DFE laptops Intune Autopilot join error 0x800705b4

[TechiMCR]

We received two models of HP's from the DFE over the pandemic. The HP 250 G7 we had no problems joining to intune but HP 255 G7 model is failing with the error code 0x800705b4 on the securing your hardware stage. I understand this can point to an error with the TPM chip but the model does have a TPM 2.0 chip.I have created a blank autopilot profile that is assigned no compliance or config profiles but I still get the same error. I have bypassed our firewall/filter to rule out an error with the internet requests being blocked.Any suggestions to get around this would be greatly appreciated!

[EssentialRug]

We received two models of HP's from the DFE over the pandemic. The HP 250 G7 we had no problems joining to intune but HP 255 G7 model is failing with the error code 0x800705b4 on the securing your hardware stage. I understand this can point to an error with the TPM chip but the model does have a TPM 2.0 chip.I have created a blank autopilot profile that is assigned no compliance or config profiles but I still get the same error. I have bypassed our firewall/filter to rule out an error with the internet requests being blocked.Any suggestions to get around this would be greatly appreciated!

 

Have you tried clearing the TPM in the bios?

[TechiMCR]

Have you tried clearing the TPM in the bios?

Yh, as part of out autopilot process we clear the TPM in the BIOS, should of mentioned this in the post.I asked for support from Microsoft and they replied with the below:"We regret to inform that we have a in the current period a known issue with the AMD processors when Windows devices are deploying through Self-Deploying Autopilot. Incident 272912878Therefore, I would ask you to please make a new deployment profile but with User Driven mode for the enrollment of the device. "I haven't done user driven before, will have to see if it's suitable for schools.

[Paul-K]

We had this same issue with the HP 255 G7 devices and I have recently been testing after going back and forth between HO, Microsoft and AMD but think this is now working. We had to update the BIOS to the latest version from the HP site, I also updated the device to Windows 10 21H2 prior to provisioning the device for Intune but as it’s now half term I’ve not managed to test another device, I am looking to do another few next week to test fully. I am now having the same issue with tue last batch we received from the DfE which are HP 245 G8 devices. It seems anything with an AMD processor is the problem, something to do with the certificates as it doesn’t present them correctly.

[georgeescott]

Had this same 'Securing your hardware (0x800705b4)' error today when testing Autopilot self-deploying with our Dfe Lenovo 300e's.

Running tpmtool GetDeviceInformation on the device shows:

Tpm Firmware Vulnerability: 0x00000002
ADV190024 - ECDSA key generation (tpm.FAIL)

 

https://call4cloud.nl/2022/08/ready-for-attestation-a-true-underdog-story was helpful diagnosing this.

 

Lenovo have an advisory on it https://support.lenovo.com/us/en/product_security/ps500286-st-microelectronics-tpm-firmware-ecdsa-signature-generation-vulnerability but don't list the 300e's.

They're out of warranty now so can't log a ticket with Lenovo without paying for support but have posted in the Forums hoping someone may have seen it before.

 

Running latest BIOS and have cleared TPM.

 

Has anyone managed to resolve this with the Lenovo DfE laptops? Or did you have to resort to the user-driven Autopilot profile.

[georgeescott]

Had this same 'Securing your hardware (0x800705b4)' error today when testing Autopilot self-deploying with our Dfe Lenovo 300e's.

Running tpmtool GetDeviceInformation on the device shows:

Tpm Firmware Vulnerability: 0x00000002
ADV190024 - ECDSA key generation (tpm.FAIL)

 

Lenovo have an advisory on it https://support.lenovo.com/us/en/product_security/ps500286-st-microelectronics-tpm-firmware-ecdsa-signature-generation-vulnerability but don't list the 300e's.

 

Ok, so I'm getting closer and have it working on one Lenovo 300e DfE laptop. But still getting 'Securing your hardware (0x800705b4)' on other ones i'm testing with. Starting to think it could be a hardware problem versus a Windows/Intune problem.

 

I've found a way to update the TPM firmware to fix the vulnerability. It looks like the TPM updates are coming down through Windows Update and most aren't provided on the TPM/device manufacturers websites.

As it's an optional driver update, it isn't installing before the Device Preparation phase of Autopilot/ESP.

 

So, the TPM update process for Windows 11 is:

1. After Autopilot, wait for the device to get to the ESP
   
2. Press SHIFT+F10 to open CMD
   
3. Run "tpmtool GetDeviceInformation" to confirm the TPM's Manufacturer
   
4. Open Windows Updates; either by running "start ms-settings:windowsupdate" or by pressing Windows Key+Pause/Break
   
5. Check for updates
   
6. Go to Windows Updates -> Advanced options -> Additional options -> Optional updates -> Driver updates
   
7. Hopefully the TPM manufacturer's name will be listed as a firmware update.
   On my Lenovo 300e, it was listed as "Nuvoton - Firmware - 0.0.0.6".
   
8. Tick the required firmware update and click Download & install
   
9. The update(s) will begin installing. Restart when prompted and the TPM firmware should begin updating
   
10. After it boots back in to Windows and the ESP page, press SHIFT+F10 to open CMD
    
11. Run "tpmtool GetDeviceInformation" again to confirm that the "Tpm Firmware Vulnerability" property is no longer listed, and that the "TPM Has Vulnerable Firmware" is "False"
    
12. Restart Autopilot or wipe the device and it might go through the Device preparation -> Securing your hardware step this time
    You can normally restart the ESP process without needing to wipe the device by:
    


1. Press SHIFT+F10 to open CMD
   
2. Run regedit
   
3. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\AutopilotSettings\
   
4. Delete the following keys:
   
   1. DevicePreparationCategory.Status
      
   2. DeviceSetupCategory.Status
      

    

   [*]In CMD, run shutdown /r /t 0 to restart and the ESP should start from the beginning again

    

   I've got a ticket logged with Microsoft to troubleshoot why 0x800705b4 is happening so I'll post back if I get anywhere..

   
   

Edited March 22, 2024 by georgeescott

[georgeescott]

Ok, so I'm getting closer and have it working on one Lenovo 300e DfE laptop. But still getting 'Securing your hardware (0x800705b4)' on other ones I'm testing with. Starting to think it could be a hardware problem versus a Windows/Intune problem

Ok, so this error appears to be a combination of issues.

 

1. The JSON file for Windows Autopilot for existing devices
   We were using the JSON file for Windows Autopilot for existing devices in a ConfigMgr task sequence to wipe devices to Windows 11 and to then enrol them in to Autopilot. However, the JSON file only supports user-driven Autopilot profiles. Self-deploying and pre-provisioning Autopilot profiles aren't supported due to these scenarios requiring TPM attestation. https://learn.microsoft.com/en-us/autopilot/existing-devices.
    
   Annoyingly (at the time of writing) the article for this error https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-enrollment-errors#securing-your-hardware-failed-0x800705b4 doesn't specify this, so I've logged a GitHub issue to get this updated.
    
    
   
2. TPM firmware vulnerabilities
   The DfE laptops we have are affected by TPM vulnerabilities. This then impacts TPM attestation during the Autopilot self-deploy mode and the user-mode pre-provisioning, which causes the 0x800705b4 TPM attestation timeout error during ESP.
   
   • Lenovo 300e (Intel Celeron N4120 CPU, Nuvoton Technology TPM)
     

     Tpm Firmware Vulnerability: 0x00000002
     ADV190024 - ECDSA key generation (tpm.FAIL)

     
     Fixable with a TPM firmware update via Windows Update
      
      
     

   • Dell Latitude 3190 (Intel Celeron N4120 CPU, Intel TPM)
     

     INFORMATION_EK_CERTIFICATE

     
     No TPM firmware update via Windows Update or OEM
      
      
     

   • HP 250 G7 (Intel Celeron N4020 CPU, Intel TPM)
     

     INFORMATION_EK_CERTIFICATE

     
     No TPM firmware update via Windows Update or OEM
     

I've tried to reach out to HP/Dell to see if they'll issue a TPM firmware update but as the devices we have are no-longer under warranty, getting support or even talking to a human is proving very difficult.

Will keep trying though!

[CHiLL]

I have just encountered into this issue with 3x HP 250 G7 laptops and 1x Dell 3190, with the same error code reported. All laptops are running Windows 10 21H2, TPM 2.0 and all report that "TPM Has Vulnerable Firmware" is "False". I have also updated them all to the latest BIOS/firmware version, but I'm still encountering the issue. I am wondering if it's configuration related, because we recently changed our Autopilot from User-driven to Device-driven.

[georgeescott]

I have just encountered into this issue with 3x HP 250 G7 laptops and 1x Dell 3190, with the same error code reported. All laptops are running Windows 10 21H2, TPM 2.0 and all report that "TPM Has Vulnerable Firmware" is "False". I have also updated them all to the latest BIOS/firmware version, but I'm still encountering the issue. I am wondering if it's configuration related, because we recently changed our Autopilot from User-driven to Device-driven.

 

I've still got the ticket open with MS, but I suspect it's a CPU/TPM Firmware issue that OEM's are going to have to fix.

 

I did have a Lenovo 300e enrol in self-deploying mode when "TPM Has Vulnerable Firmware" was "True", so seems that it may not be as important to attest as I thought. Must just be the "Ready for Attestation: True" that matters.

 

If you were using user-driven mode previously, it won't use/need the TPM to enrol the device as it'll use the user credentials.

Whereas using self-deploying mode (or pre-provisioning with user-driven) would then use the TPM to enrol the device instead.

 

If it's using one of the TPM's that has an issue with TPM attestation, it'll fail to enrol. The only way to fully enrol them is user-driven mode sadly.

Edited June 17, 2024 by georgeescott

[CHiLL]

I've still got the ticket open with MS, but I suspect it's a CPU/TPM Firmware issue that OEM's are going to have to fix.

 

I did have a Lenovo 300e enrol in self-deploying mode when "TPM Has Vulnerable Firmware" was "True", so seems that it may not be as important to attest as I thought. Must just be the "Ready for Attestation: True" that matters.

 

If you were using user-driven mode previously, it won't use/need the TPM to enrol the device as it'll use the user credentials.

Whereas using self-deploying mode (or pre-provisioning with user-driven) would then use the TPM to enrol the device instead.

 

If it's using one of the TPM's that has an issue with TPM attestation, it'll fail to enrol. The only way to fully enrol them is user-driven mode sadly.

The 250 G7 I have in front of me, which has the most up to date BIOS from HP (F.48 dated 07/05/2024) shows "Is Capable for Attestation: False", which suggests that it's a flat no go for device enrollment, if that's a requirement. I'm not sure I want to have to go through a whole rigmarole of running a bunch of different things on each laptop, when it appears that every laptop is affected. I'd rather go back to user-driven enrollment and remove the primary user in Intune, which will turn it into a shared device.

Edited June 18, 2024 by CHiLL

[Brummytech]

We just use setup school pcs for dell 3190s and hp dfe devices. Dells are usuable HP seem horrific now.

[georgeescott]

I'd rather go back to user-driven enrollment and remove the primary user in Intune, which will turn it into a shared device.

 

The MS Intune team basically closed the ticket asking us to log it with the Windows team instead. We don’t have a support contract so it’s a no-go for further troubleshooting. It’d probably need Dell/HP to issue a TPM firmware update anyway (we don’t have any under warranty any more so can’t log it with them either).

 

We’re either going to do user-driven enrolments and remove primary user, or might look at using a Device Enrollment Manager (DEM) https://learn.microsoft.com/en-us/mem/intune/enrollment/device-enrollment-manager-enroll.

[Chclark]

Did anyone get a resolution for the hps I updated the bios but same error on preparing during the autopilot enrollment.

[georgeescott]

Did anyone get a resolution for the hps I updated the bios but same error on preparing during the autopilot enrollment.

 

Nope, you’ll need to log a ticket with HP to fix the TPM firmware I’m afraid. They won’t do it if they’re not under warranty though. That’s where I got to.

[Chclark]

Well that sucks as the warranty is out as they was DfE devices. So that's 20 odd laptops destined for the trade in pile. Unless anyone knows what hp does to fix it?

[georgeescott]

Well that sucks as the warranty is out as they was DfE devices. So that's 20 odd laptops destined for the trade in pile. Unless anyone knows what hp does to fix it?

 

I was told by Intel and Microsoft that the OEM has to fix the TPM firmware bugs. They’ve fixed it in other laptop models with a firmware update, so just need to issue one for this model.

 

You can use it in user-driven mode, just not self-deploy or use pre-provisioning as the TPM bug then breaks this.

[Chclark]

I was told by Intel and Microsoft that the OEM has to fix the TPM firmware bugs. They’ve fixed it in other laptop models with a firmware update, so just need to issue one for this model.

 

You can use it in user-driven mode, just not self-deploy or use pre-provisioning as the TPM bug then breaks this.

 

Yea the hope was to have them as generic shared devices, suppose can set then up as 121 devices which get issued for home use.

[CHiLL]

I gave up and went back to using user-driven enrollment, with the only caveat that you should remove the primary user from the device in Intune once it's set up. That allows it to enter shared device mode and will then work as expected.

[Chclark]

I gave up and went back to using user-driven enrollment, with the only caveat that you should remove the primary user from the device in Intune once it's set up. That allows it to enter shared device mode and will then work as expected.

 

 

These are the only ones I've had issue with that so far haven't been able to resolve device driven enrollment. The dells that came from the DfE did have a issue but a bios update fixed them.

[mikeglover]

I thought I was going mad when I was trying to HP 255 G7 working on self-deploy. Fairly new to self-deploy as been using user-driven alot. Oh well back to user user-driven for these.

Thank you for saving me wasting time more on this.

[mjhardisty]

What about Automatic Enrolment in Intune over Autopilot? This will at least enable you to get devices onto MDM - it doesn't give the full capability of autopiloted devices, but means they can be used and managed?

 

https://learn.microsoft.com/en-us/mem/intune/enrollment/quickstart-setup-auto-enrollment

[georgeescott]

What about Automatic Enrolment in Intune over Autopilot? This will at least enable you to get devices onto MDM - it doesn't give the full capability of autopiloted devices, but means they can be used and managed?

 

https://learn.microsoft.com/en-us/mem/intune/enrollment/quickstart-setup-auto-enrollment

 

This is workplace join effectively isn’t it?

So they’d show as ‘registered’ and not ‘joined’ or ‘hybrid joined’ wouldn’t it? So we can only control them with limited policies I think.

 

We’ve gone for user-driven enrollment and then we remove the primary user from the device.

Although we still need to test if a Device Enrollment Manager will be a more viable workaround: http:// https://learn.microsoft.com/en-us/mem/intune/enrollment/device-enrollment-manager-enroll.

[mjhardisty]

I've performed this on a few machines now, they appear as Corporate Ownership in Intune, just with limited abilities to reset them (since they have no ability to autopilot restore). I've had no issues with policies, apart from Bitlocker due to TPM, etc. In Azure they appear as "Entra joined" with no owner and MDM as Intune.

[Squelch]

I have nothing constructive to add to this thread, I just wanted to say thanks as I have three HP Envy x360's that I have to switch to user deployed in order to rebuild and I had no idea why until now.

[georgeescott]

Ok, so this error appears to be a combination of issues.

 

 

1. TPM firmware vulnerabilities
   The DfE laptops we have are affected by TPM vulnerabilities. This then impacts TPM attestation during the Autopilot self-deploy mode and the user-mode pre-provisioning, which causes the 0x800705b4 TPM attestation timeout error during ESP.I've tried to reach out to HP/Dell to see if they'll issue a TPM firmware update but as the devices we have are no-longer under warranty, getting support or even talking to a human is proving very difficult.
   Will keep trying though!
   
   • Lenovo 300e (Intel Celeron N4120 CPU, Nuvoton Technology TPM)
     

     Tpm Firmware Vulnerability: 0x00000002
     ADV190024 - ECDSA key generation (tpm.FAIL)

     
     Fixable with a TPM firmware update via Windows Update
     

   • Dell Latitude 3190 (Intel Celeron N4120 CPU, Intel TPM)
     

     INFORMATION_EK_CERTIFICATE

     
     No TPM firmware update via Windows Update or OEM
     

   • HP 250 G7 (Intel Celeron N4020 CPU, Intel TPM)
     

     INFORMATION_EK_CERTIFICATE

     
     No TPM firmware update via Windows Update or OEM
     

 

So... further to my previous post about affected laptops, we've recently purchased a non-DfE laptop that's also affected by this issue. The model is:

 

HP 255 G8 (AMD Ryzen 5 5500U CPU, AMD TPM)

INFORMATION_EK_CERTIFICATE

 

Comes with TPM Version: 3.87.0.5 out of the box.

 

No TPM firmware update via Windows Update or OEM

Luckily this newer one is still under warranty so I've logged a case with HP today.

I've asked them to update HP Commercial Notebook PCs - TPM Attestation May Time Out During Microsoft Autopilot Pre-Provisioning once/if they release a new TPM version.

I've reported TPM issues with HP 245 G8, HP 250 G7, HP 255 G7 and HP 255 G8 to them. Let me know if any other HP models are affected.

Edited October 17, 2024 by georgeescott