After encrypting with Full Disk Encryption on an UEFI system, following reboot the system may directly enter Windows Automatic Repair without displaying the DESlock+ pre-boot login.

Symptoms

Certain flawed BIOS implementations can re-order the UEFI boot order without user interaction. Doing so on a system protected by DESlock+ Full Disk Encryption will bypass the pre-boot login preventing the user from entering their Full Disk Encryption password and preventing correct decryption of the disk.

This can result in Windows attempting to boot and entering automatic repair.

If you continue with Automatic Repair, it will be unable to resolve the problem.

Rebooting the PC will again not display the DESlock+ pre-boot login and will repeat the process above.

It is important to let the Automatic Repair complete, even though it will be unable to resolve the problem.

Restarting or turning off the system while the repair is in progress can result in irrecoverable data loss.  

Booting the system correctly

To correctly boot the system you should enter the "UEFI boot menu" and choose the DESlock+ boot menu option. You will need to refer to your hardware documentation for details on entering the UEFI boot menu. The manual may alternatively refer to it as "Boot Option Menu" or some other term.

Once you have found the boot menu, it will display a list of options, similar to the below.

You must choose the DESlock BtMgr option to boot to the DESlock+ login. You can then enter credentials to boot the PC normally.

Resolving the issue

The issue should be resolved with DESlock+ client version 4.7.7 or later.

Until you are able to resolve the issue correctly you may need to go through the process above each time you wish to boot your PC. You should contact your hardware vendor for assistance. It is possible this may be fixed in a later BIOS update to the hardware.

Keywords: EFI, UEFI, GPT, 8.1