Drive Encryption is Active, but the Crypt State is decrypted or no volume information is shown

Technical Articles ID: KB92192
Last Modified: 11/3/2021

Environment

McAfee Drive Encryption (DE) 7.2.x

Applies to systems configured in the BIOS to use Unified Extensible Firmware Interface (UEFI)

Problem

DE is in one of the following states:

DE shows Active, but with no volume information
DE shows Active, but the Crypt State shows as decrypted

The DE encrypted status of the partition in the registry shows Decrypted:

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\McAfee EndPoint Encryption\MfeEpePc\Status\CryptState = Decrypted

The Mfeepe.log doesn’t report any errors.

You see this issue on supported systems that are configured in the BIOS to use the UEFI interface.

The system identifies the hard drive as new hardware, and sets the default value under the GPT attribute to 0x8000000000000000.

To view the status of the attribute, use the command-line option: gpt attributes=<n>

Cause

The hard disk was moved from one system to another. The system identifies the hard drive as new hardware, and sets the default value under the GPT attribute to 0x8000000000000000.

NOTE: No drive letter is assigned to the drive. For more details, see the Microsoft GPT documentation.

When the GPT attribute is set to 0x8000000000000000, DE ignores the partition and doesn’t encrypt the partition.

Solution

For DE to identify the partition and start encrypting, you must set the GPT attribute in the registry to zero:

Open a command prompt as an administrator.
1. Press the Windows key + R, type regedit into the field, and press Enter.
2. In the Start Search field, type cmd, and then press Ctrl+Shift+Enter.
  
  If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
At the command prompt, type:

diskpart
In the command window, type the command below, and press Enter:

list disk

Example of a Resulting output:

Disk ### Status Size Free Dyn Gpt
-------- ------------- - ------ - ------ --- ---
Disk 0 Online 476 GB 0 B
In the command window, type the command below, and press Enter:

select disk 0

NOTE: Disk 0 is now the selected disk.
In the command window, type the following and press Enter:

list partition

Example of a Resulting output:

Partition Type   Size Offset
------------- ---------------- -------   -------
Partition 1 System 350 MB 1024 KB
Partition 2  Reserved 128 MB 351 MB
Partition 3  Primary   476 GB 479 MB
Partition 4  OEM   100 MB 476 GB
In the command window, type the following and press Enter:

select partition 3

NOTE: Partition 3 is now the selected partition.
In the command window, type the command below, and press Enter:

detail partition

Example output:

Type : ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
Hidden : No
Required: No
Attrib : 0x80000000000000
Offset in Bytes: 502267904
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 0 C Windows NTFS Partition 476 GB Healthy Boot

Use the DiskPart utility to remove this flag by setting the GPT attributes. Type the command below, and press Enter:

select disk 0
select partition 3
gpt attributes=0x0000000000000000

NOTE: After you set the GPT attributes to zero, DE encrypts the partition on the next policy enforcement.

Affected Products

Drive Encryption 7.2
Known Issue/Product Defect

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Knowledge Center

Drive Encryption is Active, but the Crypt State is decrypted or no volume information is shown

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Drive Encryption is Active, but the Crypt State is decrypted or no volume information is shown

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title