Drive Encryption: Lenovo T490 devices randomly stop booting

[kvk]

Hi, we have an ongoing issue with a customer who deployed Lenovo T490 devices. The service request with McAfee hasn't yielded any satisfying results, the customer is raging and starts to question the usage of McAfee products altogether. This is a really precarious situation and the tension is really high over this problem.

This is what we are experiencing: On multiple Lenovo T490 devices, every now and then the system partition gets corrupted. It starts with a customer call that the preboot authentication screen is not showing. What we have to do then, and this is really time consuming: We have to boot EETech, remove DE, and repair the system partition using bcdboot.

Note that the customer also uses other Lenovo devices which don't have this problem.

Has anyone had the same issues? 20N2 and 20N3 model types are being used with the Lenovo T490 models.

Also: We are using Drive Encryption 7.2.9.17 with the latest HW compat XML file.

[Former Member]

Hi kvk,

Thank you for your post.

We are aware of the PBA not showing on Lenovo T490. Please raise a Service Request, and we will continue helping you to resolve this issue.

Thank you.

[kvk]

Hi Sheila, thanks your reply.

We did already raise a service request and there is no confirmed solution so far. This is the SR number in case you want to have a good read: SR # <4-21003412481>

Just today we received a modified HW XML (98) with compat flags for the T490. So does the modified HW XML also fix the corrupted system partition issue? Because when this issue occurs, an emergency boot does not help.

We then have to fully decrypt and run the following in a PE environment to fix boot:

diskpart
select disk 0
select partition 1
delete partition override
create partition efi
format quick fs=fat32 label="System"
assign letter=S
exit

bcdboot C:\Windows

Kind Regards

Kevin

[Former Member]

Hi kvk,

Yes, its was your issue I came across.

Since your issue is being worked by our engineering team, we can continue providing you support through your service request.

Thank you.

[kvk]

Hi SB1,

well the reason I'm posting here is because I feel our case is not taken seriously... We are currently testing a way to decrypt and re-encrypt machines on a broad range and minimize the time without an active encryption because there is no other way other than this or emergency booting the systems manually. From a management view this honestly is a complete joke and a waste of time.

Especially since there seems to be an internal McAfee tool with which you can change the HW compat flags directly.

Kind Regards

Kevin

[kblowe]

Was this issue resolved? If so please provide any insight to the fix.

Thanks.

[kvk]

No, the issue is still there.

[Pat]

Hi,

When you say 'stop booting'

Does it go into a boot loop and unable to get into Windows?

Also, did you manage to find out the root cause?

Thanks

[kvk]

Unable to boot into Windows yes, boot loop no. We switched to BitLocker and ditched McAfee, no solution from support.

[Pat]

Hi,

Thank you for your response. The reason i ask is because we are encountering an issue where a user will be working away and then suddenly their device will bluescreen. There after goes into a bootloop doing the same thing over and over again saying 'no boot device found' and then on to auto repair.

it's as if the disk is being completely corrupted.

15 devices per week. Only solution is to do a reimage of the device.

Detech recovery software is as much use as a chocolate fireguard at this point, as it doesn't even pick up the ssd.

May i ask if you found it troublesome removing the mcafee product and drive encryption over the air to your end users? just out of sheer curiosity

Again, thank you for your response by the way.

Thanks