AdrianDrob Posted September 14, 2018 Hello, After I have successfully encrypted using BitLocker Drive Encryption technology trough policy profile in Kaspersky Security Center, every time i shutdown I'm having this annoying blue screen. After restarting automatically windows it boots and all it is fine, also when restart is all right, the problem appears only when shutdown. Stop code: 0x0bad1001 What failed: Ntfs.sys I'm using: Kaspersky Security Center: 10.5.1781 Kaspersky Agent: 10.5.1781 Kaspersky Endpoint Security: 11.0.0.6499 Microsoft Windows 10 1803 Share this post Link to post
Evgeny_E Posted September 14, 2018 Hello. Kaspersky Endpoint Security, only supply policy settings to MS Bitlocker. You should contact application vendor for a consultation, aslo ntfs.sys is not a Kaspersky Lab driver. Share this post Link to post
AdrianDrob Posted September 17, 2018 Hello, I know that BitLocker is from MS but i think is not related to encryption itself. If I disable and after enable the encryption from Windows, the blue screen doesn't come out anymore at boot time, after shutdown. Share this post Link to post
Nikolay Arinchev Posted September 17, 2018 Hi, Could you please provide us with GSI report from that host? Thank you! Share this post Link to post
AdrianDrob Posted September 17, 2018 Hi Nikolay, See GSI Reports here Thanks for your help! Share this post Link to post
Nikolay Arinchev Posted September 17, 2018 Thank you for that info! Please provide us with Full memory dump that was generated during the crash. Thank you! Share this post Link to post
AdrianDrob Posted September 18, 2018 Hi Nikolay, See Full memory dump here, it is from another host with the same problem, same BSOD. Hope will help. Thank you! Share this post Link to post
Evgeny_E Posted September 18, 2018 Hello. You said that you had configured Bitlocker drive encryption, but reports and memory dump is demonstrating that you have installed other encryption components too - Kaspersky Lab Full Drive Encryption and Kaspersky Lab File Level Encryption. The error in memory dump was related to File level encryption module. If you did not deployed policy for FLE, you can uninstall this module using KSC task "Change application components". Also you should similarly remove FDE component. Share this post Link to post
AdrianDrob Posted September 19, 2018 Yes, that's right. I uninstalled that two modules FLE and FDE on an affected host and that solved the issue. It should be a warning somewhere to inform that if you use a module to not install the other ones. Thanks for your help Evgeny_E! Share this post Link to post
Kirill Tsapovsky Posted September 19, 2018 2 hours ago, AdrianDrob said: Yes, that's right. I uninstalled that two modules FLE and FDE on an affected host and that solved the issue. It should be a warning somewhere to inform that if you use a module to not install the other ones. Thanks for your help Evgeny_E! Thank you for your feedback. Share this post Link to post