Un-allowed DMA capable bus/device(s) detected

Question

My problem is how can I find out which device on my laptop is Un-allowed DMA capable. I tried disabling my USB devices and unplugging laptop from docking station. My colleague has same laptop model and he is not having same issue as I do.

System Information

OS Name Microsoft Windows 10 Enterprise
Version 10.0.16299 Build 16299
Other OS Description Not Available
OS Manufacturer Microsoft Corporation
System Name NB-SOKRE
System Manufacturer LENOVO
System Model 20L7S02M00
System Type x64-based PC
System SKU LENOVO_MT_20L7_BU_Think_FM_ThinkPad T480s
Processor Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz, 2112 Mhz, 4 Core(s), 8 Logical Processor(s)
BIOS Version/Date LENOVO N22ET37W (1.14 ), 22.5.2018.
SMBIOS Version 3.0
Embedded Controller Version 1.08
BIOS Mode UEFI
BaseBoard Manufacturer LENOVO
BaseBoard Model Not Available
BaseBoard Name Base Board
Platform Role Mobile
Secure Boot State On
PCR7 Configuration Bound
Windows Directory C:\Windows
System Directory C:\Windows\system32
Boot Device \Device\HarddiskVolume1
Locale United States
Hardware Abstraction Layer Version = "10.0.16299.371"
User Name 3PRO\kkljucaric
Time Zone Central European Daylight Time
Installed Physical Memory (RAM) 16,0 GB
Total Physical Memory 15,8 GB
Available Physical Memory 7,02 GB
Total Virtual Memory 18,2 GB
Available Virtual Memory 5,31 GB
Page File Space 2,38 GB
Page File C:\pagefile.sys
Virtualization-based security Running
Virtualization-based security Required Security Properties Base Virtualization Support, Secure Boot, DMA Protection
Virtualization-based security Available Security Properties Base Virtualization Support, Secure Boot, DMA Protection, Secure Memory Overwrite, UEFI Code Readonly, SMM Security Mitigations 1.0
Virtualization-based security Services Configured Credential Guard
Virtualization-based security Services Running Credential Guard
Windows Defender Device Guard Code Integrity Policy Audit
Windows Defender Device Guard user mode Code Integrity Audit
Device Encryption Support Reasons for failed automatic device encryption: Un-allowed DMA capable bus/device(s) detected
A hypervisor has been detected. Features required for Hyper-V will not be displayed. 

Answer 1

Turns out that you don't have to use process of elimination to find out which bus to add to the approved list, it's in an event viewer message.

1. Open Event Viewer.
2. Choose Applications and Services Logs -> Microsoft -> Windows -> BitLocker-API -> Management.
3. Look for an "Information" item with Event 4122: it will have text that says something like:

The following DMA (Direct Memory Access) capable devices are not declared as protected from external access, which can block security features such as BitLocker automatic device encryption:


ISA Bridge:
    PCI\VEN_8086&DEV_A30D (Intel(R) 300 Series Chipset Family LPC Controller (HM370) - A30D)

PCI-to-PCI Bridge:
    PCI\VEN_8086&DEV_A334 (Intel(R) PCI Express Root Port #13 - A334)
    PCI\VEN_8086&DEV_A337 (Intel(R) PCI Express Root Port #16 - A337)
    PCI\VEN_8086&DEV_A343 (Intel(R) PCI Express Root Port #20 - A343)
    PCI\VEN_8086&DEV_A330 (Intel(R) PCI Express Root Port #9 - A330)
    PCI\VEN_8086&DEV_1901 (Intel(R) Xeon(R) E3 - 1200/1500 v5/6th Gen Intel(R) Core(TM) PCIe Controller (x16) - 1901)
    PCI\VEN_8086&DEV_A336 (Intel(R) PCI Express Root Port #15 - A336)

Those are the items you would need to add to Approved if they do not create a security vulnerability (e.g. they aren't externally accessible, I think?)

Answer 2

If there are more people trying to solve this.. I was lazy so I created a small PS script which generates .reg file (with all found PCI devices) in tmp directory and then imports it silently.

$tmpfile = "$($env:TEMP)\AllowBuses.reg"
'Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DmaSecurity\AllowedBuses]'`
| Out-File $tmpfile
(Get-PnPDevice -InstanceId PCI* `
| Format-Table -Property FriendlyName,InstanceId -HideTableHeaders -AutoSize `
| Out-String -Width 300).trim() `
-split "`r`n" `
-replace '&SUBSYS.*', '' `
-replace '\s+PCI\\', '"="PCI\\' `
| Foreach-Object{ "{0}{1}{2}" -f '"',$_,'"' } `
| Out-File $tmpfile -Append
regedit /s $tmpfile

From there you can start removing added entries via regedit one by one while refreshing system info page and checking which entry makes it incompatible again.. It is faster than adding entries manually :) For me it was missing entry for "PCI Express Downstream Switch Port"

You might need to change permissions for this key though (add your user or group as owner of the key), since also Microsoft has it in their guide here:

https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-bitlocker

Answer 3

Microsoft provides this documentation about this message.

Both the blacklist and whitelist are in your registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DmaSecurity. I’m not aware of an automated process to check this, though creating one should be pretty easy.

A typical candidate that exists on most systems is “PCI-to-PCI Bridge”. Curiously, “PCI Express Root Complex” is both in AllowedBuses and UnallowedBuses.

Answer 4

In my case, the I just needed to white-list my graphics card. Here is the process I followed to do this.

Find the problem device

1. Open up your computer and physically disconnect all optional devices from your motherboard (eg HDDs, SSDs, PCIe cards)
2. Start up the computer and run the System Information report again to see if the error has disappeared
3. If the error is still present, then my instructions probably won't help you
4. If the error is absent, add just one of the devices you removed
5. Repeat from step 2

Eventually you may find that re-adding one particular device causes the error to appear. Make note of which device it is.

Check if it has external DMA

See BitLocker drive encryption in Windows 10 for OEMs to determine whether your device has external DMA. If it does, then proceed at your own risk. Otherwise, you're ok to proceed.

Get the device ids

1. Open Device Manager

2. Find the device

3. Double-click it

4. Go to Details tab

5. Set Property to Parent

6. Copy the value

   

White-list the device

1. Open Regedit
2. Navigate to Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DmaSecurity\AllowedBuses
3. Grant yourself access to modify the registry key
   1. Right-click AllowedBuses and go to Permissions
   2. Make yourself the owner
      1. Press Advanced
      2. Next to Owner, make note of what it says (mine said SYSTEM)
      3. Next to Owner, press Change
      4. Enter your username (eg your Microsoft account email address)
      5. Press OK
   3. Grant yourself access
      1. Press Add
      2. Enter your username (eg your Microsoft account email address)
      3. Press OK
      4. Select your user
      5. Tick Full Control
      6. Press OK
4. Under AllowedBuses, create a new String Value
   1. Set its name to something that easily identifies the device, such as NVIDIA GeForce GTX 1050
   2. Paste in the value you copied from Device Manager, but strip off everything after PCI\VEN_####&DEV_####
5. Restart your computer
6. Run System Information
7. Confirm that the error is now gone
8. Go back into the registry and undo the permission changes you made

Answer 5

There is another reason for seeing this "Un-allowed DMA capable bus/device(s) detected" message, as observed on my Windows 10 system: using a different boot manager.

Long story short, I found an extra 27GB drive on my Dell laptop which seemed unused so I installed Ubuntu there. But I had to disable encryption on the C drive first. When the install was done, and I booted into Windows from grub boot manager, the "Device encryption" option was gone from System > Updates and Security. The solution was to go into BIOS and select Windows Boot which bypasses grub and the option showed up again, allowing me to re-encrypt the drive. As expected, my Windows mount in Ubuntu was no longer visible.

For what it's worth, the reason I did this was because I wanted a Linux development system to overcome the limitations of WSL. The lack of an official Linux client for my cloud drive on Linux which was my plan for sharing data between Windows and Linux, made the dual boot a less desirable option.

What I have now is a light Ubuntu server installed in a VirtualBox VM. I start it in headless mode, which allows me to close VirtualBox so it doesn't take up space on the taskbar, it's like it's not even there, except when the CPU usage spikes and the fans get busy, but this was fixed by lowering the Execution Cap in the VM settings. Then I SSH into it directly from PowerShell, no WSL needed. The beauty of it is that I can give it a bridged adapter so that DHCP assigns it a dedicated IP address, which conveniently lets me access the web server on docker, without the limitations and issues I've seen on WSL. Also, I can mount the cloud drive folder in the VM and access all the files. Took me a while to settle on a development environment with the best of Linux and Windows 10 so I hope this is helpful.

I still have my physical Ubuntu machine with grub dual-boot but I changed the BIOS setting so it goes first to Windows Boot Manager and therefore straight to Windows. I like the assurance of seeing the encryption settings there telling me that encryption is ON.

Answer 6

For me, removing

"ISA Bridge" and "PCI to PCI Bridge"

from

[Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DmaSecurity\Default\UnallowedBuses]

fixed it on a Lenovo L15 20U8.

Answer 7

I was able to resolve this error message found in the Event Viewer:

The following DMA (Direct Memory Access) capable devices are not declared as protected from external access, which can block security features such as BitLocker automatic device encryption:

ISA Bridge: PCI\VEN_8086&DEV_068E (Intel(R) LPC Controller (WM490) - 068E)

PCI-to-PCI Bridge: PCI\VEN_8086&DEV_06BD (Intel(R) PCI Express Root Port #6 - 06BD) PCI\VEN_8086&DEV_06AC (Intel(R) PCI Express Root Port #21 - 06AC) PCI\VEN_8086&DEV_06C0 (Intel(R) PCI Express Root Port #17 - 06C0) PCI\VEN_8086&DEV_15EA (PCI Express Downstream Switch Port) PCI\VEN_8086&DEV_15EA (PCI Express Downstream Switch Port) PCI\VEN_8086&DEV_15EA (PCI Express Downstream Switch Port) PCI\VEN_8086&DEV_15EA (PCI Express Downstream Switch Port) PCI\VEN_8086&DEV_15EA (PCI Express Upstream Switch Port) PCI\VEN_8086&DEV_1901 (Intel(R) PCIe Controller (x16) - 1901) PCI\VEN_8086&DEV_06B8 (Intel(R) PCI Express Root Port #1 - 06B8)

by entering BIOS and turning off "Fast Boot" and then it worked. I was doing this on an HP ZBook Fury 15 G7 Mobile Workstation.

Answer 8

I know this is older, but I've created a script that will parse the event log and only add the required DMA hardware IDs to the allowed list if anyone needs it.

#Get message
$message = get-winevent -LogName 'Microsoft-Windows-BitLocker/BitLocker Management' | where {$_.ID -eq 4122} | select -first 1

#Take .Message. Split on Carriage Return to return line-by-line
$messageSplit = $message.Message.split("`r")

$results = @()

#For loop dynamicaly set to length of $messageSplit
for ($i = 0; $i -le $messageSplit.Length; $i++) {
IF($messageSplit[$i] -match 'PCI\\VEN'){

    $results += $messageSplit[$i].Split("(")[0].trim()
    }
}

foreach($r in $results)
{
    New-ItemProperty -PropertyType string -Path HKLM:\system\CurrentControlSet\Control\DmaSecurity\AllowedBuses -Name $r -Value $r
}