[Windows Client] Disk encryption posture check fails when an unencrypted external drive is connected

Last updated: October 14, 2026

Applicable to:

  • Twingate Component: Client | Device Security

  • Platform: Windows

Overview

When disk encryption is required in a Device Security policy, the Windows Client checks that the system drive and any other non-removable drives are encrypted with BitLocker. Connecting an unencrypted external SSD or hard drive can cause the posture check to fail, even when the system drive is fully encrypted.

Symptoms

  • Connecting to the Network fails with “Authentication Blocked – Device security not met. This device does not meet the minimum security requirements to access this Network.”

  • The Client’s Troubleshoot information shows Block reason: Device posture.

  • The Client logs show the encryption check failing:
    Service posture data collected. {"IsHardDriveEncryptionEnabled":false, ...}

  • The failure can start when an external drive is connected and clear when it is disconnected.

Cause

The Windows posture check reports whether the system disk and other disks are encrypted by BitLocker (Device Security Posture Checks). Windows classifies each drive by type, and the check evaluates every drive classified as a local (non-removable) disk.

  • External SSDs and hard drives can be classified by Windows as local disks rather than removable drives. If they are not BitLocker-encrypted, the check fails.

  • USB flash drives are usually classified as removable drives, so they are not evaluated.

  • Only BitLocker encryption is recognised. Drives encrypted with products that don’t use BitLocker will not satisfy the check.

Locked BitLocker drives (Client versions earlier than 2026.239): a BitLocker-encrypted drive that has not been unlocked reports its protection status as unknown. Earlier Client versions treated this as not encrypted. Windows Client 2026.239 fixes this, so locked, encrypted drives pass the check.

Resolution

  1. Encrypt or disconnect any external SSD or hard drive. If an external drive (other than a USB flash drive) is connected, either:

    • encrypt it with BitLocker, or

    • disconnect it while using Twingate.

  2. If the drive is encrypted but locked, update the Twingate Client to 2026.239 or later, or unlock the drive.

  3. If the check doesn’t clear, quit and relaunch the Twingate Client, then retry.

If the check still fails, contact Support with your Client logs.