Client always shows the System State as Inactive (on UEFI systems MfeEpe.log reports Shrinking failed)

Technical Articles ID: KB83312
Last Modified: 12/8/2021

Environment

Drive Encryption (DE) 7.x

For details of DE supported environments, see KB79422 - Supported platforms for Drive Encryption 7.x.

Problem 1

Some Unified Extensible Firmware Interface (UEFI) systems fail to activate during the installation of DE.

NOTE: This issue isn’t reported on legacy BIOS systems.

Client side:
The user sees the following on the client in the Encryption System Status window, even though the encryption policy was activated in ePolicy Orchestrator (ePO):

System State	Inactive
Volume Status	No volume information
Progress	Progress bar shows no encryption activity

ePO console:
The administrator sees the following Client System Details for Drive Encryption:

State

In-Active

Clicking More, Disks shows the following message:

No details available, as Drive Encryption is not Active

Problem 2

The errors below are recorded on the client in the MfeEpe.log file:

INFO	EpePartitionHelper	Shrinking OS partition by 104710144 bytes to make space for EE partition
ERROR	EpePartitionHelper	Shrinking failed
ERROR	EpePartitionHelper	Please contact your system administrator who should manually free up space on the boot disk so that a partition of 104858624 bytes may be created
ERROR	EpePartitionHelper	Checking the disk for errors may help. Shrinking will fail on disks with errors
INFO	EpePartitionHelper	Shrinking OS partition by 87932928 bytes to make space for EE partition
ERROR	EpePartitionHelper	Shrinking failed

Cause

DE is trying to shrink the last volume on the drive, which must have 32 empty sectors after the last volume and before the Logical block addressing (LBA) '-32' sectors. DE fails to shrink the partition if there aren’t 32 empty sectors on the drive between the LBA '-32' and the end partition header of the last volume.

The cause for this issue is usually the Windows Extensible Firmware Interface System Partition (ESP) being placed after the Windows partition.

Microsoft recommends that the ESP is the first partition on the disk. For verification, see the Microsoft article.

Solution

You can manually shrink the operating system volume by 106 MB, which allows DE to complete the activation.

IMPORTANT:

When applying an image to multiple systems, we recommend the image that the computer was created from is re-created, or repaired to place the ESP as the first partition on the disk.
As reported in the log, check the disk for errors using chkdsk, as shrinking can also fail on any disk that has bad sectors.

Open Windows File Explorer.
Right-click on your Computer_name, and select Manage.
Under Storage, click Disk Management.
Right-click the basic volume you want to shrink, and click Shrink Volume.
In the Enter the amount of space to shrink in MB field, type 106.
Click Shrink.

For instructions on how to manually shrink the partition, see the Microsoft article.

Affected Products

Drive Encryption 7.3.x
Drive Encryption 7.2
Install/Uninstall

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro

Knowledge Center

Client always shows the System State as Inactive (on UEFI systems MfeEpe.log reports Shrinking failed)

Environment

Problem 1

Problem 2

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Client always shows the System State as Inactive (on UEFI systems MfeEpe.log reports Shrinking failed)

Environment

Problem 1

Problem 2

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title