Stop error on Lenovo ThinkPad that has KB4568831 or a later update and Enhanced Windows Biometric Security enabled in UEFI

Applies to: Windows 10, version 2004, all editions

Symptoms


You have a Lenovo ThinkPad device that has received the July 31, 2020—KB4568831 (OS Build 19041.423) Preview update or a newer update. The device also has Enhanced Windows Biometric Security enabled in the UEFI, and it runs Lenovo Vantage software.

The device experiences a Stop error (also known as a bugcheck or blue screen error). The codes that are associated with the error are “SYSTEM_THREAD_EXCEPTION_NOT_HANDLED” (in the Stop error message screen) and “0xc0000005 Access Denied” (in memory dumps files and other logs). The associated process is ldiagio.sys.

Cause


Windows devices that receive July 31, 2020—KB4568831 (OS Build 19041.423) Preview or newer updates restrict how processes can access peripheral component interconnect (PCI) device configuration space under specific conditions. Processes that have to access PCI device configuration space must use officially supported mechanisms.

Enabling the Enhanced Windows Biometric Security option in the UEFI of Lenovo ThinkPad devices that were manufactured in 2019 or 2020 meet the conditions that trigger this behavior. When Lenovo Vantage software runs, some versions may try to access PCI device configuration space in an unsupported manner. This action causes a Stop error to occur.

Workaround


To temporarily mitigate this problem, edit the device UEFI configuration (in the Security > Virtualization section) to disable Enhanced Windows Biometric Security. This change disables the restrictions that are enabled by the SDEV table and VBS.

Status


Lenovo and Microsoft are working on a fix for this problem. For updated Lenovo Vantage support information about this problem, see Lenovo HT511000.

More information


Windows devices that receive the July 31, 2020—KB4568831 (OS Build 19041.423) Preview or later updates restrict how processes can access peripheral component interconnect (PCI) device configuration space if a Secure Devices (SDEV) ACPI table is present and Virtualization-based Security (VBS) is running. Processes that have to access PCI device configuration space must use officially supported mechanisms.

The SDEV table defines secure hardware devices in ACPI. VBS is enabled on a system if security features that use virtualization are enabled. Some examples of these features are Hypervisor Code Integrity or Windows Defender Credential Guard.

The new restrictions are designed to prevent malicious processes from modifying the configuration space of secure devices. Device drivers or other system processes must not try to manipulate the configuration space of any PCI devices, except by using the Microsoft-provided bus interfaces or IRPs. If a process tries to access PCI configuration space in an unsupported manner (such as by parsing MCFG table and mapping configuration space to virtual memory), Windows denies access to the process and generates a Stop error.

Enabling the Enhanced Windows Biometric Security option in the UEFI of Lenovo ThinkPad devices that were manufactured in 2019 and 2020 enables an SDEV table. When Lenovo Vantage software runs, some versions may try to access PCI device configuration space in an unsupported manner. This action causes a Stop error. The error is typically displayed as described in the “Symptoms” section.