Windows 10 - Boot Volume Not Encrypting

Hello Ricko,

Looks like you're almost there, I suspect you're right in saying it's probably just something simple.

As it's just the boot volume that's not encrypting (and that has the same policy settings as your secondary drive), I would look at the following first:

Is BitLocker enabled for the Boot Volume?

Right click Start > Control Panel > System and Security > BitLocker Drive Encryption > Make sure BitLocker is enabled for the C:\ drive too.

Is the Boot Volume ready to be encrypted?

The drive must have atleast two partitions - one partition must include the drive Windows is installed on. This is the drive that BitLocker will encrypt, the other partition is the active partition, which must remain unencrypted so that the computer can be started.

Microsoft states that "once you've encrypted the drive Windows is installed on, you can also encrypt additional data drives on the same computer" - I'm not aware of any issues encrypting the secondary volume first but it's worth mentioning this.

The boot volume must also be formatted with the NTFS file system and have a BIOS that is compatible with TPM and supports USB devices during computer startup. If this is not the case, you will need to update the BIOS before using BitLocker.

Let me know how you get on with those Ricko and we'll go from there.

Hello Ricko,

Looks like you're almost there, I suspect you're right in saying it's probably just something simple.

As it's just the boot volume that's not encrypting (and that has the same policy settings as your secondary drive), I would look at the following first:

Is BitLocker enabled for the Boot Volume?

Right click Start > Control Panel > System and Security > BitLocker Drive Encryption > Make sure BitLocker is enabled for the C:\ drive too.

Is the Boot Volume ready to be encrypted?

The drive must have atleast two partitions - one partition must include the drive Windows is installed on. This is the drive that BitLocker will encrypt, the other partition is the active partition, which must remain unencrypted so that the computer can be started.

Microsoft states that "once you've encrypted the drive Windows is installed on, you can also encrypt additional data drives on the same computer" - I'm not aware of any issues encrypting the secondary volume first but it's worth mentioning this.

The boot volume must also be formatted with the NTFS file system and have a BIOS that is compatible with TPM and supports USB devices during computer startup. If this is not the case, you will need to update the BIOS before using BitLocker.

Let me know how you get on with those Ricko and we'll go from there.

Hi Toby,

Thanks for your suggestions.

Bitlocker is enabled, just not turned on (i.e. encryption not complete) When I run the bitlocker drive prep tool it says the drive is properly configured. I set up a second test target to verify (different model dell) and I am having the same issue on both machines.

Both machines are NTFS formatted and support bitlocker (I had them encrypted manually previously but decrypted them so I could test this), so I know they are capable

Any other suggestions would be appreciated!

Thanks!
~Rick

Hello Ricko,

No worries, let's go through the checklist and see if we can see what could be holding this up.
Typical reasons for this kind of delay are as follows:

- A bootable CD is in the drive (must be ejected to start the encryption process)
- A bootable USB stick attached (must be ejected to start the encryption)
- A GPO is defined which is not supported in combination with BitLocker Management by SGN
- The drive is not properly prepared for Bitlocker encryption (can be done using the Bitlocker Drive Preparation tool BdeHdCfg.exe but it looks like you've done this already)
- TPM is not activated (but defined as protector)

It's important that only the following BitLocker group policies (GPOs) are configured:

- Require additional authentication at startup
- Allow BitLocker without a compatible TPM
- Enable use of BitLocker authentication requiring preboot keyboard input on slates
- Configure minimum PIN length for startup
- Turn on TPM backup to Active Directory Domain Services

Ensure that all other BitLocker group policies are left as default. Otherwise they might be overruled by SafeGuard policies or even lead to conflicts with the SafeGuard BitLocker management.

For Example: Activating the group policy setting "Do not enable Bitlocker until recovery information is stored to AD for operating system drives" leads to encryption failing to start if you are using SafeGuard Bitlocker Challenge/Reponse.

Hope that helps Ricko, please let us know how you get on.

Hi Toby,

 

Sorry for reviving such an old post, but I'm also currently running into this scenario. I was able to encrypt the non-boot volume but not the OS partition where Windows 7 resides.

While reading this post I kept reading about Bitlocker and I was wondering if this would be a pre-requisite in order to for the SGN 8 to encrypt the boot volume?

 

Your response is highly appreciated.

 

Thanks