Windows 10 Insider Preview Fast/Slow/RP Build 17134.5 - April 27 Insider

DavidY said:

Windows 8.1 and now Windows 10 will automatically encrypt devices which meet certain hardware requirements - I think the hardware specification was called 'InstantGo'. For instance the OS drive must be solid state rather than spinning.

This disk encryption applies to all versions of W10, even Home. It encrypts the drive in the background by default; you don't have to switch it on (but you can switch it off).

One of these requirements is that Secure Boot must be switched on, and the gotcha is that if you switch off Secure Boot, you won't be able to read the drive any more. (That was my experience in W8.1 at least, and I assume it's still true.)

So be careful with switching off Secure Boot...

Drives are not encrypted by default.

This may apply to bitlocker if enabled (I cannot say). You really need to be more specific about when automatic encryption applies.

DavidY said:

It's not the same as Bitlocker.
Here's the Microsoft link:
https://docs.microsoft.com/en-us/win...yption-for-oem

My experience with Windows 8.1 (can't remember which W10 versions I tested it on) was that on my cheap tablet with W8.1 Core, switching on Secure Boot and logging in with an (admin-level) MS Account was enough to start it encrypting.

Do you have an OPAL enabled device? That one would encrypt everything at hardware level if enabled. But as far as I know Windows will not encrypt anything until you tell it to do so.

DavidY said:

It's not the same as Bitlocker.
Here's the Microsoft link:
https://docs.microsoft.com/en-us/win...yption-for-oem

slicendice said:

Do you have an OPAL enabled device? That one would encrypt everything at hardware level if enabled. But as far as I know Windows will not encrypt anything until you tell it to do so.

Interesting.
From DavidY's link...

Windows 10 device encryption is enabled only after users sign in with a Microsoft Account or an Azure Active Directory account. Device encryption is not enabled with local accounts.

...and later on:

Starting with Windows 10, version 1703, use the following steps to determine if the system supports automatic device encryption.

1. Click Start, and type System information
2. Right-click System Information app and click Open as Administrator. Allow the app to make changes to your device by clicking Yes. Some devices might require elevated permissions to view the encryption settings.
3. In System Summary, see Device Encryption Support. The value will state if the device is encrypted, or if not, reasons why it is disabled.

My system (legacy bios, so it shouldn't) says...

Device Encryption Support
Reasons for failed automatic device encryption: TPM is not usable, PCR7 binding is not supported, Hardware Security Test Interface failed and the device is not InstantGo, Un-allowed DMA-capable bus/device(s) detected, Disabled by policy, TPM is not usable

What does yours say?

OK!

Now I see what this encryption fuzz is all about.

Read this: Wikipedia - InstantGo

Based on this information, automatic encryption is only available on devices that meet all the requirements mentioned in the article.

My laptop has all of those requirements, except it also supports booting using legacy boot (BIOS/MBR), so automatic encryption is disabled because of this limitation. Requires a UEFI ONLY capable device.

Here's what my computer outputs:
Device Encryption Support: Reasons for failed automatic device encryption: Hardware Security Test Interface failed and device is not InstantGo, Disabled by policy


Here is more talk about this: TenForums - Reasons for failed automatic device encryption...Post #11

Bree said:

Interesting.
From DavidY's link...

...and later on:


My system (legacy bios, so it shouldn't) says...


What does yours say?

Device Encryption Support Reasons for failed automatic device encryption: PCR7 binding is not supported, Un-allowed DMA capable bus/device(s) detected

slicendice said:

OK!

Now I see what this encryption fuzz is all about.

Read this: Wikipedia - InstantGo

Based on this information, automatic encryption is only available on devices that meet all the requirements mentioned in the article.

My laptop has all of those requirements, except it also supports booting using legacy boot (BIOS/MBR), so automatic encryption is disabled because of this limitation. Requires a UEFI ONLY capable device.

Here's what my computer outputs:
Device Encryption Support: Reasons for failed automatic device encryption: Hardware Security Test Interface failed and device is not InstantGo, Disabled by policy


Here is more talk about this: TenForums - Reasons for failed automatic device encryption...Post #11

About the only devices that support uefi only booting are Surface Pros. My tablet does not fit all the requirements.

Does anybody understand what this encryption actually does?

cereberus said:

About the only devices that support uefi only booting are Surface Pros. My tablet does not fit all the requirements.

Does anybody understand what this encryption actually does?

As far as I understand it, it automatically encrypts everything on devices that are capable of going into standby mode, while still being connected online. Requires to be a certified device (the requirements seems to be very strict), and most are not.