Recently, we’ve identified the cause behind ongoing issues when cloning systems from HP to Dell, specifically relating to persistent bluescreen errors. The problem stems from legacy McAfee software—not the widely recognized antivirus component, but rather McAfee’s Disk Encryption utility. Interestingly, this encryption utility dates back to 2012 and served as an early alternative to Microsoft’s BitLocker, predating its widespread adoption.
The critical issue arises because McAfee Disk Encryption is no longer supported in Windows 11 24H2. Consequently, attempts to clone systems containing this software result in clone failures or persistent bluescreens following an update. Importantly, without access to the original encryption keys—which we currently do not possess—decrypting affected disks is not possible.
To identify affected systems, administrators should check for the presence of the “McAfee Endpoint Encryption Agent” service. Additionally, verifying the existence of three specific files in the directory C:\Windows\System32\drivers\ will confirm incompatibility:
- MfeEpeHb.sys
- MfeEpeOpal.sys
- MfeEpePc.sys
If any of these indicators are present, cloning the system is not feasible. A detection or clone check script will be implemented to quickly identify and handle systems impacted by this legacy encryption software.
