Problem

After attempting to OPAL encrypt a system, the following error message appears after SafeStart fails. 

The disk specified is locked (0xC00B004F)

Cause

Windows and other software can automatically configure drives and take ownership of the drive. If a drive is already owned by another piece of software on the system, ESET Endpoint Encryption cannot configure the drive and take ownership of it when encryption is trying to start.

Solution

To solve this issue you must first perform a PSID revert. This will unlock the drive however it will also wipe all the data off the drive, so please take a backup of your data prior to doing this.

You can see how to perform a PSID revert here - How do I perform a PSID Revert on my OPAL disk?

Once you have performed PSID revert you must reinstall Windows. However in the Windows setup process you must perform the following steps in order to stop Windows automatically locking the drive. 

Launch regedit using a command prompt Window. You can do this by pressing Shift+F10 whilst in Windows setup, and typing regedit. 

 Once regedit has launched, please navigate to the following registry path -

 HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EnhancedStorageDevices

Once you have navgiated to this path, please right click the blank space and create a new DWORD (32-bit) Value. You will need to name this TCGSecurityActivationDisabled and set the value to 1.

Once you have followed these steps you can carry on with the Windows installation process as normal. 

Alternatively you can setup an unattended file which will disable this feature on the installation of Windows. Microsoft have documented this in the following links - 

https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-enhancedstorage-adm-tcgsecurityactivationdisabled
https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-setup-diskconfiguration-disableencrypteddiskprovisioning