Device Encryption Requires Modern UEFI, TPM Chip, and Secure Boot

System Requirements for Device Encryption

To ensure your PC is ready for device encryption, there are four essential requirements that must be met. Firstly, your computer needs to have a modern UEFI (Unified Extensible Firmware Interface) instead of the older BIOS (Basic Input/Output System). Secondly, an up-to-date TPM chip (Trusted Platform Module) is necessary. Fortunately, both of these components have been standard in most PCs for many years.

Additionally, your device must support the “Modern Standby” (S0) power-saving mode. To verify this, you can open the command prompt with administrator rights and type in the command:

powercfg /a

Press the Enter key. If the response “Standby (S0 low power state) … available on this system” appears, then your device meets the third requirement. However, if you see “Standby (S0 Low power idle) is not supported by the system firmware,” you should check your manufacturer or device-specific UEFI menu to see if it can be activated there.

The fourth requirement is that the Secure Boot option must be available and switched on. This setting is found in the UEFI, so you may need to search for it before your device encryption is ready to start. Don’t give up if you don’t find it immediately; persistence is key.

For a final compatibility check and to ensure correct configuration, type:

msinfo

in the search and input field of the taskbar and start the system information by right-clicking as administrator. Look for the entry “Support for device encryption” at the bottom. If it says “Requirements met,” you’re good to go.

If not, Windows will display the cause of the error when you hover your mouse over it. A common issue cited is missing “PCR7 binding.” The previously mentioned prerequisites are often hidden behind this term; a targeted Google search can often provide more information. For further assistance, refer to resources like the box titled “Problems with device encryption.”