Zenbook Pro 14 6404 (bitlocker activates)

[tdj88]

Rules

• I made myself familiar with the Readme, FAQ and Troubleshooting.
• I understand that, if insufficient information or no app logs will be provided, my issue will be closed without an answer.

What's wrong?

When switching from Standard to Ultimate, the system kicks on bitlocker, and you have to enter a key to unlock it and also lose the windows hello login settings

How to reproduce the bug?

Switch from standard to Ultimate in Ghelper and reboot

Logs

don't have any right now, but I can get logs just takes time repeat it.

Device and Model

Asus Zenbook Pro 14 OLED 6404VI

Additional information.

Here is a screen shot of what MyAsus does to resolve that issue.

Armoury Crate

Uninstalled

Asus Services

6

Version

164

OS

Win 11

[seerge]

@tdj88 hello, what exactly do you expect G-Helper to do in this situation ? :)
It's some crazy (or probably just bugged) implementation of a mux switch on a bios-level from Asus.

I would just suggest to turn OFF Bitlocker completely if it enables like that.

On all other devices MUX is not related to Bitlocker anyhow :)

[tdj88]

I'll address both questions.

1.) It could send a script command that does the same thing My Asus does to suspend it and re-enable it on reboot. (possible toggle maybe) While turning it off is one fix having BitLocker would be ideal. I'll ask this: Is security not essential?

to your second statement

MUX has had a direct impact on bit lock and windows hello setting. I provided examples of people having this issue.

https://answers.microsoft.com/en-us/windows/forum/all/windows-hello-resets-every-time-i-use-mux-option/93e54f0f-f2ae-4af2-8f39-3b77b4dda90f

https://www.reddit.com/r/GamingLaptops/comments/13ipt90/windows_11_mux_switch_issue/

[seerge]

@tdj88 I honestly don't want to force G-Helper disabling Bitlocker. Also Bitlocker disabling is not instant. Windows will take a lot of time to decrypt drive even after turning it off.

People already accuse G-Helper in all possible sins in the world (that has nothing to do with the app in a first place). If it will be disabling bitlocker for someone, it will give another reason for accusations :)

As for MUX switch triggering bitlocker. I used like 4 different Asus laptops with Ultimate mode, and not a single one had this issue. So I assume it's quite narrow / specific for 6404VI model ?

[tdj88]

I would not recommend forcing Ghelper to disable BitLocker. That does take a while, but I recommend doing what MY ASUS does is suspend it till reboot.
Here is a link explaining it
https://www.windowscentral.com/how-suspend-bitlocker-encryption-perform-system-changes-windows-10

I have researched this, and it's on multiple device brands, not just ASUS.

Is BitLocker enabled on those devices as well?

[seerge]

@tdj88 From what I read it can be suspended for fixed amount of reboots (presumably 1). What if user reboots more than once ? they will face same problem. And G-Helper can't monitor system reboots, as it's not a service and is not guaranteed to be running.

All ROG / TUF series are not affected by this issue, as otherwise someone would notice that before.

I would just turn off bitlocker completely, and call it a day honestly.

[seerge]

By the way, i'm getting

Suspend-BitLocker -MountPoint "C:" -RebootCount 0
Suspend-BitLocker : This version of Windows does not support this feature of BitLocker Drive Encryption. To use this
feature, upgrade the operating system.

So it's probably relevant only for Windows 11 Pro ...

[tdj88]

This is what I got and I'm running Home

PS C:\Users\young> Suspend-BitLocker -MountPoint "C:" -RebootCount 0


   ComputerName: ZENTIGER

VolumeType      Mount CapacityGB VolumeStatus           Encryption KeyProtector              AutoUnlock Protection
                Point                                   Percentage                           Enabled    Status
----------      ----- ---------- ------------           ---------- ------------              ---------- ----------
OperatingSystem C:        951.78 FullyEncrypted         100        {RecoveryPassword, Tpm}              Off``

[tdj88]

I also just ran it in tandem with Ghelper and didn't get my drive locked, so it works. But I won't push it any further; if it happens to others, you at least have a solution in the future that you'll be able to refer back to.

[EChDatAnyl]

This the reason why the Vivobook Pro 15 OLED (2024) N6506MV model bricked as screen refusal when set on Ultimate. Should have stick to standard or eco mode. Have to deal with the clean install.

[seerge]

@EChDatAnyl you don't really had to do clean install

• You can also change Standard / Ultimate in BIOS (F2 on boot -> Advanced Settings). It's called "Display Mode" or something like that.
• Or you can do a hard reset (press and hold power button for 40 seconds). It also usually rests it.

But in general, isn't it easier to just disable bitlocker at all in a first place ?

[EChDatAnyl]

@EChDatAnyl you don't really had to do clean install

• You can also change Standard / Ultimate in BIOS (F2 on boot -> Advanced Settings). It's called "Display Mode" or something like that.
• Or you can do a hard reset (press and hold power button for 40 seconds). It also usually rests it.

But in general, isn't it easier to just disable bitlocker at all in a first place ?

Actually never mind. I did found this video to completely disable BitLocker. https://www.youtube.com/watch?v=9HkzC_IZqLc

Now the Ultimate mode can be used without bricking my laptop. This would be helpful as the first thing to completely disable BitLocker in the first place.

[seerge]

@EChDatAnyl you can just disable bitlocker in a windows settings prior to anything :)

[tuhlaajapoika]

Note that I have an older Asus G14 which doesn't have a MUX switch so I can't test anything myself.

I've been tinkering with Secure Boot, Bitlocker and TPM on both my desktop PC and Asus G14 lately and I'm wondering if Bitlocker TPM protector is tied to certain TPM PCR values that trigger when changes are made to firmware etc, hence Bitlocker asking Recovery Key or MyAsus showing the warning message.

Those who have issues, what value does "PCR Validation Profile" have for TPM protector? You can output the value in elevated PowerShell for system volume: manage-bde -protectors -get C:? It should output something like PCR Validation Profile: 7, 11. PCRs 7 and 11 measure UEFI Secure Boot state and boot which shouldn't trigger anything.

edit. Here's a link to Microsoft Documentation for those who are interested.

[tuhlaajapoika]

Okay, so. I checked my friend's newly bought Asus TUF A15. Bitlocker is tied to PCRs 7 and 11 as it should be. Armoury Crate asked to temporary suspend Bitlocker nevertheless. Seems like a hacky way to switch the GPU.

[seerge]

@tuhlaajapoika what is specific model name of that TUF A15 ? Cause so far I haven't seen a single ROG / TUF device that would require disabling bitlocker (or entering MS account password on login otherwise) when using Ultimate mode.

[tuhlaajapoika]

@seerge The model is TUF A15 FA507NV-HQ172 with Ryzen 5 7535HS, RTX 4060 and the MUX switch. It's a Nordic variation, I think.

Did I understand correctly that suspending/temporarily disabling Bitlocker shouldn't be necessary even though Armoury Crate suggests it when switching to Ultimate mode? My friend didn't have the recovery key nor did Microsoft's website work yesterday, so we couldn't check if the key was backed up or not. It was safer to just accept the temporary option.