Monday, March 24, 2014

BitLocker Pre-Provisioning: The operating system reported error 255: The extended attributes are inconsistent.

 The operating system reported error 255: The extended attributes are inconsistent. - error message appears in SCCM 2012 log during BitLocker Preprovisiong to Windows 7 machine.




Here is the explanation from MS for BitLocker Pre-Provisioning:

The Pre-provision BitLocker task sequence step in Microsoft System Center 2012 Configuration Manager allows you to enable BitLocker from the Windows Preinstallation Environment (Windows PE) prior to operating system deployment. Only the used drive space is encrypted, and therefore, encryption times are much faster. This is done with a randomly generated clear protector applied to the formatted volume and encrypting the volume prior to running the Windows setup process. The ability to pre-provision BitLocker was introduced with Windows 8 and Windows Server 2012. However, you can pre-provision BitLocker on a hard drive and install Windows 7 as long as you follow specific steps. After Windows 7 Setup completes, you must set a BitLocker key protector because the Windows 7 BitLocker control panel does not support BitLocker with a clear protector. You must add a key protector by using the Enable BitLocker step or by using the manage-bde.exe command-line tool.
________________________________________________________________________________
The scenario is to have C: and D: partitions on Windows 7 machine and both partitions to be BitLocker encrypted.
BitLocker Pre-Provisioning TS embeded components for C: and D: are applied in WinPE, before Image applying. That means both drives are pre-provisioned, only the used drive space is encrypted.
To the end of TS, regular BitLocker TS embeded components for C: and D: are applied in Windows mode and Recovery passwords are updated to the computer object in AD.  



Checking the SCCM Logs show this specified error:  The operating system reported error 255: The extended attributes are inconsistent for C: partition (on the first picture in this article)

Encryption of D: is without an error message. (the picture below:)



In order to avoid this specified error, Pre-Provisioning of D: should be removed and only C: drive should be Pre-Provisioned. D: drive should be encrypted using regular BitLocker TS embeded component.



The error  The operating system reported error 255: The extended attributes are inconsistent. appear because during D: partition BitLocker Pre-Provisioning, TPM is again reinitialized and proper attributes are created. Now, when the regular BitLocker TS embeded component for C: to the end of TS should close Pre-Provisioning encryption, it finds attributes related to D: drive but not to C: which should suppose to get and for that reason we get this error. 


2 comments: