Windows 10: Bitlocker hardware encryption cannot be activated on Win10 10586/1511

Hey,

I'm having an issue with enabling hardware encryption with Bitlocker using Windows 10 build 10586 on a clean install with a Samsung 850 SSD.

The encryption worked flawlessly before.

I've spent hours and attempted multiple solutions and made several tests.

On the same machine, if clean installing build 10240 (RTM, before November update) right now, the encryption works.

I have UEFI on with Legacy/CSM off, Fast Boot on, Secure Boot on, and a clean GPT installation after using the 'diskpart clean' command.

As always, it's required to change a group policy to allow additional authentication at startup. I did that as always.

On a clean installation of build 10586, the wizard will say 'parameter is incorrect' when you attempt to start encryption.

Microsoft did announce some Bitlocker-related changes for build 10586: https://technet.microsoft.com/en-us/library/mt403325

There are also new group policies added. I've tried all combinations. They now allow you to try and force a specific encryption cipher. Samsung uses XES-AES256. I tried forcing that (as well as all other combinations) but the same error returns.

Now, here's where it gets interesting, and possibly why no reports about this have surfaced yet:
If you enable the encryption on build 10240, and then upgrade to 10586, the encryption will remain and will work properly on build 10586.

If you then attempt to 'Reset this PC', and choose the 'keep nothing' option, it will warn you that bitlocker will be disabled. Once it's done cleaning, if you attempt to enable encryption, it will again show the error.

Even if you don't reset the PC, but simply disable Bitlocker on 10586 and then attempt to re-enable it, it will no longer work.

tl;dr: Hardware encryption via Bitlocker on build 10586 cannot be enabled on a clean install. Currently-known workaround is installing 10240, encrypting it, then upgrading to 10586.

Any solutions will be appreciated, thanks!

:)

 

Unable to enable BitLocker on Windows 10.

Original title: Win 10 Clean Install Cannot enable Bitlocker

Hi

Trying to do a clean install of Win10 Pro on a new Lenovo M700 Tiny machine. Win 10 OS Build 10586.218, version 1511

Cannot activate Bitlocker. Run thru turning on Bitlocker, saving key backup to USB, encrypt entire drive, using new encryption, select test Bitlocker encryption, reboot, bitlocker fails: "Bitlocker could not be enabled. The Bitlocker Encryption
key cannot be obtained from the Trusted Platform Module".

Have tried:

• 
  Checked TPM.msc. TPM is recognized, activated, owned etc
  
• 
  Deactivated TPM in BIOS, rebooted, logged in, verified off in TPM.msc, rebooted, reactivated in BIOS, TPM.msc sees functioning TPM, still fails same error
  
• 
  Cleared and reactivated TPM using TPM.msc. Same error
  
• 
  Formatted and reinstalled Win10 3 times. Recreated the Win10 USB install "disk" using the media creation tool for 1 attempt. Same issue each time.
  
• 
  All Lenovo driver & BIOS updates installed using Thinkvantage Tools. All MS Win 10 updates installed
  

Any help appreciated

 

Windows 10 Version 1511 (November Update - Build 10586/th2) breaks eDrive (hardware encryption) with BitLocker






1

Sign
in to vote

Hey,

Starting with Windows 10 build 10586, enabling hardware encryption with BitLocker following a clean install is no longer possible. It is possible with the RTM build 10240 prior to the November update. The error on the
newer build is 'Parameter is incorrect (code 0x80070057)'.

The only way to get it working on build 10586/Version 1511 is to enable encryption on build 10240 and then perform an upgrade. This isn't perfect because if you then disable encryption on the updated build, you can't re-enable it afterwards.

Hoping for a fix.

Thanks.

 

I am having this exact same issue on build 10586. Very frustrating. I have not tried the 10240 build however. Any suggestion on where I can get that build?

 

Glad to hear (but not glad that you're having the problem) that it isn't just me, even though I've encountered this on 2 different systems. I'm really surprised that Microsoft missed such a bug with the Insider program getting this build before it was out for the general public.

Unless there's a way to resolve it we don't know about, they'd have to patch it in an upcoming update I think.

Personally, the 10240 upgrade route thing is an annoying workaround and not a long-term solution. Upgrading still leaves traces and old folders from the previous version etc. Many enthusiasts prefer the clean install route. I really hope it's fixed soon.

 

I am also having this problem, on a Thinkpad T450s.

I tried replying to your thread on the MS forums, but couldn't do so, there seems to be some bug with the reply feature there.

Also hoping for a solution. Ran into this after spending about 10 hours figuring out all the steps to enable eDrive with my SED. X_X

 

Wow cool news... reformatted dozens of times. Also have the same "parameter is incorrect" issue with W10 and a Samsung Evo 850.

How do you download the specific build of Windows 10 in order to enable encryption?

Boosty

 

I will note that I am also using an Evo 850. Kyoung, would you happen to have this drive as well?

 

FYI
Tried enabling bitlocker and disabling XTS-AES since that is new in this build, without any change... forcing it to legacy AES256 or AES128 gave the same error.

manage-bde -on c: -recoverykey d: -em aes256 -s

Parameter is incorrect (code 0x80070057)

ARGH

 

Yes. Samsung Evo 850

 

which MS forum ?

Same problem here with a brand new SED Seagate ST3000DM002 as a data volume.

Is MS informed about this bug ?
Don't know how they work, will there be a bug number, any chance to track it ?

Damn, how long will this take, days, weeks, months, who knows.......

 

Bitlocker hardware encryption cannot be activated on Win10 10586/1511