System encrypted with Endpoint Encryption will not boot after HP Master Boot Record restore
Last Updated April 27, 2015
A system that has been encrypted with Symantec Endpoint Encryption Full Disk (SEE-FD) will no longer boot after the Master Boot Record (MBR) is restored using the HP business notebook or business desktop MBR save/restore BIOS feature.
The system will boot stating that there is a non-system disk or disk error.
The HP MBR restore feature is designed to replace the MBR with a known-good back-up in the event the MBR has been tampered with. Because SEE replaces the MBR as a way of securing the disk, the HP MBR restore (if enabled) will detect the change and prompt the user to choose how they would like to proceed.
Because SEE must change the MBR, and the HP MBR restore feature is intended to detect MBR changes, the only way to completely avoid being prompted by the HP BIOS is to disable the MBR Save/Restore feature. Aleternately the end-user can choose the appropriate option during the first boot after installation to ensure the back-up MBR is updated with the new SEE-FD MBR.
Please see the attached document from HP for further information on the "HP Master Boot Record Save/Restore BIOS Feature for HP Business Notebooks and Desktops"
If the MBR restore feature is active and the end-user is prompted by the HP BIOS, they will recieve the following options:
Enter 1 to overwrite backup MBR with HDD MBR
This will replace the MBR currently stored within the BIOS with the new MBR that was just written by SEE during the install
Enter 2 to overwrite HDD MBR with backup MBR
This will replace the MBR that was just written by SEE with the MBR stored in the BIOS
Enter 3 for No action
This will do nothing and the end-user may be prompted again when the system is rebooted
Symantec support recommends option 1 if you have been prompted after SEE was installed or upgraded.
HP Business class systems have the "Master Boot Record Save/Restore BIOS Feature for HP Business Notebooks and Desktops" feature available.