Lenovo M810z - Change TPM Version to 1.2

[adurrant]

Hello,

I'm having issues bitlockering M810z with SCCM, it seems to go through fine but it appears that the TPM version is set to 2.0, I saw on the latest BIOS version that there's support for 'TPM FW Switch Feature' so hoping this is what I need, I've set up SCCM to flash the BIOS for this model, but is there any BIOS settings that I can push through SCCM to ensure that the TPM module is set to 1.2? The TPM chip is set to 'Discrete' already...

 

BIOS I'm upgrading to is here: http://pcsupport.lenovo.com/ec/en/products/DESKTOPS-AND-ALL-IN-ONES/THINKCENTRE-M-SERIES-DESKTOPS/M810Z/downloads/DS121000

 

I'm also having issues updating the BIOS via OSD as I'm unsure where abouts to insert the install\reboot steps as it needs to before the 'Enable Bitlocker' step, here's what my TS looks like at present, deploying Windows 7 Enterprise x64:

Any advice?

 

 

[simulacra75]

Not entirely sure why you're trying to get BitLocker to work with Windows 7 Professional, because it doesn't/cannot work. It's not implemented in Windows 7 Professional. You need to have Windows 7 Ultimate or Enterprise to use BitLocker.

[adurrant]

6 minutes ago, simulacra75 said:

Not entirely sure why you're trying to get BitLocker to work with Windows 7 Professional, because it doesn't/cannot work. It's not implemented in Windows 7 Professional. You need to have Windows 7 Ultimate or Enterprise to use BitLocker.

Sorry, I meant enterprise.

[simulacra75]

Well then, that's different!

Okay. Lenovo make things a little easier because they expose the BIOS settings to WMI. This means you can use Powershell, for example, to get settings from WMI and also to change them.

 

Display all BIOS Settings in Powershell

gwmi -class Lenovo_BiosSetting -namespace root\wmi | ForEach-Object {if ($_.CurrentSetting -ne "") {Write-Host $_.CurrentSetting.replace(","," = ")}}

 

Get all possible values for a particular setting (TPM chip in this example)

(gwmi –class Lenovo_GetBiosSelections –namespace root\wmi).GetBiosSelections("SecurityChip") |Format-List Selections

 

Change and save a BIOS setting (making TPM active in this example. Note the 2 step process, changing the value and then saving said value. Also note the setting string is case-sensitive)

(gwmi -class Lenovo_SetBiosSetting –namespace root\wmi).SetBiosSetting("SecurityChip,Active")

(gwmi -class Lenovo_SaveBiosSettings -namespace root\wmi).SaveBiosSettings()

 

That should be enough to get you started i think. Probably worth pointing out that changing BIOS settings via Powershell is not supported on ALL Lenovo models. Give it a try though.

 

[adurrant]

53 minutes ago, simulacra75 said:

Well then, that's different!

Okay. Lenovo make things a little easier because they expose the BIOS settings to WMI. This means you can use Powershell, for example, to get settings from WMI and also to change them.

 

Display all BIOS Settings in Powershell

gwmi -class Lenovo_BiosSetting -namespace root\wmi | ForEach-Object {if ($_.CurrentSetting -ne "") {Write-Host $_.CurrentSetting.replace(","," = ")}}

 

Get all possible values for a particular setting (TPM chip in this example)

(gwmi –class Lenovo_GetBiosSelections –namespace root\wmi).GetBiosSelections("SecurityChip") |Format-List Selections

 

Change and save a BIOS setting (making TPM active in this example. Note the 2 step process, changing the value and then saving said value. Also note the setting string is case-sensitive)

(gwmi -class Lenovo_SetBiosSetting –namespace root\wmi).SetBiosSetting("SecurityChip,Active")

(gwmi -class Lenovo_SaveBiosSettings -namespace root\wmi).SaveBiosSettings()

 

That should be enough to get you started i think. Probably worth pointing out that changing BIOS settings via Powershell is not supported on ALL Lenovo models. Give it a try though.

 

Hello,

Thanks for this, I did see this on Lenovos website, however it appears that it's mostly designed for their thinkpads, thinkcentres appear to have less functionality.... do you know if the above will apply to ThinkPads and ThinkCentres?

Source: https://support.lenovo.com/ec/en/solutions/ht100612

[simulacra75]

I do not know if it will work on Thinkcentre products. Best thing you can do, is run the powershell commands on some of the models and see if you get output. That will tell you if it works or not.

[adurrant]

Thanks I will give this a go!

Do you know the correct way to upgrade the BIOS via SCCM?

[simulacra75]

AFAIK, you cannot use a 64-bit boot image in your TS because the Lenovo BIOS Flash utility only supports the x86 architecture. On top of this you need to add a specific  "Run Command Line" that does a "full" restart of the target computer, 

cmd.exe /c shutdown /s /t 0 /f

That should do it but if you cannot use an x86 boot image, you're screwed until Lenovo provide an 64-bit compatible Flash utility

 

[adurrant]

Thanks,

There does appear to be a x64 version in the file structure once extracted:

Are you recommending that I flash the BIOS early in the TS before the OS is applied or after? If after, the above command will shut down the OS though, any workarounds with that?

[simulacra75]

I'd suggest you actually try some things out yourself. Personally, i'd update the BIOS early on in the TS, preferably in Windows PE.