mrbios Posted July 14, 2014 Posted July 14, 2014 Does anyone have a step by step guide to setting up and configuring TPM? I've got some laptops i want to enable it on, but they're not Dell, HP or Lenovo (and naturally 99.9% of internet advice revolves around those) Ideally i wanted to enable and configure TPM via my SCCM 2012R2 task sequence, but without a bios configuration tool like the CCTK etc that doesn't appear to be possible. I've only got to do 9 though so if need be i can do it manually once the OS is on. It's an Infineon chip, I've got the Infineon Security Platform Settings Tool installed. Having never used TPM until now though, i'm finding i need some sort of documentation to look through and get my head around it before i go locking myself out of something Also I've seen something about some "Trusted computing management tool" which appears to be some server based management of infineon TPM chips but i can't find anything about that either. Lastly as for bios options these have me confused too, once you enable TPM you get the option for "Clear TPM" "Enable Take ownership" "disable take ownership" Anyone able to point me in the right direction here?
clareq Posted July 14, 2014 Posted July 14, 2014 I'm working my way through this one as well, and am still testing - I think I'm nearly there. In BIOS I'm enabling Take Ownership, and then, in my task sequence I'm adding the following run command line switches - each a separate line, so I can see where it's breaking. Switch on Bitlocker: cmd.exe /c manage-bde.exe -tpm -TurnOn Take Ownership Bitlocker cmd.exe /c manage-bde.exe -tmp -takeownership Start Encryption cmd.exe /c manage-bde -on - adbackup Each line is set to continue on error Now, all this works if I run the commands on the machine once it's been added to the domain, but for the life of me, I've not yet managed to make it work fully from a task sequence. Having said that, I found a typo in my second command 30 minutes ago, so I'm running another test now. I'll let you know how it goes. 1
mrbios Posted July 14, 2014 Author Posted July 14, 2014 awesome thank you! Can you show me what your task sequence looks like at the stages these commands are running?
clareq Posted July 14, 2014 Posted July 14, 2014 I should know whether it's worked in 30 minutes or so - I'll grab celebratory screen shots if it's worked 1
mrbios Posted July 14, 2014 Author Posted July 14, 2014 (edited) I should know whether it's worked in 30 minutes or so - I'll grab celebratory screen shots if it's worked Out of interest, what laptops are you using if you're also not using HP/Lenovo or Dell? I'm trying to do this on Novatech (Clevo chassis) ones at the moment. EDIT: Well i've edited my task sequence for how i think it should go with your commands, running it now so we'll see Edited July 14, 2014 by mrbios
clareq Posted July 14, 2014 Posted July 14, 2014 We have a varied bag - Dell, Samsung, Ergo, Lenovo and HP. I'm trying to get a non specific TS set up. I don't fully understand why you need a utility to manipulate BIOS if you can set it manually before running the TS. We have to go into BIOS anyway to set up admin password etc.
mrbios Posted July 14, 2014 Author Posted July 14, 2014 We have a varied bag - Dell, Samsung, Ergo, Lenovo and HP. I'm trying to get a non specific TS set up. I don't fully understand why you need a utility to manipulate BIOS if you can set it manually before running the TS. We have to go into BIOS anyway to set up admin password etc. I was a bit lost by that as it seems like they're only setting a temporary bios password in the task sequence anyway (at least on the example i looked at) and then removing it afterwards. Didn't really make sense to me, unless the TPM chip knows if a bios password is set and it requires one to be set in order for you to enable it?
clareq Posted July 14, 2014 Posted July 14, 2014 From what I've seem some BIOS do require a password set before you can enable TMP. As we don't send any machines out without a BIOS password, that isn't an issue for us.
SYNACK Posted July 14, 2014 Posted July 14, 2014 From what I've seem some BIOS do require a password set before you can enable TMP. As we don't send any machines out without a BIOS password, that isn't an issue for us. I was a bit lost by that as it seems like they're only setting a temporary bios password in the task sequence anyway (at least on the example i looked at) and then removing it afterwards. Didn't really make sense to me, unless the TPM chip knows if a bios password is set and it requires one to be set in order for you to enable it? Yes, some bios s require this before any security features can be messed with like the hp ones. If you are doing it manually then you can get around this because the wizard prompts you to accept at boot time which does not require a bios password but that defeats the whole automation thing. As to that hp has the hp BCU http://ftp.hp.com/pub/caps-softpaq/cmit/HP_BCU.html and Dell has their variation but if you can get the BIOS settings right beforehand this should not be required. You could however use WMI to grab the manufacturer as part of your task sequence then automate the bios config for those that you can, you can even update them programmatically but this is a tad more dangerous depending on your build environment.
mrbios Posted July 14, 2014 Author Posted July 14, 2014 It didn't work Back to the drawing board. When i image mine, this is the state it ends up in: Are you getting similar?
clareq Posted July 14, 2014 Posted July 14, 2014 No, I get that the TPM is turned on, but ownership has not been set. i have seen that screen before (I've been working on this for about an month) If I remember rightly I had to set some permissions in AD to allow machines to write back the key. have a look here: Henk's blog: How to Enable BitLocker, Automatically save Keys to Active Directory 1
mrbios Posted July 14, 2014 Author Posted July 14, 2014 ah good old henks blog, i like that guy lol. Cheers, will give that a go.
SYNACK Posted July 14, 2014 Posted July 14, 2014 When i image mine, this is the state it ends up in: [ATTACH=CONFIG]25616[/ATTACH] Are you getting similar? Does the TPM show up properly in hardware manager, do you need to integrate the driver into it. What happens if you resume protection? this should write the key back to the TPM or drop an error which may shed more light, if it will enable it may just be another command to resume protection at the end of the sequence.
mrbios Posted July 14, 2014 Author Posted July 14, 2014 Does the TPM show up properly in hardware manager, do you need to integrate the driver into it. What happens if you resume protection? this should write the key back to the TPM or drop an error which may shed more light, if it will enable it may just be another command to resume protection at the end of the sequence. If i try to resume i just get an error. I'll have to check once this task sequence has finished running as to whether it shows up in device manager, certainly there wasn't any devices showing without drivers, but perhaps it wasn't appearing at all. Done the AD change now too so hopefully i'll see the same error that clareq is getting from this point...
clareq Posted July 14, 2014 Posted July 14, 2014 I am going to cautiously say it's working. My task sequence includes: I've obviously removed the password we've used to take ownership. I'm now going to get a fresh machine and try and run the TS on there. The important thing is to ensure the Disable 64-bit file system redirection is ticked. 2
mrbios Posted July 14, 2014 Author Posted July 14, 2014 (edited) grrr none of the images are loading for me here. Just getting a black X for some reason. Images loading ok for everyone else? Even my own image i put on the last page isn't appearing for me, how bizarre EDIT: ok open in new window works, strange Excellent, will give the same settings a go here, you've got a typo on your take ownership part by the way, you've got tmp rather than tpm Edited July 14, 2014 by mrbios 1
sted Posted July 14, 2014 Posted July 14, 2014 dosent applying gpo bitlocker settings do most if not all of that for you anyway with the added advantage of storing the key in ad where you can easily find it if needed
clareq Posted July 14, 2014 Posted July 14, 2014 You still need to turn on the TPM and take ownership. I have the GPO settings set, but nothing happens to a laptop in that OU unless I take these steps.
sted Posted July 14, 2014 Posted July 14, 2014 granted you always need to turn it on but do you need to take ownership?
clareq Posted July 14, 2014 Posted July 14, 2014 It seems so. Everything I've read certainly says so.
sted Posted July 14, 2014 Posted July 14, 2014 It seems so. Everything I've read certainly says so. i know when io enabled bitlocker on my surace pro i did 0 other than turn it on and save the key to my ms account when it asked me to
clareq Posted July 14, 2014 Posted July 14, 2014 Windows 8 manages bitlocker differently apparently - I know a TPM chip isn't required.
sted Posted July 14, 2014 Posted July 14, 2014 Windows 8 manages bitlocker differently apparently - I know a TPM chip isn't required. it technically isnt on win7 you can use a pen drive and/or a pin iirc
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now