B550-A Pro PCR7 Configuration Binding Not Possible

M

m0j0144

New member
Joined
May 12, 2026
Messages
5
Windows 11 cannot enable automatic device encryption, and Ubuntu 26 cannot be installed using hardware based encryption. BIOS has been updated to the latest version 7C56vAL1(Beta version). Here is some relevant information from System Information:

OS Name Microsoft Windows 11 Home
Version 10.0.26200 Build 26200
System Model MS-7C56
BIOS Version/Date American Megatrends International, LLC. A.L1, 9/19/2025
BIOS Mode UEFI
Secure Boot State On
PCR7 Configuration Binding Not Possible
Virtualization-based security Running
Automatic Device Encryption Support Reasons for failed automatic device encryption: PCR7 binding is not supported, Hardware Security Test Interface failed and device is not Modern Standby, Un-allowed DMA capable bus/device(s) detected
Click to expand...

Windows Security indicates all requirements are met for enhanced hardware security, and all features are active except Device Encryption is missing entirely.
Clearing TPM, resetting factory defaults, and reinstalling Windows did not resolve the issue.
Attached file includes data from BitLocker-API Management events:
BitLocker determined that the TCG log is invalid for use of Secure Boot. The filtered TCG log for PCR[7] is included in this event.
Click to expand...
 

Attachments

  • evtid893.xml
    18.4 KB · Views: 31
Sort by date Sort by votes
m0j01415d202df said:
Windows Security indicates all requirements are met for enhanced hardware security
Click to expand...

Check Core isolation setting some times it can be blocked by incomptabel drivers or Anti Cheat stuff

1778649455649.png


1778649558794.png
 
Upvote 0 Downvote
If the db signature measured in TCGlog isn't a Microsoft's db key, pcr7 binding isn't accepted.
How to get TCGlog
1. download TCGLogTools.psd1 , TCGLogTools.psm1 in https://github.com/mattifestation/TCGLogTools
2. open powershell in admin previleges and cd 1's folder
3. execute the following commands
import-module TCGLogTools
$TCGLogBytes = Get-TCGLogContent -LogType SRTMCurrent
$TCGLog = ConvertTo-TCGEventLog -LogBytes $TCGLogBytes
$TCGLog.Events.pcr7 | convetto-json -depth 8 | out-file prc7.json
Click to expand...
4. view the pcr7.json (ex. my B660M https://jsoneditoronline.org/#left=cloud.51c840e190534a5c893b681fbf00b0a6 )
If "CN=MSI SHIP DB" found, Windows doesn't allow pcr7 binding.
 
Upvote 0 Downvote
hiroyuki75315ac02ec said:
If the db signature measured in TCGlog isn't a Microsoft's db key, pcr7 binding isn't accepted.
How to get TCGlog
1. download TCGLogTools.psd1 , TCGLogTools.psm1 in https://github.com/mattifestation/TCGLogTools
2. open powershell in admin previleges and cd 1's folder
3. execute the following commands

4. view the pcr7.json (ex. my B660M https://jsoneditoronline.org/#left=cloud.51c840e190534a5c893b681fbf00b0a6 )
If "CN=MSI SHIP DB" found, Windows doesn't allow pcr7 binding.
Click to expand...
I think this produces the same information as the event log I shared initially (albeit more legibly). I searched it and found one instance of 'MSI SHIP DB'. I noticed this also appears in the 'Subject' for one of the signatures in your own JSON.

Does that mean you've had the same issue? Do you know what can be done about it?
 
Upvote 0 Downvote
Yes, I have the same issue. Our MSI users can't resolve that.
If pcr7 binding is possible, the certificate chain will look like bellow.
TCGLog in a VMware virtual machine https://jsoneditoronline.org/#left=cloud.d5c6807cebde4563bb8fd77d6375f1b2
PK=Windows OEM Devices PK (Issuer: Microsoft RSA Third Party PCA 2023)
KEK=Microsoft Corporation KEK CA 2011
db=Microsoft UEFI CA 2023
The signature attached to the PK certificate must be one that Windows trusts.
For resolving that , MSI needs to install a Microsoft-signed PK certificate on the new motherboard.
 
Upvote 0 Downvote
Back
Top