Enabling Device Encryption Support on Windows 11: PCR7 Binding Not Supported, Un-allowed DMA Capable Bus/Device() Detected

In this article, we will discuss how to enable device encryption support in Windows 11 using native tools. Specifically, we will cover the following errors that you might encounter when attempting to enable device encryption:

• PCR7 Binding Not Supported
• Un-allowed DMACapable Bus/Device() Detected

Key Concepts

Before we dive into the specific errors and solutions, let's cover some key concepts related to device encryption in Windows 11.

• BitLocker: Microsoft's built-in full disk encryption tool for Windows operating systems
• Device Encryption: A feature in Windows 11 that uses BitLocker to encrypt the system drive automatically when certain requirements are met
• TPM (Trusted Platform Module): A hardware-based security feature that can be used to store encryption keys and other sensitive information
• PCR (Platform Configuration Register): A set of registers in the TPM that can be used to store configuration information and securely bind encryption keys to specific hardware configurations

Error: PCR7 Binding Not Supported

When attempting to enable device encryption on a Windows 11 system, you might encounter the following error:

Device Encryption is not available because PCR7 binding is not supported on this device.

This error typically occurs when the system does not have a TPM version 2.0 or later available. In order to enable device encryption on a system without a TPM, you can use the following steps:

1. Press the Windows key + X and select "Windows PowerShell (Admin)" from the menu
2. Enter the following command and press Enter:

Replace "" with the letter of the system drive (typically C:)

2. Enter the following command and press Enter:

Replace "" with the letter of the system drive (typically C:)

Error: Un-allowed DMACapable Bus/Device() Detected

When attempting to enable device encryption on a Windows 11 system, you might encounter the following error:

Device Encryption is not available because an Un-allowed DMACapable Bus/Device() has been detected.

This error typically occurs when the system has a bus or device connected that does not meet certain security requirements for device encryption. In order to resolve this error, you will need to identify and remove the offending bus or device. You can use the following steps:

1. Press the Windows key + X and select "Device Manager" from the menu
2. Expand each category and look for any devices that have a warning symbol or are listed as "Unknown Device"
3. Right-click on the offending device and select "Uninstall Device"
4. Restart the system

Additional Considerations

• If you are attempting to enable device encryption on a virtual hard disk (VHD), you will need to ensure that the VHD is attached to a virtual machine that meets the security requirements for device encryption.
• You may need to configure the Group Policy setting "Prevent non-TPM computers from using BitLocker"