9

My problem is how can I find out which device on my laptop is Un-allowed DMA capable. I tried disabling my USB devices and unplugging laptop from docking station. My colleague has same laptop model and he is not having same issue as I do.

System Information

OS Name Microsoft Windows 10 Enterprise
Version 10.0.16299 Build 16299
Other OS Description Not Available
OS Manufacturer Microsoft Corporation
System Name NB-SOKRE
System Manufacturer LENOVO
System Model 20L7S02M00
System Type x64-based PC
System SKU LENOVO_MT_20L7_BU_Think_FM_ThinkPad T480s
Processor Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz, 2112 Mhz, 4 Core(s), 8 Logical Processor(s)
BIOS Version/Date LENOVO N22ET37W (1.14 ), 22.5.2018.
SMBIOS Version 3.0
Embedded Controller Version 1.08
BIOS Mode UEFI
BaseBoard Manufacturer LENOVO
BaseBoard Model Not Available
BaseBoard Name Base Board
Platform Role Mobile
Secure Boot State On
PCR7 Configuration Bound
Windows Directory C:\Windows
System Directory C:\Windows\system32
Boot Device \Device\HarddiskVolume1
Locale United States
Hardware Abstraction Layer Version = "10.0.16299.371"
User Name 3PRO\kkljucaric
Time Zone Central European Daylight Time
Installed Physical Memory (RAM) 16,0 GB
Total Physical Memory 15,8 GB
Available Physical Memory 7,02 GB
Total Virtual Memory 18,2 GB
Available Virtual Memory 5,31 GB
Page File Space 2,38 GB
Page File C:\pagefile.sys
Virtualization-based security Running
Virtualization-based security Required Security Properties Base Virtualization Support, Secure Boot, DMA Protection
Virtualization-based security Available Security Properties Base Virtualization Support, Secure Boot, DMA Protection, Secure Memory Overwrite, UEFI Code Readonly, SMM Security Mitigations 1.0
Virtualization-based security Services Configured Credential Guard
Virtualization-based security Services Running Credential Guard
Windows Defender Device Guard Code Integrity Policy Audit
Windows Defender Device Guard user mode Code Integrity Audit
Device Encryption Support Reasons for failed automatic device encryption: Un-allowed DMA capable bus/device(s) detected
A hypervisor has been detected. Features required for Hyper-V will not be displayed. 
1
  • I have unistalled USB devices and Pci BUS HD ID (ACPI\VEN_PNP&DEV_0A08) restarted PC with no change. Sep 4, 2018 at 9:54

8 Answers 8

11

Turns out that you don't have to use process of elimination to find out which bus to add to the approved list, it's in an event viewer message.

  1. Open Event Viewer.
  2. Choose Applications and Services Logs -> Microsoft -> Windows -> BitLocker-API -> Management. event viewer tree
  3. Look for an "Information" item with Event 4122: it will have text that says something like:
The following DMA (Direct Memory Access) capable devices are not declared as protected from external access, which can block security features such as BitLocker automatic device encryption:


ISA Bridge:
    PCI\VEN_8086&DEV_A30D (Intel(R) 300 Series Chipset Family LPC Controller (HM370) - A30D)

PCI-to-PCI Bridge:
    PCI\VEN_8086&DEV_A334 (Intel(R) PCI Express Root Port #13 - A334)
    PCI\VEN_8086&DEV_A337 (Intel(R) PCI Express Root Port #16 - A337)
    PCI\VEN_8086&DEV_A343 (Intel(R) PCI Express Root Port #20 - A343)
    PCI\VEN_8086&DEV_A330 (Intel(R) PCI Express Root Port #9 - A330)
    PCI\VEN_8086&DEV_1901 (Intel(R) Xeon(R) E3 - 1200/1500 v5/6th Gen Intel(R) Core(TM) PCIe Controller (x16) - 1901)
    PCI\VEN_8086&DEV_A336 (Intel(R) PCI Express Root Port #15 - A336)

Those are the items you would need to add to Approved if they do not create a security vulnerability (e.g. they aren't externally accessible, I think?)

1
  • So i did this and noticed a missing driver. i installed the driver and noticed a bunch of these added to the AllowedBuses. So that cleared up some of them Oct 5, 2022 at 18:13
6

If there are more people trying to solve this.. I was lazy so I created a small PS script which generates .reg file (with all found PCI devices) in tmp directory and then imports it silently.

$tmpfile = "$($env:TEMP)\AllowBuses.reg"
'Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DmaSecurity\AllowedBuses]'`
| Out-File $tmpfile
(Get-PnPDevice -InstanceId PCI* `
| Format-Table -Property FriendlyName,InstanceId -HideTableHeaders -AutoSize `
| Out-String -Width 300).trim() `
-split "`r`n" `
-replace '&SUBSYS.*', '' `
-replace '\s+PCI\\', '"="PCI\\' `
| Foreach-Object{ "{0}{1}{2}" -f '"',$_,'"' } `
| Out-File $tmpfile -Append
regedit /s $tmpfile

From there you can start removing added entries via regedit one by one while refreshing system info page and checking which entry makes it incompatible again.. It is faster than adding entries manually :) For me it was missing entry for "PCI Express Downstream Switch Port"

You might need to change permissions for this key though (add your user or group as owner of the key), since also Microsoft has it in their guide here:

https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-bitlocker

1
  • I actually had to allow 5 devices. After you run the script, or add in the keys manually from Get-PnPDevice -InstanceId PCI* | fl FriendlyName, DeviceID (which is probably better if you don't understand what the script is doing since anyone can edit the answer), the DMA error should be gone and say "Meets prerequisites". Then you need to thin down the list to avoid allowing everything. An easy way to check devices is to copy the CTRL+X (cut) the device ID in regedit and then press OK. Refresh system information. If you get DMA again, paste the ID back in, otherwise delete the key. Sep 5, 2021 at 0:28
5

Microsoft provides this documentation about this message.

Both the blacklist and whitelist are in your registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DmaSecurity. I’m not aware of an automated process to check this, though creating one should be pretty easy.

A typical candidate that exists on most systems is “PCI-to-PCI Bridge”. Curiously, “PCI Express Root Complex” is both in AllowedBuses and UnallowedBuses.

10
  • 1
    How to manage them, and to delete / forbidd them on list of unallowedBuses? Aug 31, 2018 at 14:29
  • You can just edit the registry, I guess? I don’t have the means to test this, sorry.
    – Daniel B
    Sep 3, 2018 at 13:19
  • I have unistalled USB devices and Pci BUS HD ID (ACPI\VEN_PNP&DEV_0A08) restarted PC with no change. Sep 5, 2018 at 12:57
  • USB is unrelated to DMA. Attempting to just uninstall devices will only result in Windows reinstalling them if the hardware is still present.
    – Daniel B
    Sep 5, 2018 at 13:09
  • My attempt was to uninstall devices to find out if it was problem with USB devices drivers or Pci Bus drivers. Sep 6, 2018 at 7:33
4

In my case, the I just needed to white-list my graphics card. Here is the process I followed to do this.

Find the problem device

  1. Open up your computer and physically disconnect all optional devices from your motherboard (eg HDDs, SSDs, PCIe cards)
  2. Start up the computer and run the System Information report again to see if the error has disappeared
  3. If the error is still present, then my instructions probably won't help you
  4. If the error is absent, add just one of the devices you removed
  5. Repeat from step 2

Eventually you may find that re-adding one particular device causes the error to appear. Make note of which device it is.

Check if it has external DMA

See BitLocker drive encryption in Windows 10 for OEMs to determine whether your device has external DMA. If it does, then proceed at your own risk. Otherwise, you're ok to proceed.

Get the device ids

  1. Open Device Manager

  2. Find the device

  3. Double-click it

  4. Go to Details tab

  5. Set Property to Parent

  6. Copy the value

    Identify the device using Device Manager

White-list the device

  1. Open Regedit
  2. Navigate to Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DmaSecurity\AllowedBuses
  3. Grant yourself access to modify the registry key
    1. Right-click AllowedBuses and go to Permissions
    2. Make yourself the owner
      1. Press Advanced
      2. Next to Owner, make note of what it says (mine said SYSTEM)
      3. Next to Owner, press Change
      4. Enter your username (eg your Microsoft account email address)
      5. Press OK
    3. Grant yourself access
      1. Press Add
      2. Enter your username (eg your Microsoft account email address)
      3. Press OK
      4. Select your user
      5. Tick Full Control
      6. Press OK
  4. Under AllowedBuses, create a new String Value
    1. Set its name to something that easily identifies the device, such as NVIDIA GeForce GTX 1050
    2. Paste in the value you copied from Device Manager, but strip off everything after PCI\VEN_####&DEV_#### Regedit showing the device added to AllowedBuses
  5. Restart your computer
  6. Run System Information
  7. Confirm that the error is now gone
  8. Go back into the registry and undo the permission changes you made
2
  • 1
    How come you whitelist the GPU parent ID and not the GPU's ID? I think the GPU parent is the PCIe controller. Is it so that you can upgrade your GPU without whitelisting the new GPU each time? Is it less secure to be whitelisting the controller instead of the GPU? Sep 4, 2021 at 22:31
  • @dosentmatter, from trial and error, only adding the parent ID worked for me
    – Sam
    Jan 29, 2022 at 1:28
2

There is another reason for seeing this "Un-allowed DMA capable bus/device(s) detected" message, as observed on my Windows 10 system: using a different boot manager.

Long story short, I found an extra 27GB drive on my Dell laptop which seemed unused so I installed Ubuntu there. But I had to disable encryption on the C drive first. When the install was done, and I booted into Windows from grub boot manager, the "Device encryption" option was gone from System > Updates and Security. The solution was to go into BIOS and select Windows Boot which bypasses grub and the option showed up again, allowing me to re-encrypt the drive. As expected, my Windows mount in Ubuntu was no longer visible.

For what it's worth, the reason I did this was because I wanted a Linux development system to overcome the limitations of WSL. The lack of an official Linux client for my cloud drive on Linux which was my plan for sharing data between Windows and Linux, made the dual boot a less desirable option.

What I have now is a light Ubuntu server installed in a VirtualBox VM. I start it in headless mode, which allows me to close VirtualBox so it doesn't take up space on the taskbar, it's like it's not even there, except when the CPU usage spikes and the fans get busy, but this was fixed by lowering the Execution Cap in the VM settings. Then I SSH into it directly from PowerShell, no WSL needed. The beauty of it is that I can give it a bridged adapter so that DHCP assigns it a dedicated IP address, which conveniently lets me access the web server on docker, without the limitations and issues I've seen on WSL. Also, I can mount the cloud drive folder in the VM and access all the files. Took me a while to settle on a development environment with the best of Linux and Windows 10 so I hope this is helpful.

I still have my physical Ubuntu machine with grub dual-boot but I changed the BIOS setting so it goes first to Windows Boot Manager and therefore straight to Windows. I like the assurance of seeing the encryption settings there telling me that encryption is ON.

1
  • 1
    That was my problem as well. Thanks for pointing it out.
    – Alessandro
    Nov 6, 2023 at 16:28
1

For me, removing

"ISA Bridge" and "PCI to PCI Bridge"

from

[Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DmaSecurity\Default\UnallowedBuses]

fixed it on a Lenovo L15 20U8.

0

I was able to resolve this error message found in the Event Viewer:

The following DMA (Direct Memory Access) capable devices are not declared as protected from external access, which can block security features such as BitLocker automatic device encryption:

ISA Bridge: PCI\VEN_8086&DEV_068E (Intel(R) LPC Controller (WM490) - 068E)

PCI-to-PCI Bridge: PCI\VEN_8086&DEV_06BD (Intel(R) PCI Express Root Port #6 - 06BD) PCI\VEN_8086&DEV_06AC (Intel(R) PCI Express Root Port #21 - 06AC) PCI\VEN_8086&DEV_06C0 (Intel(R) PCI Express Root Port #17 - 06C0) PCI\VEN_8086&DEV_15EA (PCI Express Downstream Switch Port) PCI\VEN_8086&DEV_15EA (PCI Express Downstream Switch Port) PCI\VEN_8086&DEV_15EA (PCI Express Downstream Switch Port) PCI\VEN_8086&DEV_15EA (PCI Express Downstream Switch Port) PCI\VEN_8086&DEV_15EA (PCI Express Upstream Switch Port) PCI\VEN_8086&DEV_1901 (Intel(R) PCIe Controller (x16) - 1901) PCI\VEN_8086&DEV_06B8 (Intel(R) PCI Express Root Port #1 - 06B8)

by entering BIOS and turning off "Fast Boot" and then it worked. I was doing this on an HP ZBook Fury 15 G7 Mobile Workstation.

1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Jun 26, 2023 at 17:03
0

I know this is older, but I've created a script that will parse the event log and only add the required DMA hardware IDs to the allowed list if anyone needs it.

#Get message
$message = get-winevent -LogName 'Microsoft-Windows-BitLocker/BitLocker Management' | where {$_.ID -eq 4122} | select -first 1

#Take .Message. Split on Carriage Return to return line-by-line
$messageSplit = $message.Message.split("`r")

$results = @()

#For loop dynamicaly set to length of $messageSplit
for ($i = 0; $i -le $messageSplit.Length; $i++) {
IF($messageSplit[$i] -match 'PCI\\VEN'){

    $results += $messageSplit[$i].Split("(")[0].trim()
    }
}

foreach($r in $results)
{
    New-ItemProperty -PropertyType string -Path HKLM:\system\CurrentControlSet\Control\DmaSecurity\AllowedBuses -Name $r -Value $r
}

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .