Windows 11 Home - TPM Encryption


cereberus

Well-known member
Pro User
VIP
Local time
5:29 AM
Posts
2,011
OS
Windows 10 Pro + others in VHDs
The procedure in the article was not correctly used. The article tells you to boot to the recovery environment. Follow it, it works on all versions, builds and editions of windows 10 and 11.

I followed it step by step. It failed.
 

My Computer

System One

  • OS
    Windows 10 Pro + others in VHDs
    Computer type
    Laptop
    Manufacturer/Model
    ASUS Vivobook 14
    CPU
    I7
    Motherboard
    Yep, Laptop has one.
    Memory
    16 GB
    Graphics Card(s)
    Integrated Intel Iris XE
    Sound Card
    Realtek built in
    Monitor(s) Displays
    N/A
    Screen Resolution
    1920x1080
    Hard Drives
    1 TB Optane NVME SSD, 1 TB NVME SSD
    PSU
    Yep, got one
    Case
    Yep, got one
    Cooling
    Stella Artois
    Keyboard
    Built in
    Mouse
    Bluetooth , wired
    Internet Speed
    72 Mb/s :-(
    Browser
    Edge mostly
    Antivirus
    Defender
    Other Info
    TPM 2.0

NavyLCDR

Well-known member
Power User
VIP
Local time
9:29 PM
Posts
911
OS
Windows 11
@Comport Colin,

I have a question. I followed your tutorial. Everything worked exactly as was stated in the tutorial except:
This is the result I got:
Capture1.jpg

Now, I thought it was odd that it says Protection Off. So, I created a second VM. I attached the same VHD to it. I left Secure Boot and TPM disabled. And.... guess what..... the "encrypted" drive booted in the new VM! It is my understanding that should not have happened if the drive was truly encrypted. By creating a new VM without secure boot and without TPM, did I not, in effect, move the VHD to a new computer and drive encryption should have prevented booting it in the new computer, especially with Secure Boot and TPM disabled? I believe your method only gives a false indication of encryption and the drive is not actually encrypted.

capture3.jpg
 

My Computers

System One System Two

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Homebuilt
    CPU
    AMD Ryzen 7 3800XT
    Motherboard
    ASUS ROG Crosshair VII Hero (WiFi)
    Memory
    32GB
    Graphics Card(s)
    EVGA GeForce GTX 1080 Ti
  • Operating System
    Windows 11 Education
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 7773
    CPU
    Intel i7-8550U
    Memory
    32GB
    Graphics card(s)
    Nvidia Geforce MX150
    Sound Card
    Realtek
    Monitor(s) Displays
    17"
    Screen Resolution
    1920 x 1080
    Hard Drives
    Toshiba 512GB NVMe SSD
    SK Hynix 512GB SATA SSD
    Internet Speed
    Fast!

NavyLCDR

Well-known member
Power User
VIP
Local time
9:29 PM
Posts
911
OS
Windows 11
Also, I just mounted the VHDX file on a totally different physical computer, and I can still access the contents of the drive. All that your method appears to do is provide a false indication that the drive in encrypted, without actually encrypting anything.
 

My Computers

System One System Two

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Homebuilt
    CPU
    AMD Ryzen 7 3800XT
    Motherboard
    ASUS ROG Crosshair VII Hero (WiFi)
    Memory
    32GB
    Graphics Card(s)
    EVGA GeForce GTX 1080 Ti
  • Operating System
    Windows 11 Education
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 7773
    CPU
    Intel i7-8550U
    Memory
    32GB
    Graphics card(s)
    Nvidia Geforce MX150
    Sound Card
    Realtek
    Monitor(s) Displays
    17"
    Screen Resolution
    1920 x 1080
    Hard Drives
    Toshiba 512GB NVMe SSD
    SK Hynix 512GB SATA SSD
    Internet Speed
    Fast!

jimbo45

Well-known member
Power User
VIP
Local time
4:29 AM
Posts
1,631
Location
Hafnarfjörður IS
OS
Windows XP,7,10,11 Linux Arch Linux
Also, I just mounted the VHDX file on a totally different physical computer, and I can still access the contents of the drive. All that your method appears to do is provide a false indication that the drive in encrypted, without actually encrypting anything.
The trouble is so many people don't do exhaustive testing -- just because a job runs and completes without reporting any errors doesn't mean that the app has actually worked. !! I'll bet there are loads here who probably DO take backups but have they tested then on "bare metal recovery" - and then found to their horror that the restore fails for some unfathonable reason.

I know people like @cereberus and @NavyLCDR always do fairly rigourous testing so I'd go by what they report rather than rely on a "1-Off" simple test by loads of others..

Cheers
jimbo
 

My Computer

System One

  • OS
    Windows XP,7,10,11 Linux Arch Linux
    Computer type
    PC/Desktop
    CPU
    2 X Intel i7

NavyLCDR

Well-known member
Power User
VIP
Local time
9:29 PM
Posts
911
OS
Windows 11
The trouble is so many people don't do exhaustive testing -- just because a job runs and completes without reporting any errors doesn't mean that the app has actually worked. !! I'll bet there are loads here who probably DO take backups but have they tested then on "bare metal recovery" - and then found to their horror that the restore fails for some unfathonable reason.

I know people like @cereberus and @NavyLCDR always do fairly rigourous testing so I'd go by what they report rather than rely on a "1-Off" simple test by loads of others..

Cheers
jimbo
I don't now if my almost brand-new MSI gaming laptop has Modern Standby or not. I would assume that it does. I'm going to have to do some testing with real device encryption if it does. I don't use encryption in real life.
 

My Computers

System One System Two

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Homebuilt
    CPU
    AMD Ryzen 7 3800XT
    Motherboard
    ASUS ROG Crosshair VII Hero (WiFi)
    Memory
    32GB
    Graphics Card(s)
    EVGA GeForce GTX 1080 Ti
  • Operating System
    Windows 11 Education
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 7773
    CPU
    Intel i7-8550U
    Memory
    32GB
    Graphics card(s)
    Nvidia Geforce MX150
    Sound Card
    Realtek
    Monitor(s) Displays
    17"
    Screen Resolution
    1920 x 1080
    Hard Drives
    Toshiba 512GB NVMe SSD
    SK Hynix 512GB SATA SSD
    Internet Speed
    Fast!

Comport Colin

Member
Local time
6:29 AM
Posts
36
OS
Win11
@NavyLCDR
Protection was left off by you. You missed the last command to turn it on. And when it's off, that drive can be moved around freely - expected behavior.
 

My Computer

System One

  • OS
    Win11

Comport Colin

Member
Local time
6:29 AM
Posts
36
OS
Win11
Also your command shows "nor protectors"... you missed more than one part. Sorry, what is so hard about that tutorial :) Seriously asked. I would like to improve it.
 

My Computer

System One

  • OS
    Win11

NavyLCDR

Well-known member
Power User
VIP
Local time
9:29 PM
Posts
911
OS
Windows 11
So, I just copied the "encrypted" vhdx file to a completely different physical computer. Attached it to a VM on the completely different physical computer and it booted right up. It is not encrypted even though manage-bde -status shows 100% encrypted.
 

My Computers

System One System Two

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Homebuilt
    CPU
    AMD Ryzen 7 3800XT
    Motherboard
    ASUS ROG Crosshair VII Hero (WiFi)
    Memory
    32GB
    Graphics Card(s)
    EVGA GeForce GTX 1080 Ti
  • Operating System
    Windows 11 Education
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 7773
    CPU
    Intel i7-8550U
    Memory
    32GB
    Graphics card(s)
    Nvidia Geforce MX150
    Sound Card
    Realtek
    Monitor(s) Displays
    17"
    Screen Resolution
    1920 x 1080
    Hard Drives
    Toshiba 512GB NVMe SSD
    SK Hynix 512GB SATA SSD
    Internet Speed
    Fast!

NavyLCDR

Well-known member
Power User
VIP
Local time
9:29 PM
Posts
911
OS
Windows 11
Also your command shows "nor protectors"... you missed more than one part. Sorry, what is so hard about that tutorial :) Seriously asked. I would like to improve it.
I followed your tutorial EXACTLY step by step. I did not miss any steps. YOU need to do more testing. Good day to you, sir.
 

My Computers

System One System Two

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Homebuilt
    CPU
    AMD Ryzen 7 3800XT
    Motherboard
    ASUS ROG Crosshair VII Hero (WiFi)
    Memory
    32GB
    Graphics Card(s)
    EVGA GeForce GTX 1080 Ti
  • Operating System
    Windows 11 Education
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 7773
    CPU
    Intel i7-8550U
    Memory
    32GB
    Graphics card(s)
    Nvidia Geforce MX150
    Sound Card
    Realtek
    Monitor(s) Displays
    17"
    Screen Resolution
    1920 x 1080
    Hard Drives
    Toshiba 512GB NVMe SSD
    SK Hynix 512GB SATA SSD
    Internet Speed
    Fast!

Comport Colin

Member
Local time
6:29 AM
Posts
36
OS
Win11
LOL. That's good, will do. No, sorry, I am the author of that article. You see it has been around for a while with 16,200 views and has been upvoted and has been used in solutions on experts-exchange - never before someone told me that it does not work. And I have just today done it in a VM, there's no room for failure in doing so. Please be so kind to share screenshots of the results of every single step.
 

My Computer

System One

  • OS
    Win11

cereberus

Well-known member
Pro User
VIP
Local time
5:29 AM
Posts
2,011
OS
Windows 10 Pro + others in VHDs
LOL. That's good, will do. No, sorry, I am the author of that article. You see it has been around for a while with 16,200 views and has been upvoted and has been used in solutions on experts-exchange - never before someone told me that it does not work. And I have just today done it in a VM, there's no room for failure in doing so. Please be so kind to share screenshots of the results of every single step.
Your guide does not show the power states at each step.

You do not say if your device does not support modern standby at all, or if you are switching to it.
You do not show initial encryption status e.g. if you clean install W10 Home with 22000 build, and device encryption is available, it automatically encrypts drive.

I just did a test - I put Windows 10 Home into S3 mode, then booted into command prompt which boots in winpe mode (mini OS in effect), and then checked powerstate , and it shows as S0 state.

I run the manage-bde and it bombs out with an error.

The issue may be because my host Windows 10 Home is on drive 1, but the boot files are on drive 0 which has Pro as main OS.

In any case, I tried to set the powerstate to S3 in command file, but because that boots in RAM, it is not persistent, so even I boot from W10H as dual boot on Drive 0, it will always appear to run encryption command as the command prompt is always in S0 state.

You have not shown evidence of powerstates at each step, or indeed evidence the host C drive is actually encrypted.

Please be so kind to share screenshots of the results of every single step, including powerstates at each step.

I do not think your example is a universal solution - it certainly does not work in my case.


I will try moving W10 Home to disk 0, and remove all boot entries except W10 Home, to see if that make any difference, but I am sceptical.
 

My Computer

System One

  • OS
    Windows 10 Pro + others in VHDs
    Computer type
    Laptop
    Manufacturer/Model
    ASUS Vivobook 14
    CPU
    I7
    Motherboard
    Yep, Laptop has one.
    Memory
    16 GB
    Graphics Card(s)
    Integrated Intel Iris XE
    Sound Card
    Realtek built in
    Monitor(s) Displays
    N/A
    Screen Resolution
    1920x1080
    Hard Drives
    1 TB Optane NVME SSD, 1 TB NVME SSD
    PSU
    Yep, got one
    Case
    Yep, got one
    Cooling
    Stella Artois
    Keyboard
    Built in
    Mouse
    Bluetooth , wired
    Internet Speed
    72 Mb/s :-(
    Browser
    Edge mostly
    Antivirus
    Defender
    Other Info
    TPM 2.0

Comport Colin

Member
Local time
6:29 AM
Posts
36
OS
Win11
"You do not say if your device does not support modern standby at all, or if you are switching to it." - oh yes, look at my screenshots, that I provided earlier today. Modern standby is not supported but bitlocking still works in the VM.
1651151023578.png
 

My Computer

System One

  • OS
    Win11

jimbo45

Well-known member
Power User
VIP
Local time
4:29 AM
Posts
1,631
Location
Hafnarfjörður IS
OS
Windows XP,7,10,11 Linux Arch Linux
LOL. That's good, will do. No, sorry, I am the author of that article. You see it has been around for a while with 16,200 views and has been upvoted and has been used in solutions on experts-exchange - never before someone told me that it does not work. And I have just today done it in a VM, there's no room for failure in doing so. Please be so kind to share screenshots of the results of every single step.
The number of views on some of those things are 100% irrelevant and don't at all co-relate to the number of people actually qualified to remark on such things. I'd rather have 3 genuine experts than 65,000 with "unknown provenance" on some bonkers web site flogging adverts or hardware.

In any case I've never really found anything of use on experts-exchange and it's a site best avoided IMO.

Tom's hardware IMO is far better and although this one is non Windows it's almost "The classic" standard for a good informative wiki so just take a peep at the arch wiki.


Cheers
jimbo
 

My Computer

System One

  • OS
    Windows XP,7,10,11 Linux Arch Linux
    Computer type
    PC/Desktop
    CPU
    2 X Intel i7

Comport Colin

Member
Local time
6:29 AM
Posts
36
OS
Win11
Well, this is going sideways.
If I can assist with the tutorial, tell me where your problem is - again: if I can do it in a VM, so can you.
If you fail, let me know where and add screenshots.
 

My Computer

System One

  • OS
    Win11

NavyLCDR

Well-known member
Power User
VIP
Local time
9:29 PM
Posts
911
OS
Windows 11
LOL. That's good, will do. No, sorry, I am the author of that article. You see it has been around for a while with 16,200 views and has been upvoted and has been used in solutions on experts-exchange - never before someone told me that it does not work. And I have just today done it in a VM, there's no room for failure in doing so. Please be so kind to share screenshots of the results of every single step.
Am I supposed to be impressed? Fail.

Capture1.jpg
 

My Computers

System One System Two

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Homebuilt
    CPU
    AMD Ryzen 7 3800XT
    Motherboard
    ASUS ROG Crosshair VII Hero (WiFi)
    Memory
    32GB
    Graphics Card(s)
    EVGA GeForce GTX 1080 Ti
  • Operating System
    Windows 11 Education
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 7773
    CPU
    Intel i7-8550U
    Memory
    32GB
    Graphics card(s)
    Nvidia Geforce MX150
    Sound Card
    Realtek
    Monitor(s) Displays
    17"
    Screen Resolution
    1920 x 1080
    Hard Drives
    Toshiba 512GB NVMe SSD
    SK Hynix 512GB SATA SSD
    Internet Speed
    Fast!

NavyLCDR

Well-known member
Power User
VIP
Local time
9:29 PM
Posts
911
OS
Windows 11
Just for grins I tried it again. And this time, I have to admit....

Nope, still not impressed.

Capture1.jpgcapture3.jpgcapture4.jpg
 

My Computers

System One System Two

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Homebuilt
    CPU
    AMD Ryzen 7 3800XT
    Motherboard
    ASUS ROG Crosshair VII Hero (WiFi)
    Memory
    32GB
    Graphics Card(s)
    EVGA GeForce GTX 1080 Ti
  • Operating System
    Windows 11 Education
    Computer type
    Laptop
    Manufacturer/Model
    Dell Inspiron 7773
    CPU
    Intel i7-8550U
    Memory
    32GB
    Graphics card(s)
    Nvidia Geforce MX150
    Sound Card
    Realtek
    Monitor(s) Displays
    17"
    Screen Resolution
    1920 x 1080
    Hard Drives
    Toshiba 512GB NVMe SSD
    SK Hynix 512GB SATA SSD
    Internet Speed
    Fast!

cereberus

Well-known member
Pro User
VIP
Local time
5:29 AM
Posts
2,011
OS
Windows 10 Pro + others in VHDs
Something tells me you missed the final step again:
manage-bde -protectors -enable c:

Ok, now I have managed to get it to work. This is bitlocking the c drive from the winpe mode as a data partition.

As I was dual booting, I forgot that in winpe mode, the drive letter of C drive was not necessarily C , but on checking it was drive E in winpe mode, - so I had to change first command to "manage-bde -on e: -used". Then when I booted into Windows, I used C again.

I checked the powerstate in winpe, and that was S0 even though in Windows it was S3.

You do not say if your tests were done on a device without S0 mode (desktops often have tpm but no S0 mode).

That would be the acid test, as it may be because winpe sees it as S0, it works.

I also found you had to turn it off in winpe.

Whilst I concede that it seems to work, I cannot test on a pc with tpm but no modern standby.

In the end, although this seems to work, it is not that intuitive and requires a fair bit of skill.
 

My Computer

System One

  • OS
    Windows 10 Pro + others in VHDs
    Computer type
    Laptop
    Manufacturer/Model
    ASUS Vivobook 14
    CPU
    I7
    Motherboard
    Yep, Laptop has one.
    Memory
    16 GB
    Graphics Card(s)
    Integrated Intel Iris XE
    Sound Card
    Realtek built in
    Monitor(s) Displays
    N/A
    Screen Resolution
    1920x1080
    Hard Drives
    1 TB Optane NVME SSD, 1 TB NVME SSD
    PSU
    Yep, got one
    Case
    Yep, got one
    Cooling
    Stella Artois
    Keyboard
    Built in
    Mouse
    Bluetooth , wired
    Internet Speed
    72 Mb/s :-(
    Browser
    Edge mostly
    Antivirus
    Defender
    Other Info
    TPM 2.0
Top Bottom