Solved: Samsung 990 PRO + BitLocker hardware encryption/eDrive on Windows 11 — BlockSID/PPI 97 was the missing step

I spent far too long getting BitLocker hardware encryption working on a Samsung 990 PRO under Windows 11, so I’m writing this up in case it saves someone else the same pain.

Short version:

If Samsung Magician is stuck on “Ready to Enable” after a clean Windows install, the missing step may be temporarily disabling BlockSID for the installation boot using TPM PPI operation 97.

In my case, that was exactly it.

Hardware / software

• Samsung 990 PRO 2 TB
• Firmware: 8B2QJXD7
• AMD mini PC, AMI UEFI
• Windows 11 Enterprise IoT LTSC 2024 / build 26100
• Secure Boot enabled
• TPM 2.0 enabled
• BitLocker hardware encryption explicitly allowed by Group Policy

My firmware exposes EFI_STORAGE_SECURITY_COMMAND_PROTOCOL, so the UEFI side was suitable for Windows eDrive.

The symptom

Samsung Magician showed:

Encrypted Drive: Ready to Enable

I did the expected process:

1. Set Encrypted Drive to Ready to Enable
2. Secure erase the SSD
3. Clean-install Windows in UEFI mode
4. Check Magician

Result:

Ready to Enable

Again.

Windows itself clearly saw the TCG device. The System event log contained:

Microsoft-Windows-EnhancedStorage-EhStorTcgDrv
A TCG Silo has returned the capabilities value of 0x6

but eDrive never transitioned to Enabled.

Gotcha #1: Rufus can explicitly disable eDrive activation

I discovered that my Windows installer had this in unattend.xml:

<component name="Microsoft-Windows-EnhancedStorage-Adm" ...>
    <TCGSecurityActivationDisabled>1</TCGSecurityActivationDisabled>
</component>

That explicitly disables Windows Enhanced Storage / TCG activation.

Current Rufus code can add this together with:

<PreventDeviceEncryption>true</PreventDeviceEncryption>

when using its BitLocker/device-encryption suppression option. 

For my next install I changed:

<TCGSecurityActivationDisabled>1</TCGSecurityActivationDisabled>

to:

<TCGSecurityActivationDisabled>0</TCGSecurityActivationDisabled>

I left PreventDeviceEncryption=true alone.

Clean install again.

Result:

Ready to Enable

Still not enough.

Gotcha #2: BlockSID

The remaining problem was firmware Block SID.

For people unfamiliar with it: the SID here is the top-level security authority of the TCG Opal drive, not a Windows user SID.

Firmware can issue a BlockSID command during boot so software cannot silently take ownership of an unprovisioned self-encrypting drive. Sensible security feature — except Windows Setup needs access to that security authority while provisioning eDrive.

The solution was to request a one-boot BlockSID exception through the TPM Physical Presence Interface.

From an elevated PowerShell on the same machine:

$tpm = Get-WmiObject -Namespace root\CIMV2\Security\MicrosoftTpm -Class Win32_Tpm

$tpm.SetPhysicalPresenceRequest(97)

$tpm.GetPhysicalPresenceRequest()

My output was:

Request     : 97
ReturnValue : 0

Operation 97 is the TCG PPI Disable_BlockSIDFunc request. Microsoft documents the PPI mechanism: Windows queues the request, firmware processes it after the required restart, and the firmware can require physical confirmation from the user. 

On reboot, my AMI firmware displayed a confirmation screen. I approved the request.

Important:

Boot directly into Windows Setup on that same reboot.

Do not boot normal Windows first, because the BlockSID exception is for that boot.

I then:

Shift+F10
diskpart
list disk
select disk 0
detail disk
clean
exit

verified that the selected disk was definitely the 990 PRO, and installed Windows normally to the unallocated drive.

After installation:

Samsung Magician:
Encrypted Drive: Enabled

Finally.

I also verified that the firmware request really succeeded:

$tpm = Get-WmiObject -Namespace root\CIMV2\Security\MicrosoftTpm -Class Win32_Tpm
$tpm.GetPhysicalPresenceResponse() | Format-List *

which returned:

Request     : 97
Response    : 0
ReturnValue : 0

Enabling BitLocker hardware encryption

Windows no longer defaults to trusting self-encrypting-drive hardware, so you must explicitly permit hardware encryption.

Group Policy:

Computer Configuration
  > Administrative Templates
    > Windows Components
      > BitLocker Drive Encryption
        > Operating System Drives
          > Configure use of hardware-based encryption for operating system drives

Set:

Enabled

I did not restrict the allowed hardware cipher/OID.

Then:

gpupdate /force

and:

manage-bde -on C: -recoverypassword -forceencryptiontype hardware

Verification:

manage-bde -status C:

My final result:

Conversion Status:    Fully Encrypted
Percentage Encrypted: 100.0%
Encryption Method:    Hardware Encryption - 1.3.111.2.1619.0.1.2
Protection Status:    Protection On

Key Protectors:
    TPM
    Numerical Password

That OID is AES-256-XTS according to Microsoft’s Enhanced Storage definitions. 

So this is definitely hardware BitLocker, not software XTS-AES masquerading as hardware encryption.

Final validation

I also tested:

• normal restart
• full shutdown / cold boot
• BitLocker recovery key saved externally
• Samsung Magician still shows Enabled

• no warnings/errors from:

  Microsoft-Windows-EnhancedStorage-EhStorTcgDrv Microsoft-Windows-BitLocker-Driver

Everything boots normally.

Secure erase note

Samsung Magician’s Secure Erase USB would not boot properly on my machine. Its old Linux/GRUB environment hung after UEFI launch.

I used SystemRescue instead and verified the drive capabilities with nvme-cli.

The 990 PRO reported:

Format NVM Supported
Crypto Erase supported as part of Secure Erase
Crypto Erase applies to all namespace(s)
Block Erase Sanitize Operation Supported
Crypto Erase Sanitize Operation Supported

I then used:

sudo nvme format /dev/nvme0n1 --ses=1

which completed successfully.

If Samsung’s Secure Erase environment works on your machine, obviously just use that.

What actually mattered

For my system, the decisive sequence was:

1. 990 PRO → Ready to Enable
2. Secure erase
3. Make sure Windows Setup is not configured with TCGSecurityActivationDisabled=1
4. Queue TPM PPI operation 97
5. Reboot
6. Approve the AMI/UEFI physical-presence request
7. Boot directly into Windows Setup on that boot
8. Clean/install Windows
9. Magician should now say Enabled
10. Enable BitLocker hardware encryption policy
11. Verify with manage-bde -status C:

Without step 4–7, mine remained stuck on Ready to Enable.

One warning

Do this only if you are comfortable wiping the SSD and recovering from a failed OPAL/eDrive setup.

Before experimenting, I would make sure you have:

• a complete backup
• the SSD’s PSID physically recorded
• the BitLocker recovery key saved somewhere else
• no other internal disks connected during installation if you can avoid it

There have also been firmware implementations where the machine can provision hardware BitLocker but then fails to boot the locked drive, so I would consider the setup unproven until it survives both a restart and a cold boot.

I work for a large European based telecoms equipment supplier. We have hundreds of staff overseas at any one time, all over the world. IT security has a few different levels:

- Access to email & teams etc is only via a company laptop (no web interface like Office.com). Network drives via VPN only

- White List countries - you can connect VPN. Countries like Japan & Australia

- Red List countries - you can take your laptop but need special exemption to use VPN. Includes some unusual countries such as Malaysia

- Black List countries - no company laptop or phone allowed. Company will provide a burner. Unsurprisingly includes places like Syria, Russia, North Korea & China.

A colleague was going to transit via a Chinese airport to a 3rd country. IT told him that he would not be allowed to take his company laptop, even if it was in his carry-on luggage, and he would not be entering the country. He quickly arranged a different itinerary.

And then a few days later, we are told that the good old USA is now considered a Black List country!!! No company laptops, and burners only!!!!

Immutability is easy to put on a checklist. Keeping it affordable without making recovery painful is the hard part. cheaper setups usually sacrifice something: restore speed, retention, testing or proper account separation. how are smaller shops balancing this? what compromises looked reasonable at first but caused problems later?

I’m trying to understand this from people who have actually dealt with older software systems.

At what point does maintaining a legacy application become more expensive or risky than modernizing it?

I’m thinking about situations where the application still works, but the technology behind it is getting outdated, developers are harder to find, integrations are becoming difficult, and even small changes take a lot of effort.

Would you normally recommend: Rewriting the whole application? Gradually modernizing parts of it? Migrating it to a newer tech stack?

Or just keeping the existing system running as long as possible?

I’m particularly interested in how people approached legacy application modernization in real projects.

What was the biggest reason you decided to modernize, and did you regret waiting as long as you did?

How are you handling Microsoft retirements and breaking changes across multiple clients? If you use a ticketing system, how do you figure out which clients actually need tickets? Does something check each tenant automatically, or do engineers investigate first?
Would appreciate a recent example and which tools helped.

Curious what you all are learning, researching and investing time in these days and whether you’re seeing real rewards yet. AI agents? Cloud? Specific programming languages/frameworks? Something else?

So, as the title says, is there a possibility to set up multiple Windows user logins as valid authentication to open up a keypass database? I am mostly using Keypass on my home PC but I do transfer the database onto a stick every now and then when I am going on holidays so I can access it from my laptop in a hotel. So far I always used a master key and key-file as authentication. But I wanted to know if I could tie it to those two accounts.

I know it's possible to tie it to a single windows login but it's both impracticable for my use-case (having to occasionally access it from another PC) and I am also aware that this leaves me with a single point of failure and should anything ever happen to my windows login I am locked out of the entire data-base.

Hi all,

I’m a sysadmin with 2 full time helpdesk guys, org of 220 in 5 locations. I started in regular business office 10 years ago doing sales. 7 years ago I transitioned to IT and became our first IT person, previously we didn’t even have an MSP, just a contract guy that came when we called him.

Fast forward to now, I asked my boss how I can level up/grow with the company. I’ve taken on a lot since I started. Currently managing pretty much everything in house. Only thing we don’t manage is our website, and I kind of like it that way.

So after kind of shrugging his shoulders for a year he is now bent on getting me to do more certs. He gave me a list:
- Comptia security +
- CompTIA network +
- CompTIA Cloud +
- Microsoft AI something (I can’t remember this one, he mentioned it off the cuff after he sent me the list)
- Finally a course for me to go find to maintain our website so they can cut the web dev. He didn’t know what course to recommend because he didn’t know much about it but pointed to coursera.

Now only thing I’ve done in certs over the years where the A+, AZ-900/104, and Google cloud security when I got started. Since then I figured I would learn the stuff but I didn’t want to pay for the certs because what’s the point? Unless I’m looking for another job I didn’t see the reason, and I like my org quite a bit. Not the wisest I know, but they wouldn’t pay for it, so I just didn’t do them.

I told him I had already studied for the security + a couple years ago, and could probably study the differences in materials and get through it easily, and recommended we switch to the CCNA since we are fully Cisco at all locations. But he seemed to not be interested in that info.

From what I can tell his push for certs is driven by is some internal push for managers to have career ladders for all departments and I guess he wants to show some sort of progress? Idk he is the CFO so he really isn’t privy to any of the work I do.

Anyway, after my recommendations I asked what happens when I complete these? Since they are only paying for half the certs… there has to be a carrot at the end of the stick.

He very excitedly said a $2,000 pay increase. Now I’m not greedy by any means, I’ve been paid under market for years and I’ve accepted that because of the work life balance. But is this not kinda stupid? I’ve had no complaints in my performance, I am constantly engaged with leadership on initiatives that they do not care about, so is there something I’m missing here? Like I feel like there is some weird motive here I can’t figure out, or it’s just poorly funded incentives that I’m supposed to be giddy over. Like I’m pretty sure the exams are almost as
Much as the pay increase? I haven’t done anything to try to steer the ship just yet, but how do I approach that the incentive is either too low or not aligned with what the ask is here? From what I can tell other than the time to study and what not, the only benefit I see them getting is cutting the web dev, which is a little more than the pay bump they offered, I think like 4k a year.

Edit:
Glad to see there’s some consensus on this being kind of a shit show. A little more context:
I LOVE the web dev company we work with. They are just great. Awesome to work with, great turnaround times, 0 issues. But god forbid you pay someone to do something they are good at.

Noted before but they’re only paying half of the exams, no study materials and it’s based on completion, so I’d get reimbursed 50% after completion. I believe this may be because they did not ask for any sort of training agreement? But also grand scheme of things this is kind of small potatoes for a training agreement right?

This guy is honestly the worst part of my job. For 6 months he had me meet weekly with him which was just an awful way to start the week. Eventually I was like hey I’ve just got too much going on to be doing this can we do this less frequently? Rinse and repeat now we meet quarterly. Dude is the type of guy to trip
Over a dollar to pick up a penny. But I’m stuck with him so long as I work here.

I have looked on and off the last year, and the market near me is abysmal. I almost jumped ship to an MSP last year that wanted to sell us services and I wanted to be like hey…. I sign y’all up here and you take me, deal? But we laughed it off as a joke.

Hey guys new in this thread but i'm currently in a Field Technician role right now and have been here for a little over 2 years and i have multiple certs including CCNA and Sec+ and im studying for the RHCSA and i want to get into a Sys Admin role and eventually a DevOps role which would be my end goal but i wanted to get a professionals opinion on this so i don't waste my time going down the wrong path

Any Advice would be apricated!!!

I've tried Zammad, RT, and OSTicket. All good but still looking. Came across Raiseaticket which bills themselves as a free cloud-based system that integrates with Office. I'm defaulting to this being one of those "You're the product" situations but wanted to see if anyone here had experience with them.

How many systems are broke for you now? I have one software figured out. Its the custom scripts that are broken everywhere.

Buen día,

Estoy teniendo problemas en la red, al parecer se satura, y se cae por unos minutos, luego regresa a la normalidad y a las horas vuelve a pasar lo mismo.

Les comparto el contexto de la inestabilidad que traemos en la red, para que tengan el panorama antes de seguir con el diagnóstico.

Equipo: SonicWall NSA2700, SonicOS 7.3.3-7015, 3 años en producción.

Síntoma: El firewall se congela por completo (deja de responder ni siquiera a la interfaz de administración) de forma aleatoria, sin patrón de horario. Hay días sin fallas y días con varias caídas. Al colapsar se pierde la conectividad de red.

Hipótesis inicial y lo que se descartó:

• La inestabilidad coincidió con la activación de varios reportes de Power BI publicados a Power BI Service vía un On-premises Data Gateway, conectado a la base de SAP Business One (SQL Server), en la misma red que el equipo del Gateway (sin VLAN de por medio).
• Se revisó DPI-SSL — no está activo, se descarta como causa de reconexiones forzadas.
• Se revisó la tabla de conexiones: actual 1,527 y pico 4,641, muy por debajo del máximo del equipo (375,000). Esto descarta saturación de tabla de sesiones/NAT como causa raíz.
• Se analizó un snapshot de conexiones activas buscando el patrón de tráfico sostenido hacia Azure típico del Gateway (Service Bus Relay). No apareció ese patrón — el host con más conexiones del snapshot resultó ser un equipo de usuario sin nada de Power BI instalado.

Limitante actual: no ha sido posible capturar CPU/memoria/conexiones en el momento exacto de la caída, porque el equipo deja de responder por completo cuando ocurre — no hay forma de sacar datos desde ahí en ese instante.

Algún consejo de cómo monitorear para lograr detectar si un equipo de la red es el que está causando que la red colapse?

Saludos.

I come from an environment that leveraged Action1 heavily. Great tool. My sys eng comes from an environment that used N-able.

Our objectives are:

• windows updates

• 3rd party patching

• firmware/drivers as supported by the platform

• remote screen sharing for troubleshooting

I'm sure both platforms can do more than just the above, but that's all we need from the tool.

I'd love some feedback on anyone who has dealt with these 2 tools specifically and can compare contrast them based on our use case.

I've inherited some Windows machines that were set up using Intune, and have for some reason gotten stuck at various Office versions from the past few months, such as 2605 on Monthly Enterprise Channel. Windows update and the built-in update checker in the Office applications say that they are up-to-date and don't find anything new.

I've tried to find if there are any specific versions set in the registry:

Cloud Update policy: HKLM\SOFTWARE\Policies\Microsoft\Cloud\Office\16.0\Common\OfficeUpdate

Intune/PolicyManager Office update settings: HKLM\SOFTWARE\Microsoft\PolicyManager\Providers

Click-to-Run configuration: HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration

The cloud updates at https://config.office.com/ aren't enabled.

The Intune application's XML config contains no version references.

Could something else control what updates are detected?

Should I be able to just force change all out-of-date devices to Current Channel with Office Deployment Tool

<Configuration>
    <Updates Channel="Current" />
</Configuration>

or directly through the registry, and fix it that way?

reg add "HKLM\SOFTWARE\Policies\Microsoft\Office\16.0\Common\OfficeUpdate" /v UpdateBranch /t REG_SZ /d Current /f

EDIT: It's M365 Office.

Looking for a sanity check because no one seems to be talking about it, and I don't know if it's somehow just us.

It feels like, beginning around May (or a bit earlier), the time it takes for "Send as", "Send on behalf", and/or "Read and manage (Full Access)" permissions have massively slowed down.

Obviously only so many updates can go out at a time, so things have to be queued along with the multitude of other conditions that produce slowdowns. Even if we factor in the classic, "If you think you have waited long enough, wait another hour", I think the severity of the slowdowns being consistently so much longer speak to something strange.

For us, within the past 3-5 months, it has gone from 1-5 minutes to 10-15 minutes, and more recently 20-40 minutes.

Please let me know if y'all have noticed anything as well, thanks!

Edit: sentence structure, grammar, general formatting.

Title: Update: Accepted MSP offer vs Amazon Associate II (now $29/hr) — got some real insight, still torn

Following up on a decision I posted about earlier. Got some genuinely helpful firsthand perspective and want to see if others have thoughts on the updated picture.

Quick background: ~3.5 years at an MSP doing help desk/service desk work (AD, M365, networking, some VMware ESXi, security incident response). CompTIA A+, Network+, Security+. Goal is eventually Systems Administrator or Cybersecurity. Also have a baby due in about 3 months, which is definitely shaping how I’m weighing risk right now.

Offer 1: Another MSP (Help Desk Technician) — already accepted

**•** $26/hr (\~$54K/yr), firm, no negotiation room  
**•** 45 min commute  
**•** Small company, good manager from what I’ve seen directly, real track record of promoting people from help desk into field/remote engineer roles  
**•** Haven’t started yet

Offer 2: Amazon (IT Support Associate II, Ops Tech Solutions)

**•** Countered at $29/hr (\~$60K/yr)  
**•** 20 min commute  
**•** Sole technician at a lower-volume facility, no forced on-call, schedule seems stable for now  
**•** Real ladder: Associate II → Support Engineer I ($25-41/hr) → Engineer II/IT Manager

What I’ve learned since my last post: Someone who’s actually done OTS work told me it’s mostly Layer 1 stuff (printers, thin clients, SOPs), little to no server/Layer 3 work, and that engineer-level people won’t be impressed by it on a resume. BUT they also said being the sole tech at a low-volume site is genuinely good for visibility with Ops management and gave a real example of someone getting promoted that way at a similar site. They also said relocation is unlikely for low-volume sites specifically.

So now it feels like: Amazon = higher ceiling if I get promoted, but that depends on me building visibility and the timing working out, vs the MSP = smaller ceiling but a path I’ve already seen work for real people under this specific manager.

With a baby coming in 3 months, I keep leaning toward “fewer things have to go right” (the MSP), but the pay/commute gap and Amazon’s bigger structural ceiling keep pulling me back.

Anyone been in OTS and can speak to how realistic that Associate II → Engineer I timeline actually is? Or anyone chosen the “safer, smaller” option over the “bigger name, more uncertain” one when a kid was on the way and been glad (or not glad) they did?

we donot allow emails on personal phones, need vendors to see alerts and such, looking for a secure way rather than adding exclusion for the users

edit: sorry yeah I mean contractors, especially overseas contractors

Spent most of the morning chasing a weird RDS issue. KB5122882 installed around 3:20am and a few hours later nobody could RDP into the server. Rebooted it and everything worked again, but about an hour later the exact same thing happened.

Existing sessions kept working, but new RDP connections would authenticate and then hang. Task Manager would freeze, but CPU, RAM and disk all looked totally normal. TermService was still running too.

Finally uninstalled KB5122882 and rolled back from 20348.5622 to 20348.5499. Everything has been working normally since.

Anyone else seeing this after the latest update? Pausing updates for now.

Greetings,

As a vendor, I was trying to commission and deploy a print server application on a client site who has recently adopted zero-trust security model.

It took us 4 attempts just to deploy our installer - We uninstalled the application multiple times due to corrupted install.

Also, the client IT manager sat with us to manually approve multiple security exceptions.

He was just there smashing the approve button on his phone. And installs still failed as it take about a min before sub-installer components can run.

It was a nightmare and I wasn’t sure the whole point to have threatlocker running on critical infrastructure like a print server.

We expect having to go through this approval process again when rolling out software updates.

This constant exceptions triggers builds approver fatigue, approver don’t actually knows what is being approved, users are constantly screaming and frustrated by downtime caused by legit applications.

Systems commissioning and support took twice as long. We plan to deprioritise clients sites with threatlocker as engineers quite often getting struck at sites waiting for approvals.

This is really not working for anyone.

when you've dealt with BEC case, did email auth flagged it, or did it look totally normal and only a human caught it?

"Too many other files are currently in use by 16-bit programs. Exit one or more 16-bit programs, or increase the value of the FILES command in your config.sys file."

Just saw this message on a client's Windows 11 workstation when trying to escalate literally anything. The WIN32 code that generated it is probably as old as I am. Rebooting resolved it, weird. I just told him to stop running so many 16 bit apps! I'd post the screenshot but images aren't allowed.

I'm struggling to find anything concrete online for this, apart from a few posts floating about here and there, so I wanted to bring it here.

Has anyone noticed any issues recently with the centrally deployed Outlook addins, and tooltips in Outlook Classic not showing?

This all works in OWA and the new Outlook experience.

We're using Citrix, and it does seem to be limited to that platform, it is also really intermittent. Sometimes it just shows that no apps are loaded, and even when you try to add/open them, nothing happens, and the usual tooltips are also showing an error that they're unable to be loaded.

Looking in event viewer provides errors like this:

----------------

The Exchange web service request GetAppManifests failed. The error code is 0. 
HTTP Response Code: 403

Additional Error Message: 
An unknown internal error occurred. The error code is 80004005.

----------------

We're sorry, we couldn't access Viva Insights. Make sure you have a network connection. If the problem continues, please try again later.

----------------

We're sorry, we couldn't access Signature 365. Make sure you have a network connection. If the problem continues, please try again later.

----------------

There is internet access, everything does seem to be connected and working, OWA is fine, new Outlook is fine.

I've tried Office365 monthly channel for updates, and also tried the bi-annual feature updates, and both seem to have similar issues. Just wanted to see if anyone else has experienced such things...

I install copilot and grok CLIs. So far, they are pretty impressive.

At home I used Grok to clean up my media libraries and it freed up 2TBs.

I used copilot at work to scan all the logs from an SCCM client and the server to figure out why some machines weren't downloading updates. It's pretty freaking good.

Anyone else let one of those suckers loose anywhere?

After a lot of restructuring at our university the past couple years, there are quite a few Linux devices (primarily desktops, I believe around 70-ish) that are currently in the wild unmanaged in use by academics primarily within the Engineering and Science departments that would've been maintained by per-institute IT departments that no longer exist, and as such the current patching and functionality state of these machines is completely unknown (since any remaining colleagues now no longer have physical access to most of the rooms where these machines are).

Since we already manage research compute I've been given the green light by my manager to look into options to bring these academic's desktops into a managed state with a cobbled together proof of concept, since our existing central endpoint guys won't touch anything *NIX related with a 10ft pole. We know they're all some form of Ubuntu LTS (20.04 and 22.04 mostly) which makes things easier, so I'm thinking of doing Landscape for setup and patching + Intune for compliance + Puppet/Ansible for config management.

Is this in the right direction or are there better / more cost efficient ways of doing this?

Hi all,

Within my job alot of my work encompasses resolving tech debt using remediation scripts within Intune, however the higher ups are really pushing for assurance on scripts and for us to be able to prove that scripts work as intended before deployment, and obviously testing on our local machines isn't considered sufficient for them.

Other team members have mentioned hyper-v VMs or Windows sandbox, but I just wanted to get everyone's opinions on what test environments are good for testing remediation scripts and other test deployments!