System Does Not Meet BitLocker Automatic Device Encryption Requirements

BitLocker Automatic Device Encryption Requirements

OptiPlex 3060, 5060, 7060 and XE3 systems running Windows 10 64bit Professional and Enterprise editions do not automatically enable the BitLocker function.

You can use the following steps to verify the BitLocker function.

1. Press the Windows Key and type Settings.
2. Select Update & Security.
3. The following screen shows if the system meets the BitLocker automatic Encryption Requirement (Figure 1).
   
   Figure 1 - Windows 10 Settings for BitLocker (English Only)
    

Run System Information as an Administrator (Right Click) (Figure 2), and check the "Device Encryption Support" field. Check for "Reasons for failed automatic device encryption: Unallowed DMA capable bus/device(s) detected." (Figure 3)

Figure 2 - Windows 10 System Information (English Only)


Figure 3 - Windows 10 System Information (English Only)

You must manually set the BitLocker drive encryption with the following steps.

Warning: The following steps are for Advanced users. Users should manually back up their system Registry (How to back up and restore the registry in Windows or set a System Restore point.

Users should also back up data as a precaution.

You must add a bus or device to the allowed list. Go to the registry key:

1. Run "regedit" to open the Registry Editor (Figure 4).
   
   Figure 4 - Windows 10 Regedit (English Only)
    
2. Find the following registry key path: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DmaSecurity\AllowedBuses] (Figure 5)
   
   Figure 5 - Windows 10 Registry (English Only)
    
3. Right-click "AllowedBuses" and select "Permissions" (Figure 6).
   
   Figure 6 - Windows 10 Registry (English Only)
    
4. Select "Add…" to add your user names in the Permissions for AllowedBuses Window (Figure 7)
   
   Figure 7 - Windows 10 Registry Permissions (English Only)
   
   Enter your Windows User account name and click OK to finish (Figure 8).
   
   Figure 8 - Windows 10 Registry Permissions (English Only)
    
5. Check "Allow" on "Full Control" and "Read" Permissions for your user account and select "Apply" to save the settings (Figure 9).
   
   Figure 9 - Windows 10 Registry Permissions (English Only)
    
6. Right-click the Windows Desktop and select New -> Text Document.
7. Copy the following text and save as Add_AllowedBuses.reg
   
   Windows Registry Editor Version 5.00
   
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DmaSecurity\AllowedBuses]
"Intel 300 Series Chipset Family LPC Controller(Q370)"="PCI\\VEN_8086&DEV_A306"
"Intel 300 Series Chipset Family LPC Controller(H370)"="PCI\\VEN_8086&DEV_A304"
"PCI-to-PCI Bridge#1"="PCI\\VEN_8086&DEV_1901"
"PCI-to-PCI Bridge#2"="PCI\\VEN_104C&DEV_8240"
"PCI Express Root Port #1"="PCI\\VEN_8086&DEV_A338"
"PCI Express Root Port #2"="PCI\\VEN_8086&DEV_A339"
"PCI Express Root Port #3"="PCI\\VEN_8086&DEV_A33A"
"PCI Express Root Port #4"="PCI\\VEN_8086&DEV_A33B"
"PCI Express Root Port #5"="PCI\\VEN_8086&DEV_A33C"
"PCI Express Root Port #6"="PCI\\VEN_8086&DEV_A33D"
"PCI Express Root Port #7"="PCI\\VEN_8086&DEV_A33E"
"PCI Express Root Port #8"="PCI\\VEN_8086&DEV_A33F"
"PCI Express Root Port #9"="PCI\\VEN_8086&DEV_A330"
"PCI Express Root Port #10"="PCI\\VEN_8086&DEV_A331"
"PCI Express Root Port #11"="PCI\\VEN_8086&DEV_A332"
"PCI Express Root Port #12"="PCI\\VEN_8086&DEV_A333"
"PCI Express Root Port #13"="PCI\\VEN_8086&DEV_A334"
"PCI Express Root Port #14"="PCI\\VEN_8086&DEV_A335"
"PCI Express Root Port #15"="PCI\\VEN_8086&DEV_A336"
"PCI Express Root Port #16"="PCI\\VEN_8086&DEV_A337"
"PCI Express Root Port #17"="PCI\\VEN_8086&DEV_A340"
"PCI Express Root Port #18"="PCI\\VEN_8086&DEV_A341"
"PCI Express Root Port #19"="PCI\\VEN_8086&DEV_A342"
"PCI Express Root Port #20"="PCI\\VEN_8086&DEV_A343"
"PCI Express Root Port #21"="PCI\\VEN_8086&DEV_A32C"
"PCI Express Root Port #22"="PCI\\VEN_8086&DEV_A32D"
"PCI Express Root Port #23"="PCI\\VEN_8086&DEV_A32E"
"PCI Express Root Port #24"="PCI\\VEN_8086&DEV_A32F"
    
8. Double-Click the Add_AllowedBuses.reg file to add the registry keys.
9. Press "Yes" to continue to add the registry keys (Figure 10)
   
   Figure 10 - Windows 10 Registry Editor Confirmation (English Only)
    
10. All 8th Generation PCI Express Root Port device ids have been added into the system registry key successfully (Figure 11).
    
    Figure 11 - Windows 10 Registry Editor Confirmation (English Only)
     
11. Check the system registry key-in following path, all PCI Express Root Port device ids have been added successfully (Figure 12).
    
    Figure 12 - Windows 10 Registry (English Only)
     
12. Run System Information as an Administrator (Right Click) (Figure 13)
    [Device Encryption Support] -> [Meets perquisites]
    
    Figure 13 - Windows 10 System Information (English Only)
     
13. You can now Click the "Turn On" button to enable Device encryption from [Settings] -> [Device encryption] (Figure 14)
    
    Figure 14 - Windows 10 Settings for BitLocker (English Only)
     

If you have further questions about this solution, contact Dell Technical Support.