Device Encryption Not Available in Settings

Ben Baker 0 Reputation points
2026-09-15T14:51:22.1133333+00:00

Hello there,
I'm trying to ensure Device Encryption is turned on for a work project. But the Settings option is not available at all.
I did some digging on my own to solve this, but hit a roadblock. This is what my system information says:

PCR7 Configuration Binding Not Possible

Automatic Device Encryption Support Reasons for failed automatic device encryption: PCR7 binding is not supported, Hardware Security Test Interface failed and device is not Modern Standby, Un-allowed DMA capable bus/device(s) detected

Relevant Details:
OS Name Microsoft Windows 11 Home

Version 10.0.26200 Build 26200

BIOS Version/Date LENOVO H1CN58WW, 4/11/2024

Secure Boot State On

Kernel DMA Protection On

BIOS Mode UEFI

Any ideas why Device Encryption is not available as an option? Is it possible my computer is simply too old to support this? If there's no resolution for Home, is it possible that upgrading to Pro and getting Bitlocker would solve this?

I would appreciate any help.

Windows for home | Windows 11 | Security and privacy
0 comments

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-09-15T14:51:41.7166667+00:00

    On Windows 11 Home, the missing Device encryption setting usually means the device doesn’t qualify for automatic device encryption, or the edition doesn’t expose full BitLocker management in the way Pro does.

    Based on the details provided:

    1. PCR7 Configuration = Binding Not Possible does not by itself mean BitLocker is unusable. Windows documents that BitLocker remains secure even when it uses PCR profile 0, 2, 4, 11 instead of 7, 11.
    2. The older automatic device encryption blockers shown in msinfo32 were:
      • HSTI failed / not Modern Standby
      • Un-allowed DMA capable bus/device(s) detected
    3. Starting with Windows 11 version 24H2, the DMA and HSTI/Modern Standby prerequisites for device encryption were removed. That means those two messages are no longer supposed to be blockers for automatic or manual device encryption on supported Windows 11 devices.
    4. Since Secure Boot = On, Kernel DMA Protection = On, and BIOS Mode = UEFI, the remaining issue is more likely that the device either:
      • doesn’t expose device encryption on this Home installation, or
      • doesn’t meet another requirement such as a usable TPM.

    A practical check is:

    1. Open tpm.msc as administrator.
    2. Confirm whether a TPM is present and whether the status says The TPM is ready for use.
    3. Confirm the Specification Version.

    This matters because TPM is required for silent and automatic encryption.

    About the age of the computer: the age alone is not the deciding factor. The deciding factors in the provided documentation are TPM availability/usability, UEFI/Secure Boot, and whether the device qualifies for device encryption.

    About upgrading to Pro:

    • Windows Home doesn’t show BitLocker Drive Encryption in Control Panel.
    • Upgrading to Pro can give access to standard BitLocker features even if the simplified Device encryption toggle is missing.
    • Also, Windows notes that organizations can disable device encryption in favor of a full BitLocker implementation because BitLocker provides more granular control.

    So for a work project, upgrading to Pro is the more reliable path if full BitLocker management is required.

    One important limitation: if Device encryption was turned off previously, Windows states it won’t automatically enable itself again later; it must be enabled manually in Settings. If the setting is completely absent, that manual path is not available on the current setup.

    If the goal is simply to understand why the toggle is missing on this Home device, the next supported check is TPM status in tpm.msc. If the goal is to guarantee encryption for work, Windows 11 Pro with BitLocker is the clearer solution.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. DaveM121 933.1K Reputation points Independent Advisor
    2026-09-15T15:26:23.8033333+00:00

    1

    The requirements for Device Encryption is Secure Boot and Secure Boot is enabled in your BIOS, that may not be enabled.

    Click your Start Button, then just type msinfo and press Enter, please provide a screenshot of the resulting System Information window.

    2

    Also, right click your Start Button and open Disk Management.

    Please provide a screenshot of that window showing the system drive in the bottom pane.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.