Bitlocker hardware encryption cannot be activated on Win10 10586/1511

Hey,

I'm having an issue with enabling hardware encryption with Bitlocker using Windows 10 build 10586 on a clean install with a Samsung 850 SSD.

The encryption worked flawlessly before.

I've spent hours and attempted multiple solutions and made several tests.

On the same machine, if clean installing build 10240 (RTM, before November update) right now, the encryption works.

I have UEFI on with Legacy/CSM off, Fast Boot on, Secure Boot on, and a clean GPT installation after using the 'diskpart clean' command.

As always, it's required to change a group policy to allow additional authentication at startup. I did that as always.

On a clean installation of build 10586, the wizard will say 'parameter is incorrect' when you attempt to start encryption.

Microsoft did announce some Bitlocker-related changes for build 10586: https://technet.microsoft.com/en-us/library/mt403325

There are also new group policies added. I've tried all combinations. They now allow you to try and force a specific encryption cipher. Samsung uses XES-AES256. I tried forcing that (as well as all other combinations) but the same error returns.

Now, here's where it gets interesting, and possibly why no reports about this have surfaced yet:
If you enable the encryption on build 10240, and then upgrade to 10586, the encryption will remain and will work properly on build 10586.

If you then attempt to 'Reset this PC', and choose the 'keep nothing' option, it will warn you that bitlocker will be disabled. Once it's done cleaning, if you attempt to enable encryption, it will again show the error.

Even if you don't reset the PC, but simply disable Bitlocker on 10586 and then attempt to re-enable it, it will no longer work.

tl;dr: Hardware encryption via Bitlocker on build 10586 cannot be enabled on a clean install. Currently-known workaround is installing 10240, encrypting it, then upgrading to 10586.

Any solutions will be appreciated, thanks!

I am having this exact same issue on build 10586. Very frustrating. I have not tried the 10240 build however. Any suggestion on where I can get that build?

kyoung said:

I am having this exact same issue on build 10586. Very frustrating. I have not tried the 10240 build however. Any suggestion on where I can get that build?

Glad to hear (but not glad that you're having the problem) that it isn't just me, even though I've encountered this on 2 different systems. I'm really surprised that Microsoft missed such a bug with the Insider program getting this build before it was out for the general public.

Unless there's a way to resolve it we don't know about, they'd have to patch it in an upcoming update I think.

Personally, the 10240 upgrade route thing is an annoying workaround and not a long-term solution. Upgrading still leaves traces and old folders from the previous version etc. Many enthusiasts prefer the clean install route. I really hope it's fixed soon.

I am also having this problem, on a Thinkpad T450s.

I tried replying to your thread on the MS forums, but couldn't do so, there seems to be some bug with the reply feature there.

Also hoping for a solution. Ran into this after spending about 10 hours figuring out all the steps to enable eDrive with my SED. X_X

intelli78 said:

I am also having this problem, on a Thinkpad T450s.

I tried replying to your thread on the MS forums, but couldn't do so, there seems to be some bug with the reply feature there.

Also hoping for a solution. Ran into this after spending about 10 hours figuring out all the steps to enable eDrive with my SED. X_X

Wow cool news... reformatted dozens of times. Also have the same "parameter is incorrect" issue with W10 and a Samsung Evo 850.

How do you download the specific build of Windows 10 in order to enable encryption?

Boosty

I will note that I am also using an Evo 850. Kyoung, would you happen to have this drive as well?

FYI
Tried enabling bitlocker and disabling XTS-AES since that is new in this build, without any change... forcing it to legacy AES256 or AES128 gave the same error.

manage-bde -on c: -recoverykey d: -em aes256 -s

Parameter is incorrect (code 0x80070057)

ARGH

intelli78 said:

I will note that I am also using an Evo 850. Kyoung, would you happen to have this drive as well?

Yes. Samsung Evo 850

intelli78 said:

I tried replying to your thread on the MS forums, but couldn't do so, there seems to be some bug with the reply feature there.
X_X

which MS forum ?

Same problem here with a brand new SED Seagate ST3000DM002 as a data volume.

Is MS informed about this bug ?
Don't know how they work, will there be a bug number, any chance to track it ?

Damn, how long will this take, days, weeks, months, who knows.......

John Doe said:

which MS forum ?

Same problem here with a brand new SED Seagate ST3000DM002 as a data volume.

Is MS informed about this bug ?
Don't know how they work, will there be a bug number, any chance to track it ?

Damn, how long will this take, days, weeks, months, who knows.......

Bitlocker hardware encryption cannot be activated on Win10 10586/1511