Secure boot and TPM with new OS

[Aaron]

I am really hoping someone can help me with this one.

 

I just recently purchased an HP laptop (HP Pavilion X360) which can preloaded with windows 10 home edition and I needed to install windows 10 enterprise.

 

I went through the steps to enable legacy boot which allows me to boot off USB and I installed a fresh windows 10 enterprise edition on the laptop. Right now everything was going great the OS installed with no issues activated and I started to install the software and its from here I noticed a problem. As soon as I tried to install the encryption software the laptop would restart but not encrypt the only difference I could see was over the legacy support which must have disabled TPM which I need for encryption. When I disable the legacy support and enable/disable secure boot and restart the laptop comes on to say no OS has been installed, although if I enable legacy support and restart the laptop boots into windows 10 enterprise.

 

The only thing I can think of is that the TPM is setup with the pre loaded windows 10 Home edition and what I wanted to know was is it possible now that I have windows 10 enterprise installed on the laptop that I can enable the TPM and secure boot with this OS?

 

Has anyone had this problem before?

[LeMarchand]

Have you tried enabling TPM support from within Windows?

 

My instinct would be to install from a UEFI source rather than legacy and then try to go to UEFI.

[Aaron]

thank you yes I have made sure TPM was enabled but it comes through as TPM ready with reduced functionality.

 

I am trying now by setting up the USB as Fat32 so that I can install with secure boot switched on and hopefully that will do the job.

 

I had used the windows USB creation tool to make a bootable usb and added the ISO so I am hoping that setting the USB with diskpart will solve the issue I will repost if this works.

 

Thank you for the suggestions

[Aaron]

yes it boots straight into installing windows as soon as I setup the usb with DIskpart and formatted as Fat32 so that looks to be it working now with secure boot and TPM now.

 

again thank you for suggestions

[Aaron]

for anyone else that maybe gets this I just followed the below steps:

 

First make sure your bios has secure boot turned on.

Next, build your USB stick with Fat32

Then install normally.

 

The 11 steps for manually preparing / building a USB Disk to be a bootable Win 10 Install. This bootable USB stick will work for both older BIOS installs as well as the newer UEFI installs.

1. Diskpart (Run from a CMD prompt)

2. List Disk

3. Select Disk # (Where # is the number of your USB disk)

4. Clean (removes any partitions on the USB disk, including any hidden sectors)

5. Create Partition Primary (Creates a new primary partition with default parameters)

6. Select Partition 1 (Focus on the newly created partition)

7. Active (Sets the selected partition to an active valid system partition state)

8. Format FS=fat32 quick (Formats the partition with the FAT32 file system. FAT32 is needed instead of NTFS so that it can load under the secure boot UEFI BIOS.)

9. Assign (Assigns the USB drive a drive letter)

10. Exit

11. Copy all the files from the Windows 10 isO to the USB Stick.

 

that's the exact process that's worked for me