Blue Screen after Full Disk Encryption

[AdrianDrob]

Hello,

After I have successfully encrypted using BitLocker Drive Encryption technology trough policy profile in Kaspersky Security Center, every time i shutdown I'm having this annoying blue screen. After restarting automatically windows it boots and all it is fine, also when restart is all right, the problem appears only when shutdown.

Stop code: 0x0bad1001

What failed: Ntfs.sys

I'm using:

Kaspersky Security Center: 10.5.1781

Kaspersky Agent: 10.5.1781

Kaspersky Endpoint Security: 11.0.0.6499

Microsoft Windows 10 1803

[Evgeny_E]

Hello. 

 

Kaspersky Endpoint Security, only supply policy settings to MS Bitlocker. You should contact application vendor for a consultation, aslo ntfs.sys is not a Kaspersky Lab driver. 

[AdrianDrob]

Hello,

I know that BitLocker is from MS but i think is not related to encryption itself. If I disable and after enable the encryption from Windows, the blue screen doesn't come out anymore at boot time, after shutdown.

[Nikolay Arinchev]

Hi,

Could you please provide us with GSI report from that host?

Thank you!

[AdrianDrob]

Hi Nikolay,

See GSI Reports here 

Thanks for your help!

 

[Nikolay Arinchev]

Thank you for that info!

Please provide us with Full memory dump that was generated during the crash.

Thank you!

[AdrianDrob]

Hi Nikolay,

See Full memory dump here, it is from another host with the same problem, same BSOD.

Hope will help.

Thank you!

[Evgeny_E]

Hello. 

You said that you had configured Bitlocker drive encryption, but reports and memory dump is demonstrating that you have installed other encryption components too  - Kaspersky Lab Full Drive Encryption and Kaspersky Lab File Level Encryption. 

The error in memory dump was related to File level encryption module. If you did not deployed policy for FLE, you can uninstall this module using KSC task "Change application components". Also you should similarly remove FDE component. 

[AdrianDrob]

Yes, that's right. I uninstalled that two modules FLE and FDE on an affected host and that solved the issue. It should be a warning somewhere to inform that if you use a module to not install the other ones.

Thanks for your help Evgeny_E!

[Kirill Tsapovsky]

2 hours ago, AdrianDrob said:

Yes, that's right. I uninstalled that two modules FLE and FDE on an affected host and that solved the issue. It should be a warning somewhere to inform that if you use a module to not install the other ones.

Thanks for your help Evgeny_E!

Thank you for your feedback.