We have a solution for the no-boot issue with hardware encryption on OPAL devices and will begin implementing it across all products.
Here is the validation steps we did with Samsung 990pro
-
Prepare the SSD
1.a To get started, install the SSD and have your Windows 11 Pro installation media ready.
1.b If the SSD was previously locked, perform a PSID Revert and Secure Erase to clean the drive. -
Clean the SSD during the Windows installation process.
On the Windows installation screen:
Press Shift + F10 to open Command Prompt.
Type:
->diskpart
->list disk
->sel disk 0 (select the disk where Windows will be installed, e.g., Samsung 990 Pro)
->clean (This will erase all data on the disk)
Close Command Prompt, refresh the installer, and proceed with Windows installation. -
Verify Encrypted Drive Support
After completing the Windows installation, install Samsung Magician. Once installed, confirm that “Encrypted Drive” is enabled in the drive information. (This requires an internet connection.) -
Enable hardware encryption for BitLocker
->Open Edit Group Policy (Run gpedit.msc).
->Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption → Operating System Drives
->Open “Configure use of hardware-based encryption for operating system drives”.
->Set it to Enabled.
->(Leave additional options as default; no need to select specific encryption types.) -
Encrypt the drive using BitLocker
Reboot the system.
In Windows, right-click Local Disk (C:) → select “Turn on BitLocker”.
Choose a method to unlock the drive (e.g., Microsoft recommended option).
Save the recovery key to a secure location.
Complete the BitLocker setup wizard. -
Verify encryption progress
Open Command Prompt as Administrator.
->manage-bde -status
Confirm:
Encryption Method: Hardware Encryption
Percentage Encrypted: 0% (initial state). -
Reboot and complete encryption
Restart the system.
->Run manage-bde -status again to confirm:
Encryption Method: Hardware Encryption
Percentage Encrypted: 100% -
Restart the system again to verify that it still boots properly.