3

I would like to configure hibernation of my Windows 10 OS on my desktop, but I also encrypted my system with BitLocker.

The problem is, when I put my PC into hibernate mode and return from it, I want to login into the BitLocker login screen, but instead it goes immediately to my OS. That's not what I want. I would like to put my PC into hibernation mode and when it returns, it returns first into the Bitlocker login screen.

I've read a few things, but I could not find the solution, which is why I ask this question. What struck me was that it is possible, but those people often had a TPM. Could it be that because I do not have a TPM, that this is not possible?

Hopefully it is possible and if so, how?

1
  • What you want isn't possible. I don't believe any of the sleep states would get what you want honestly. Even if you had a TPM, you wouldn't get the Bitlocker screen again, unless you shutdown your computer.
    – Ramhound
    Sep 3, 2016 at 18:45

2 Answers 2

1

The important bit here is that hibernation is both a software state and a hardware state.

Software Hibernation

When you press the Hibernate button in Windows it saves the contents of RAM to disk so that it can recover from a power loss. Then it tells the hardware to enter state "S4" which is a low power mode that isn't really off.

Hardware Hibernation

Your motherboard likely has states S0-S5 with S0 being the "ON" state and S5 being the "OFF" state. When it receives the command to enter S4 it doesn't really power off. On power up it is able to skip the BIOS and may also skip features that you want, like BitLocker.

What you are asking for

It sounds like you want to use the software Hibernation features and then put the Hardware in to S5, full power off. Then you want to do the whole boot sequence, including BitLocker, but then rapidly resume your Windows session.

Possible solutions

  1. To do this you could physically cut power to the system after it enters the Hibernation state. You would do this by flipping the switch on the PSU for a desktop or pulling the battery on a laptop.
  2. Hypothetically, to do this automatically you would need the ability to shut off state S4 in your BIOS. This would need to be a feature on your motherboard. Go in there and look around. You want to disable S4 Hibernation or otherwise force mode S5 when S4 is called. That may or may not be a feature of your BIOS.

My Solution

Disable hibernation with:

powercfg.exe -h off

This way your computer is either in sleep mode, with quick recovery. Or it is fully off. It will never again be in a state where it appears to be off but is actually unencrypted. You must use full shutdown every time you want to encrypt your data at rest.

0

A possible work around is to Lock the screen (window key - L) and then hibernate. This necessitates coupling hibernate to say closing the laptop.

Veracrypt does have the functionality, if I remember, but it cannot encrypt the entire drive which holds the system paritions. It only can encrypt the partion. Secondary paritions must be encrypted separately and that is quirky.

The abo e is only true for GPT disks. MBR ows for encrption of the entire drive.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .