Windows 10: Cannot get Hardware Encryption with BitLocker eDrive working Samsung 980 Pro 1TB

Issue

I am failing to hardware encrypt my Samsung SSDs with BitLocker eDrive. I tried this with a 980 Pro 1TB and a 970 Evo 1TB neither of those worked.


Hardware used

Motherboard ASUS TUF GAMING X570-PLUS Bios Version 3001

CPU Ryzen 9 3900X

RAM 2x CMW32GX4M2C3200C16 4*16 = 64GB Corsair Vengeance RGB Pro - 3200MHz in total

GPU Radeon RX 5700 XT GAMING X

SSDs Samsung 970 Evo 1TB; Samsung 980 Pro 1TB


Things I have tried - with 970 Evo and 980 Pro

• From a SATA Windows Boot drive:
  • Enabled Drive encryption with Samsung Magician state is Ready To Enable
  • The Firmware is up-to-date according to Magician
  • Created a Secure Erase Stick with Magician
  • Created a 64-bit Windows Installer USB should be 20H2
• Booted into the Secure Erase environment and secure erased SSD
• In the BIOS
  • Enabled Secure Boot
  • Disabled CSM Support
  • Set Windows Installer UEFI USB as only boot source
  • Enabled Disable SID Blocking Also enabled the disable on every following boot
• Rebooted to the Windows Installer
  • Installed Windows Education
  • only selected the drive, no manual partitioning at all
  • rebooted the system
• Let Windows reboot Setup - Enabled Disable SID Blocking as mentioned earlier
• Let Windows reboot again Setup - Enabled Disable SID Blocking as mentioned earlier
• Used Domain User
• In freshly installed Windows
  • Installed Magician checked state Encrypt Device: Enabled
  • Set BitLocker through policies to force HW encryption
  • Tried to enable BitLocker on C: Drive - failed
  • Installed AMD Drivers Chipset, GPIO,... with autodetect setup
  • Installed Samsung NVME drivers only on the run with 970 Evo, because 980 Pro isn't supported
  • Installed all Windows updates
  • rebooted
• Booted into Windows - Enabled Disable SID Blocking as mentioned earlier
  • retried enabling BitLocker - still fails with the same Error with both the 970 Evo and the 980 Pro

Conclusion

I am doing something wrong... Or maybe something is broken with BitLocker, Windows or my motherboard.


Questions

Has anyone same problems? Or even has fixed this in the past?


I appreciate any help :-

:)

 

(BUG) BitLocker eDrive hardware encryption

Hi,

I did a clean install of Windows 10, and tried to use hardware encryption via BitLocker on my eDrive compliant 850 EVO ssd.

First it just would not use the hardware encryption (asks if I want to encrypt whole drive or only used portion) but I found that Intel rapid storage was conflicting with the process (version V14501081)

When I uninstalled IRST, the setup went right, but after the first reboot/system check, BitLocker has just dissapeared. It can't be found in the Control Panel (see screenshot), trying to open it via search doesn't work and it's not listed when right clicking
the system drive, but when right clicking my second HDD there is an option to enable it, this brings me to the initialization screen, the BitLocker settings still can't be accessed. There's also no lock icon on the system drive, but BitLocker does ask for
a password on bootup (don't have TPM).

When typing manage-bde -status C: in the command prompt, I get an error (see screenshot)

screenshot:

https://i.imgur.com/JiHCu3K.png

This worked perfectly on Windows 8.1 for me.

Edit: Now BitLocker suddenly started working properly. The lock sign is there and the settings are back, still this is strange behaviour.

 

Bitlocker eDrive Setup with 2nd Partition

Hello,

I have successfully encrypted my C: drive with Bitlocker. I used the new Hardware Encryption (eDrive) method and it works without a problem.

But I still think that I've encountered a "bug" in this setup. My SSD (Samsung 850 Pro) is split into two partitions. While Windows 10 says that my primary partition is successfully encrypted, it shows my second Partition (D as unencrypted.

I personally think that this is wrong or misleading. As far as I understand the eDrive functionality, it doesn't directly encrypt the partition. It only manage the encryption keys of the harddrive itself.

But the harddrive itself can't differentiate between the partitions or data (Or am I wrong here?). So shouldn't partition D: be also shown as encrypted as partition C:, as the whole harddrive has been encrypted?

 

Windows 10 Pro deployment using WDS and eDrive

I'm deploying Windows 10 PC's using WDS and want to make use of eDrive. The SSD installed in the PC supports hardware encryption. When I deploy a Windows 10 Pro image to a system and then turn on BitLocker it uses software encryption.

If I take that same system install Windows 10 Pro using a CD turn on BitLocker it uses Hardware encryption. Again on the same PC I deploy Windows 10 Pro using WDS enable BitLocker it uses hardware encryption.

To do this across a number of devices is time consuming and defeats the point of WDS.

Any suggestions?