Bitlocker

Thanks for the MVP Tool log. It is helpful. I see there is a problem with the Intel IRST driver from your system. It isn't being installed when you select install drivers from the system. Then the IRST custom driver supplied with the MVP Tool is being installed when add custom drivers is selected.

The mismatch of the system being 19042 and the WinPE being 19041 is to be expected. This is because there is no new ADK available for Windows 20H2.

There is a very important question! Is the SATA mode in your BIOS set to RAID. I think it is. The problem may be that the IRST driver being installed doesn't support the RAID controller on the motherboard. Here are my recommendations:

1. Do NOT select to add system drivers during the build. Select option 2 to skip adding them.

2. The goal would be to replace the supplied IRST driver in the Custom folder with the proper IRST driver from your system.

3. Show me the contents of C:\Windows\inf\oem65.inf. Then I will give you instructions to supply the necessary files to make the driver install successfully.

When the proper IRST driver is working, the BitLocker problem may be solved.

Hello Paul,

here the file oem65.inf (as attachment)

1. Delete all the files from the \Drivers_Custom\x64\IRST folder.

2. Copy C:\Windows\inf\oem65.inf to the \Drivers_Custom\x64\IRST folder.

3. Look in C:\Windows\System32 and C:\Windows\System32\drivers and copy all these files to the \Drivers_Custom\x64\IRST folder:

iaStorAC.sys
iaStorAfs.sys
iaStorAfsService.exe
iaStorAfsNative.exe
Optane.dll
HfcDisableService.exe
OptaneEventLogMsg.dll

RstMwService.exe
RstMwEventLogMsg.dll

4. Build again.

5. Check the log to be sure the IRST driver was successfully installed.

Now let's see what the manage-bde -status command shows.

Can you please give me the complete path for Drivers_Custom x64\IRST?

D:\OneDrive - G.P.V. mbH\INSTALL\5_Tools\Acronis\MVP_ATIPEBuilder_v190\Drivers_Custom\x64\IRST

1. ok

2. ok

3. I couldn't find these drivers in this folder:

aStorAfsService.exe
iaStorAfsNative.exe
Optane.dll
HfcDisableService.exe
OptaneEventLogMsg.dll

RstMwService.exe
RstMwEventLogMsg.dll

4. ok

5. The same error as before.

One more moment, I was wrong

So, I copied all the drivers. Still, the same mistake.

By the way, if that's not yet clear: BIOS raid on.

Same error. Maybe it's time to stop using BitLocker! I don't know what else to tell you to try. It doesn't look like you're going to win the BitLocker battle.

Uff :-(

Hello, dear Paul,

I think we gave everything.

Ok, then I'll do it the way I did a few days ago.
1. I back up to an external, unencrypted hard drive using the Windows tool.
2. The same with TI.
3. And if I have the emergency, I reinstall Windows with TI, validate the last backup and securely back (that's how it worked a few days ago). Such a worst case is rare. But then I know the way to help myself.

Thank you again for your commitment.

Best regards,
Willy

We may have overlooked something basic here. Does your TPM require a driver? Does the TPM show up in Device Manager? If so, you need to add the driver to the WinPE.

Paul, I copied the TPM driver to MVP_ATIPEBuilder_v186-Drivers_Custom-x64-IRST, but unfortunately it didn't help either. Is this possible for you without any problems?

Maybe it's because of Windows 10 pro for workstations?

What exactly did you put there for the TPM driver. Please show me the inf file for the TPM. You can identify the inf file by looking at Properties of the TPM in Device Manager. Click on the Details tab and click on the drop down arrow next to Properties. Scroll down the list and find the "inf name". Then get the inf file from C:\Windows\inf. Open the inf file with notepad and find the [SourceDisksFiles] section. That will show you a list of all the files needed.

Do you mean this here:

[SourceDisksFiles]
tpm.sys = 3426

Yes that's it. You can see if the TPM driver is working in WinPE by entering the following line in a command window in WinPE:

net start tpm

If the tpm driver is working, you should see a message that the tpm service has been successfully started. Or a message that the tpm service has already been started.

The "net start tpm" command showed that the service has already started.

The command "manage-bde -status" shows an external hard drive that I am currently decrypting, see photo.

Do you mean it makes sense C: and D: to decipher again and then check what can be seen in "manage-bde -status"?

I would say that adding the tpm driver to WinPE didn't make any difference because the standard tpm driver already included in WinPE was working.

Yes, it would make sense to try manage-bde -status without any encryption.

It's a total guessing game at this point. I would try to eliminate any possibility the problem is being caused by the TPM. I would decrypt all volumes first. Then I would go into the BIOS and disable the TPM. Then I would set the group policies in Windows to allow BitLocker without a TPM. Here is a link to a guide for setting up BitLocker without a TPM https://www.windowscentral.com/how-use-bitlocker-encryption-windows-10 Then I would re-encrypt the volumes and try WinPE again.

Uiuiui, that's a lot of work!
Wouldn't it be better to install Windows with TI in an emergency and then restore the system?

Well, that's up to you. I just wonder why it's only your computer that has the problem. The only thing I can think of that would be unique to your computer is the TPM.

Your other option would be to just stop using BitLocker on that computer.

I have a more up-to-date firmware for TPM.
After the installation I try again with the USB stick.

Paul, if I have the right time window, then I reinstall Windows with TI and then I test your tool (I missed that last time unfortunately).
Just before, I deactivated the TPM in the BIOS, but unfortunately it didn't help either. Also not the updated firmware.

And now I have to take care of my family, otherwise there will be trouble!

You will hear from me again.

Best regards,
Willy

Paul, it was itching in my fingers :-)

I created a Rescue Media and i did

WinPE for my computer.

And with that, the "manage-bde-status" command works without an error message. But not completely, because the encrypted drives do not display the size (see photo)

What happens when you run the unlock script?

I still have to try, but now I have to go away to an appointment.

This is what it looks like with the "manage-bde -status" command. So not the complete information (see photo)

I then connected an external, encrypted drive.
I was able to decrypt it as it appears (see photo).
I struggle with my complicated password because the key assignment is very different.

At C: I didn't dare!

Good night and sleep well.

That's great. Looks like the long battle is finally over. Thanks for sharing the good news.

However, this path is very complicated.

It's a pity that this doesn't work with your ingenious and comfortable script :-(
Don't see any possibility anymore?

Hello Paul,
hello Steve,

I went on a long hike today and thought about it and I think I came up with a solution. I recorded them in a Word document.

I put the document in the shared folder for Steve.
The document is in German and needs to be improved a little.
Look at it and let you hear what you think about it.

Tomorrow I have a lot of appointments.

As an attachment here my documentation as PDF. I refined it a little bit.