Seeking understanding of why new Dell gamer laptops can't use Device Encryption

[twdal]

The laptops are Dell G15 5530's running Windows 11 Pro. I would prefer to use Device Encryption instead of BitLocker because it is simpler to implement and save the key in the User's Microsoft account.

MSINFO32 shows "Device Encryption Support" with two "reasons for failed automatic device encryption":

• PCR7 binding is not supported
• Un-allowed DMA capable bus/device(s) detected

Other relevant data points from MSINFO32:

BIOS Mode = UEFI
Secure Boot State = ON
PCR7 Configuration = Binding Not Possible

Dell support refuses to help much because I upgraded Windows 11 Home to Pro soon after being handed this project. But they were willing to state in a chat that "hardware based device encryption is not an option for this model". I can only guess that they say this because these laptops have NVIDIA Geforce RTX 4060 laptop GPU's.

One ray of hope is provided by this doc from Microsoft that says "Starting in Windows 11, version 24H2, the prerequisites of DMA and HSTI/Modern Standby are removed.". Might upgrading to 24H2 enable these laptops to support "Device Encryption Support"?

I'm at a loss.

 

[britechguy]

I would prefer to use Device Encryption instead of BitLocker because it is simpler to implement and save the key in the User's Microsoft account.

There is no difference between Device Encryption and BitLocker other than name. A rose is a rose is a rose.

BitLocker is what's available and the branding under Pro. Device Encryption is what's available and the branding under Home. I think BitLocker is the branding for all the editions of Windows other than Home, and the BitLocker key (which is the device encryption key) should be part of the Microsoft account used when the device was initially set up. The saving of BitLocker and Device Encryption keys is entirely automated if the owner of the device's Microsoft Account is used at device setup.

 

[phaZed]

You may need a BIOS update. Also check to make sure that S5 sleep is enabled in BIOS.

 

[Markverhyden]

Un-allowed DMA capable bus/device(s) detected

Did you see the link below. Looks like there's a hack you might be able to use. It is for W10 but the concept might still work with W11. FYI you do want to make sure you have valid backups when you do something like this.

System Does Not Meet BitLocker Automatic Device Encryption Requirements | Dell US