[0xCF060005] Not enough entropy available (hard disk not encrypting)

Technical Articles ID: KB83497
Last Modified: 2023-04-17 06:26:42 Etc/GMT

Environment

Drive Encryption (DE) 7.3.0, 7.3.0 Hotfix 1, 7.2.x

Problem

The hard disk isn't encrypting after you successfully install DE.

The MfeEpe.log records the errors below:

ERROR	MfeEpePcEncryptionProviderPlugin	[0xCF060005] Not enough entropy available
INFO	EpoPlugin	collectProperties: dispatching disk list to AgentHandler
INFO	StatusService	Policy enforcement has completed.
INFO	EpoPlugin	enforcePolicy: Timed out waiting for activation from a previous policy enforcement.

You might also observe the following after activation and during encryption of the hard disk:

After a system restart, the system might become unresponsive.
During startup, you might see the error Failed to create initial LPC state: [0xEE000007] [0xCC060005] Not enough entropy available

Cause

This issue is under investigation. Owing to a recent change to our core cryptographic module, it appears that there are issues with RDRAND on AMD Ryzen CPUs.

These issues can apparently be exacerbated in standby or hibernation mode, and can also be affected with the vendor BIOS implementation.

Solution

This issue is resolved with DE 7.3.0 Hotfix 2.

Issue resolutions in updates and major releases are cumulative; Technical Support recommends that you install the latest version. To find the most recent release for your product, go to the Product Downloads site.

Our product software, upgrades, maintenance releases, and documentation are available on the Product Downloads site.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Workaround

To test, run the NIC in Promiscuous Mode. Promqrycmd.exe is a command-line tool that you can use to detect NICs that are running in promiscuous mode.

IMPORTANT:

Promqrycmd.exe must be run from an administrator command prompt and the RPC Server service must be running on the local system.
We don't recommend permanently leaving the NIC in Promiscuous Mode owing to the security concerns.
If you're using a wireless NIC, or if it's present, disable it. Most wireless adaptors by default don't run in Promiscuous Mode. So, a limited number of packets would be added to the pool.

Temporarily run the NIC in Promiscuous Mode:

Download Promqrycmd.exe from the Microsoft Download Center.
Save the file to a temporary local folder. Example c:\test.
Open an administrator command prompt:
1. Click Start.
2. In the Start Search field, type cmd, and then press Ctrl+Shift+Enter.
  
  If the User Account Control dialog window appears, confirm that the action it displays is what you want, and then click Continue.
Change the location to the temporary folder (c:\test). Type the following and press Enter:

cd c:\test
Extract the files from c:\test. Type the following and press Enter:

Promqrycmd.exe |more

NOTE: The above command extracts promqry.exe and EULA.txt.
Collect the data. Type the following and press Enter:

Promqry.exe start iP_address_of_the_connected_adapter

NOTES:

After the NIC is configured correctly, you might need to uninstall and reinstall DE.
Assign more than one user and wait for the second user to be processed to create more network traffic. The error isn't recorded when a second user has been received and the pool is large enough to create the keys for both users.
Reset the NIC back to original state after testing.

Knowledge Center

[0xCF060005] Not enough entropy available (hard disk not encrypting)

Environment

Problem

Cause

Solution

Workaround

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

[0xCF060005] Not enough entropy available (hard disk not encrypting)

Environment

Problem

Cause

Solution

Workaround

Related Information

Affected Products

Languages:

Choose your region

Title

Title