Skip to main content

Bitlocker

Thread solved
Regular Poster
Posts: 10
Comments: 121

Hello Paul,
hello Steve,

I have been using the beta version
Windows 10.0 KB4586853 x64_330daa4ac35808160113ccb6b5a6a0fd54b414cd.cab
fixed the error in feature update 20H2.

And now Winver shows the version 19042.661 (see photo).

But when I create a new stick with the MVP_ATIPEBuilder_v190, I see the Windows version 19041.1.
And the hard drives are still not recognized (see photo).

I also attach the logfile to you.

Best regards,
Willy

Attachment Size
IMG_3819.jpg 1.35 MB
IMG_3817.jpg 1.95 MB
MVP_ATIPEBuilder_18-11-2020_15.15.51.txt 14.68 KB
0 Users found this helpful
Forum Star
Posts: 53
Comments: 1835

#1

Thanks for the MVP Tool log. It is helpful. I see there is a problem with the Intel IRST driver from your system. It isn't being installed when you select install drivers from the system. Then the IRST custom driver supplied with the MVP Tool is being installed when add custom drivers is selected.

The mismatch of the system being 19042 and the WinPE being 19041 is to be expected. This is because there is no new ADK available for Windows 20H2.

There is a very important question! Is the SATA mode in your BIOS set to RAID. I think it is. The problem may be that the IRST driver being installed doesn't support the RAID controller on the motherboard. Here are my recommendations:

1. Do NOT select to add system drivers during the build. Select option 2 to skip adding them.

2. The goal would be to replace the supplied IRST driver in the Custom folder with the proper IRST driver from your system.

3. Show me the contents of C:\Windows\inf\oem65.inf. Then I will give you instructions to supply the necessary files to make the driver install successfully.

When the proper IRST driver is working, the BitLocker problem may be solved.

Regular Poster
Posts: 10
Comments: 121

#2

Hello Paul,

here the file oem65.inf (as attachment)

Attachment Size
559855-207199.txt 26.43 KB
Forum Star
Posts: 53
Comments: 1835

#3

1. Delete all the files from the \Drivers_Custom\x64\IRST folder.

2. Copy C:\Windows\inf\oem65.inf to the \Drivers_Custom\x64\IRST folder.

3. Look in C:\Windows\System32 and C:\Windows\System32\drivers and copy all these files to the \Drivers_Custom\x64\IRST folder:

iaStorAC.sys
iaStorAfs.sys
iaStorAfsService.exe
iaStorAfsNative.exe
Optane.dll
HfcDisableService.exe
OptaneEventLogMsg.dll

RstMwService.exe
RstMwEventLogMsg.dll

4. Build again.

5. Check the log to be sure the IRST driver was successfully installed.

Now let's see what the manage-bde -status command shows.

Regular Poster
Posts: 10
Comments: 121

#4

Can you please give me the complete path for Drivers_Custom x64\IRST?

 

Forum Star
Posts: 53
Comments: 1835

#5

D:\OneDrive - G.P.V. mbH\INSTALL\5_Tools\Acronis\MVP_ATIPEBuilder_v190\Drivers_Custom\x64\IRST

Regular Poster
Posts: 10
Comments: 121

#6

1. ok

2. ok

3. I couldn't find these drivers in this folder:

aStorAfsService.exe
iaStorAfsNative.exe
Optane.dll
HfcDisableService.exe
OptaneEventLogMsg.dll

RstMwService.exe
RstMwEventLogMsg.dll

4. ok

5. The same error as before.

 

Regular Poster
Posts: 10
Comments: 121

#7

One more moment, I was wrong

Regular Poster
Posts: 10
Comments: 121

#8

So, I copied all the drivers. Still, the same mistake.

By the way, if that's not yet clear: BIOS raid on.

Forum Star
Posts: 53
Comments: 1835

#9

Same error. Maybe it's time to stop using BitLocker! I don't know what else to tell you to try. It doesn't look like you're going to win the BitLocker battle.

Regular Poster
Posts: 10
Comments: 121

#10

Uff :-(

Hello, dear Paul,

I think we gave everything.

Ok, then I'll do it the way I did a few days ago.
1. I back up to an external, unencrypted hard drive using the Windows tool.
2. The same with TI.
3. And if I have the emergency, I reinstall Windows with TI, validate the last backup and securely back (that's how it worked a few days ago). Such a worst case is rare. But then I know the way to help myself.

Thank you again for your commitment.

Best regards,
Willy

Forum Star
Posts: 53
Comments: 1835

#11

We may have overlooked something basic here. Does your TPM require a driver? Does the TPM show up in Device Manager? If so, you need to add the driver to the WinPE.

Regular Poster
Posts: 10
Comments: 121

#12

Paul, I copied the TPM driver to MVP_ATIPEBuilder_v186-Drivers_Custom-x64-IRST, but unfortunately it didn't help either. Is this possible for you without any problems?

Maybe it's because of Windows 10 pro for workstations?

Forum Star
Posts: 53
Comments: 1835

#13

What exactly did you put there for the TPM driver. Please show me the inf file for the TPM. You can identify the inf file by looking at Properties of the TPM in Device Manager. Click on the Details tab and click on the drop down arrow next to Properties. Scroll down the list and find the "inf name". Then get the inf file from C:\Windows\inf. Open the inf file with notepad and find the [SourceDisksFiles] section. That will show you a list of all the files needed.

Regular Poster
Posts: 10
Comments: 121

#14

Do you mean this here:

[SourceDisksFiles]
tpm.sys = 3426

Forum Star
Posts: 53
Comments: 1835

#15

Yes that's it. You can see if the TPM driver is working in WinPE by entering the following line in a command window in WinPE:

net start tpm

If the tpm driver is working, you should see a message that the tpm service has been successfully started. Or a message that the tpm service has already been started.

Regular Poster
Posts: 10
Comments: 121

#16

The "net start tpm" command showed that the service has already started.

The command "manage-bde -status" shows an external hard drive that I am currently decrypting, see photo.

Attachment Size
560105-207333.jpg 2.28 MB
Regular Poster
Posts: 10
Comments: 121

#17

Do you mean it makes sense C: and D: to decipher again and then check what can be seen in "manage-bde -status"?

Forum Star
Posts: 53
Comments: 1835

#18

I would say that adding the tpm driver to WinPE didn't make any difference because the standard tpm driver already included in WinPE was working.

Yes, it would make sense to try manage-bde -status without any encryption.

It's a total guessing game at this point. I would try to eliminate any possibility the problem is being caused by the TPM. I would decrypt all volumes first. Then I would go into the BIOS and disable the TPM. Then I would set the group policies in Windows to allow BitLocker without a TPM. Here is a link to a guide for setting up BitLocker without a TPM https://www.windowscentral.com/how-use-bitlocker-encryption-windows-10 Then I would re-encrypt the volumes and try WinPE again.

 

Regular Poster
Posts: 10
Comments: 121

#19

Uiuiui, that's a lot of work!
Wouldn't it be better to install Windows with TI in an emergency and then restore the system?

Forum Star
Posts: 53
Comments: 1835

#20

Well, that's up to you. I just wonder why it's only your computer that has the problem. The only thing I can think of that would be unique to your computer is the TPM.

Your other option would be to just stop using BitLocker on that computer.

Regular Poster
Posts: 10
Comments: 121

#21

I have a more up-to-date firmware for TPM.
After the installation I try again with the USB stick.

Regular Poster
Posts: 10
Comments: 121

#22

Paul, if I have the right time window, then I reinstall Windows with TI and then I test your tool (I missed that last time unfortunately).
Just before, I deactivated the TPM in the BIOS, but unfortunately it didn't help either. Also not the updated firmware.

And now I have to take care of my family, otherwise there will be trouble!

You will hear from me again.

Best regards,
Willy

 

Regular Poster
Posts: 10
Comments: 121

#23

Paul, it was itching in my fingers :-)

I created a Rescue Media and i did

WinPE for my computer.

And with that, the "manage-bde-status" command works without an error message. But not completely, because the encrypted drives do not display the size (see photo)

Attachment Size
560184-207376.jpg 2.29 MB
Forum Star
Posts: 53
Comments: 1835

#24

What happens when you run the unlock script?

Regular Poster
Posts: 10
Comments: 121

#25

I still have to try, but now I have to go away to an appointment.

Regular Poster
Posts: 10
Comments: 121

#26

This is what it looks like with the "manage-bde -status" command. So not the complete information (see photo)

I then connected an external, encrypted drive.
I was able to decrypt it as it appears (see photo).
I struggle with my complicated password because the key assignment is very different.

At C: I didn't dare!

Good night and sleep well.

Attachment Size
560223-207413.jpg 1.44 MB
560223-207416.jpg 1.38 MB
Forum Star
Posts: 53
Comments: 1835

#27

That's great. Looks like the long battle is finally over. Thanks for sharing the good news.

Regular Poster
Posts: 10
Comments: 121

#28

However, this path is very complicated.

It's a pity that this doesn't work with your ingenious and comfortable script :-(
Don't see any possibility anymore?

Regular Poster
Posts: 10
Comments: 121

#29

Hello Paul,
hello Steve,

I went on a long hike today and thought about it and I think I came up with a solution. I recorded them in a Word document.

I put the document in the shared folder for Steve.
The document is in German and needs to be improved a little.
Look at it and let you hear what you think about it.

Tomorrow I have a lot of appointments.

Regular Poster
Posts: 10
Comments: 121

#30

As an attachment here my documentation as PDF. I refined it a little bit.

Attachment Size
560284-207562.pdf 974.41 KB