Dynamic Disks aren't encrypted after selecting the policy option to encrypt All Disks

Technical Articles ID: KB87219
Last Modified: 2024-01-06 09:46:10 Etc/GMT

Environment

Drive Encryption (DE) 7.1.x

For details of DE 7.1.x supported environments, see KB79422 - Supported platforms for Drive Encryption 7.x.

Problem

After successfully deploying DE or EEPC, some or all of the drives fail to be encrypted. This problem occurs only on a small number of computers.

Server Side:

The DE or EEPC Product Settings policy on the Encryption tab is set to encrypt ALL Disks.

The following is shown at the ePolicy Orchestrator Console on the Endpoint Encryption Disk Details page:

Model Number
Serial Number
Port
Type
Size
State (Disk)s	Encrypted

On the same page, when you click Go to Related Disk Volumes, only some disks are displayed as encrypted:

Volume	Size (MB)	State (Volume)
C:	##,###	Encrypted
D:	##,###	Un-Supported

Client Side:

Computer Management, Storage, Disk Management shows the problem disk(s) that can't be encrypted.

Volume: D:
Layout: Simple
Type: Dynamic
File System: NTFS

The Endpoint Encryption System Status window shows the following:

Systems State: Active

The Volume Status for the drive that can't be encrypted is displayed as either Decrypted or Unsupported.

NOTE: When a new volume is created by shrinking an existing volume on a Dynamic disk, it's not visible via the DE client User Interface.

System Change

The disks have been converted from Basic to Dynamic.

Cause

DE or EEPC works at the sector level; it does not support software-based dynamic disks and software-based RAID.

Excerpt from the DE 7.1 Patch 3 Release Notes (PD25903)

For product documents, go to the Product Documentation portal.

Dynamic and RAID disks in Windows
Endpoint Encryption works at the sector level; consequently, it doesn't support software-based dynamic disks and software-based RAID.

Solution

This is expected behavior. Because Endpoint Encryption works at the sector level, the following issues must be considered when installing DE or EEPC on a system with this feature:

Volumes spanning one or more physical drives
DE or EEPC encrypts only the first drive where the volume exists, and leaves the remaining volumes in plain text.
Volumes mapped in as directories (hard links)
DE or EEPC doesn't encrypt the Volume because the physical sectors aren't supported at the BIOS level.
Mirrored and RAID Volumes
DE or EEPC is untested in this mode. It's not designed to support software mirroring and RAID.
Hardware RAID
DE or EEPC is untested in this mode; however, in a situation where pure Hardware RAID has been implemented, there's no reason why Endpoint Encryption shouldn't function as expected. Because it's not tested, DE or EEPC can't support diagnostic or disaster recovery in this situation.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Dynamic Disks aren't encrypted after selecting the policy option to encrypt All Disks

Environment

Problem

System Change

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Dynamic Disks aren't encrypted after selecting the policy option to encrypt All Disks

Environment

Problem

System Change

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title