "Gigabyte GC-TPM2.0_S 2.0 Trusted Platform Module for Z390".
The plan was so I could finally use Device Encrytion, as well as Secure Boot. (Obviously Home edition does not support Bitlocker)
The issue I now have is I DON'T have the option in Settings for Device Encryption.
After some research, I believe I need to have Modern Standby (S0 Low Power Idle) enabled.
I ran Command Prompt "powercfg /a" and found (see attached file):
Standby (S3), Hibernate, Hybrid Sleep, Fast Startup are available.
Standby (S1), (S2), (S0) not available, saying "The system firmware does not support this standby state".
So my question is: Have I reached the end of my search? Or can I still somehow enable Modern Standby (S0 Low Power Idle) ?
I do have "Networking connectivity in Standby" enabled in my Power Options, but I feel I'm nissing something obvious.

Something I also read:
"When writing this article, the Modern Standby feature is unavailable on some Windows 11 Home PCs. Unfortunately, this results in the Device Encryption option being missing as well, since both the features work synchronously. In essence, a bug in Windows 11 Home PC prevents data from being encrypted when the computer goes in any low power modes"

Any suggestions gratefully accepted, thanks in advance.

z3r010 · Apr 26, 2022

You don't need a TPM module, your motherboard has it built-in (Intel Platform Trust Technology - PTT).

Bigs · Apr 26, 2022

I did check my Gigabyte Z390-UD last year when I tried to install Win11, and it didn't support a TPM chip.
But like you say, it does have the Trust Tech PTT.
Either way, I can't access Device Encryption.

z3r010 · Apr 26, 2022

Have you turned it on in the Bios?

Bigs · Apr 26, 2022

Bios does show the TPM module now I just installed it.
Like I said, I've been running Secure Boot since installing Win11 6 mths ago.
Sys info always said that TPM something or other was active.
I can't find any other settings in Bios that would let me enable it, and I'm pretty sure Bios says it is enabled.

Bigs · Apr 26, 2022

Would Hybrid Sleep (which is available) be an issue?
Meaning, is it stopping the S0 sleep state?
I did set Sleep to happen after 1 minute, and it didn't. But I can manuall put it in Sleep state. Don't know which state that is, tho. S1, 2, or 3

Bigs · Apr 26, 2022

This is also what I get.
I ran the 'System Info' as administrator and under 'Device Encryption Support' is:

"Reasons for failed automatic device encryption: Hardware Security Test Interface failed and device is not Modern Standby, Un-allowed DMA capable bus/device(s) detected"

Dru2 · Apr 26, 2022

Bigs said:
I have just now installed a TPM module "Gigabyte GC-TPM2.0_S 2.0 Trusted Platform Module for Z390".

Bigs said:
Bios does show the TPM module now I just installed it.

I can't find any other settings in Bios that would let me enable it, and I'm pretty sure Bios says it is enabled.

You didn't need to buy a module, and it wasn't needed for Windows 11's TPM requirement. PTT would have worked just fine. That said, since you did install one, then under the "Peripherals" tab in your BIOS make sure "Trust Computing" is enabled. This is what actually enables the module.

Also, since you installed a module, I'm not sure you still need PTT enabled, BUT, if your issue still persists, try enabling it to see if that helps. But first, just enable Trust Computing and see how that goes before enabling PTT.

Hope this helps.

Bigs · Apr 26, 2022

I do have PTT enabled, and everything worked ok as far as it let me Secure Boot.
But I was told I needed the actual TPM module if I wanted to use Device Encryption.
That's now where the issue is, Device Encryption still does NOT show up in Settings.

Dru2 · Apr 26, 2022

Bigs said:
But I was told I needed the actual TPM module if I wanted to use Device Encryption.

Well....

Anyway - Turn on device encryption. Note this also requires an Administrator Account - Enable or Disable Built-in Administrator Account in Windows 11 Tutorial

BTW, why the need for Device Encryption?

cereberus · Apr 26, 2022

Bigs said:
I do have PTT enabled, and everything worked ok as far as it let me Secure Boot.
But I was told I needed the actual TPM module if I wanted to use Device Encryption.
That's now where the issue is, Device Encryption still does NOT show up in Settings.

Device encrypytion only works if you have a tp, or equivalent, AND Modern Standby.

Look at these tutorials.

Check if Modern Standby is Supported in Windows 11 Tutorial

This tutorial will show you how to check if the Modern Standby (S0 Low Power Idle) sleep state is supported by your Windows 10 or Windows 11 PC. In Windows 10 and Windows 11, there are two power models for PCs: S3 and Modern Standby (S0 Low Power Idle). The S3 power model is an older standard...

www.elevenforum.com

Disable Modern Standby in Windows 10 and Windows 11 Tutorial

This tutorial will show you how to disable Modern Standby (S0 Low Power Idle) to enable S3 support on a Windows 10 and Windows 11 device. In Windows 10 and Windows 11, there are two power models for PCs: S3 and Modern Standby (S0 Low Power Idle). The S3 power model is an older standard and is...

www.elevenforum.com

As a rule, modern standby is the default state, so I doubt it is there.

Even if pc supports tpm, and modern standby, device encryption still may not work depending on hardware age. 3 years old may still be too old.

If you want encryption, you will either need to upgrade to Pro or use some 3rd party tool.

Bigs · Apr 26, 2022

Dru2 said:
Well....

Anyway - Turn on device encryption. Note this also requires an Administrator Account - Enable or Disable Built-in Administrator Account in Windows 11 Tutorial

BTW, why the need for Device Encryption?

That's the issue, Device Encryption does NOT show up in settings.
I do use an Admin account.
As far as why turning on encryption, that's another story. Decision was made long ago.
Starting to think that "Device Encryption" isn't showing up because of "Sleep" state issues.
I read this on another Win11 forum post:
"When writing this article, the Modern Standby feature is unavailable on some Windows 11 Home PCs. Unfortunately, this results in the Device Encryption option being missing as well, since both the features work synchronously. In essence, a bug in Windows 11 Home PC prevents data from being encrypted when the computer goes in any low power modes"
I ran the 'System Info' as administrator and under 'Device Encryption Support' got this:
"Reasons for failed automatic device encryption: Hardware Security Test Interface failed and device is not Modern Standby, Un-allowed DMA capable bus/device(s) detected"
And a "powercfg -a" command prompt shows Standby (S1), (S2), (S0) not available.
Wheras Standby (S3), Hibernate, Hybrid Sleep, Fast Startup are available.
I also rebooted numerous times trying diasabling/enabling "Trusted Computing/Security Device support" (It's been enabled all the time),
and tried disabling/enabling "PTT" (It's been enabled all the time).
They both need to be on for "System Info" to show TPM is active, and to get "Secure Boot".
In a nutshell, Up until now, I've had TPM active and been using Secure Boot.
I installed the TPM module just today so I could use Device Encryption.

Bigs · Apr 26, 2022

cereberus said:
Device encrypytion only works if you have a tp, or equivalent, AND Modern Standby.

Look at these tutorials.

Check if Modern Standby is Supported in Windows 11 Tutorial

This tutorial will show you how to check if the Modern Standby (S0 Low Power Idle) sleep state is supported by your Windows 10 or Windows 11 PC. In Windows 10 and Windows 11, there are two power models for PCs: S3 and Modern Standby (S0 Low Power Idle). The S3 power model is an older standard...

www.elevenforum.com

Disable Modern Standby in Windows 10 and Windows 11 Tutorial

This tutorial will show you how to disable Modern Standby (S0 Low Power Idle) to enable S3 support on a Windows 10 and Windows 11 device. In Windows 10 and Windows 11, there are two power models for PCs: S3 and Modern Standby (S0 Low Power Idle). The S3 power model is an older standard and is...

www.elevenforum.com

As a rule, modern standby is the default state, so I doubt it is there.

Even if pc supports tpm, and modern standby, device encryption still may not work depending on hardware age. 3 years old may still be too old.

If you want encryption, you will either need to upgrade to Pro or use some 3rd party tool.

And I think what you're saying is the case. My hardware isn't recent enough.
So I wasted $20 on the module, will have to grin and bear it :)

cereberus · Apr 26, 2022

Bigs said:
And I think what you're saying is the case. My hardware isn't recent enough.
So I wasted $20 on the module, will have to grin and bear it :)

For $20, you could probably have go a cheap Pro licence somewhere online - however beware buying a cheap licence - a lot are scams.

z3r010 · Apr 26, 2022

The only place I've seen modern standby is on laptops, I have read the Microsoft documentation that states it is available on Desktops, but I've not seen one yet.

Bigs · Apr 26, 2022

I've just bought an ASUS laptop, installed Win11 Home, and enabled Device Encryption. Works just like I'm trying to get ther PC to do.
So looks like it's not possible, then.

Thanks again for all the input from everyone.

Comport Colin · Apr 27, 2022

Here is my article that shows how to use bitlocker on Win10/11 Home despite the lack of "modern standby" or whatever MS thinks is needed:

How to use Bitlocker on Windows 10 Home | Experts Exchange

Learn more about How to use Bitlocker on Windows 10 Home from the expert community at Experts Exchange

www.experts-exchange.com

jimbo45 · Apr 27, 2022

Hi there
for messing around with the TPM install the TPM diagnostics tool from the "Add optional features" and then some of the commands might help.

I haven't a clue about most of this (if any at all) but there are far better brains out there with knowlege of windows etc than mine.

If on a VM and using an emulated TPM this utility still recognizes it.

I'm still not convinced especially on a home laptop why I would even think about wanting to encrypt the OS -- the more complex you make things the more likely they are to go wrong and even more harder to fix - and coming from an experienced engineer (like me !!!!) who has worked on a whole range of different projects I've found that to be the case every time.

Any system whether mechanical (hardware) or software or a combination unfailingly will have those properties.

Cheers
jimbo

cereberus · Apr 27, 2022

Comport Colin said:
Here is my article that shows how to use bitlocker on Win10/11 Home despite the lack of "modern standby" or whatever MS thinks is needed:

How to use Bitlocker on Windows 10 Home | Experts Exchange

Learn more about How to use Bitlocker on Windows 10 Home from the expert community at Experts Exchange

www.experts-exchange.com

My laptop has modern standby and TPM 2.0.

Well, I tested this on W10 Home and the article must be out of date, or in error.

I started in modern standby and I tried device encryption, and it would not let me until I signed in with MS account (as I expected). I ran device encryption fine, then turned it off fine.

I turned off modern standby, rebooted, checked I was in S3 state, and no sign of device encryption in settings. I then ran "manage-bde -on c: -used", and it immediately replied I could not run device encryption on my device.

I then turned on modern standby, rebooted, checked I was in S0 state, and device encryption was now available. I then ran "manage-bde -on c: -used", and it started encrypyting.

I repeated whole exercise just to be sure.

So, my tests validate you need to be in modern standby mode to run device encryption.

I re-read article, and it claims it used Windows 10 Home in Hyper-V, and I tried it - no difference.

I note the article was for a much older version of Windows 10.

Comport Colin · Apr 27, 2022

The procedure in the article was not correctly used. The article tells you to boot to the recovery environment. Follow it, it works on all versions, builds and editions of windows 10 and 11.