Jump to content

Workstation ID changes on computers installed with Full Disk Encryption (FDE). Password Recovery unavailable.


Chelopher
 Share

Recommended Posts

Hi Team,

We're experiencing a very strange problem with some of our laptops that are installed with FDE.

I should start by saying that these computers are brand new and they're being encrypted with FDE for the first time. The instalaltion and encryption process happens smoothly, as per AIS logs info a workstation ID is assigned correctly to the computer (that assigned workstation Id matches with the one listed for the computer in question on ESET Protect Console) and final user is able to setup his/her password.  During boot up, owners are shown with FDE credentials black screen so they enter their password and everything works as expected at that point.  Problems start to come up 48 hours later of the initial FDE setup, all of a sudden, owners report that their FDE password is not alonger ccepted and when we try to do a recovery via Console  we realize that the worksation ID listed at the bottom of the FDE credential screen does not match with the one listed in the console for that computer. If we search on console using the new Workstation ID (the one listed on the client's FDE black screen) no computer associated to it can be found. The discrepancy between workstation ID invalids all the recovery options available forcing the O.S  to be wiped out.

We've faced this problem around 5 times particularly with HP laptop model Laptop 15-dw3xxx, any ideas about what could be causing this?

Thanks in advanced.

 

 

Initial WKSID on console.png

Initial WKSID on logs.jpg

New WKSID on FDE Screen.jpg

Link to comment
Share on other sites

  • ESET Staff

Hi @Chelopher,

May I request you report this issue to your local ESET Support Office via the following link: https://www.eset.com/int/support/contact/

Please include a copy of the following logs: https://support.eset.com/en/kb7894-eset-encryption-recovery-utility-diagnostics#SearchForMeta along with all the other details you have provided. This will require more investigation than we are able to provide over the forum.

Also, please provide the version of ESET Full Disk Encryption that you use.

Thank you,

Kieran

Edited by Kstainton
Link to comment
Share on other sites

Hi Kstainton,

We contacted them since last week.

Here's the log you requested:

 

14/10/2022-15:53:50 : Please select process to perform: 14/10/2022-15:53:58 : 1 14/10/2022-15:53:58 : Error flag set. (A00) 14/10/2022-15:53:58 : 14/10/2022-15:53:58 : Master Disk is missing data. 14/10/2022-15:53:58 : 14/10/2022-15:53:59 : System Data block 14/10/2022-15:53:59 : 14/10/2022-15:53:59 : 14/10/2022-15:53:59 : Decryption process can not begin. 14/10/2022-15:53:59 : ************** 14/10/2022-15:53:59 : ERROR 14/10/2022-15:53:59 : ************** 14/10/2022-15:53:59 : 14/10/2022-15:53:59 : Please contact support, providing the information above (0x8) 14/10/2022-15:53:59 : ************** 14/10/2022-15:54:02 : 14/10/2022-15:54:02 : --------------------------------------------------

That is happening with all of them.

 

Enumeration.jpg

Link to comment
Share on other sites

  • ESET Staff

Hi @Chelopher,

Do you have a Case Number or Contact Name? I will get in touch with them to escalate this to the correct team to handle this case for you properly as we will need to investigate this with the Developers of the product.

However, in regards to the issue you have just shown me.

What happens if you change the BIOS Disk Mode / SATA Mode from RAID to AHCI, does this allow the disks to enumerate using the ESET Recovery Utility?

If that option does not exist, or it is already set to AHCI, what happens if you setup the ESET Recovery Utility USB using the EFI USB option instead of the WIN RE option? Does it allow the disks to enumerate?

Thank you,

Kieran

Edited by Kstainton
Link to comment
Share on other sites

Hi Kstainton,

This is what they provided to us:

[Ticket#1139121] - Sesión Rescue ID: 967123251.

We saw the steps you mentioned on a Forum however, this particular model does not have that option so we will experiment setting the recovery to EFI USB and let you know.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...