R730 TPM 2.0 and BitLocker Recovery Key Prompt on every boot

Question

I have a couple of R730's that I acquired June 2017, running Server 2016 Datacenter. I've been noticing that every time these servers reboot, BitLocker would prompt for recovery key. I've tried suspending bitlocker, reboot, enable it. This only works for 1 restart, the next time it reboots, it asks for the key. According to docs.microsoft.com/.../system-requirements, Server 2016 requires TPM 2.0, and according to this, https://msdn.microsoft.com/en-us/library/windows/hardware/dn375855(v=vs.85).aspx PCR7 is required for TPM 2.0 I did specify TPM2.0 when I purchased these servers, it does show on the service tag, and also show on tpm.msc as version 2. PGGP4 1 INFORMATION, SERVER, TRUSTED PLATFORM MODULE, 2.0, 13G M48YR 1 ASSEMBLY, CARD (CIRCUIT), SECURITY, TRUSTED PLATFORM MODULE, 2.0, 13G When I run manage-bde -protectors -get c:, I see PCR 0, 2, 4, 11. PCR 7 is not listed. I think the missing PCR 7 is the root cause of these R730 bitlocker prompt on boot. If you have a R730 with Bitlocker, what do you get if you run 'manage-bde -protectors -get c:' ? I'm showing event id 815 & 834. 'BitLocker cannot use Secure Boot for integrity because the expected TCG Log separator entry is missing or invalid.' 'BitLocker determined that the TCG log is invalid for use of Secure Boot. The filtered TCG log for PCR[7] is included in this event.' How can I enable the PCR 7?

Daniel My · Answer

Hello

The only hardware settings I'm aware of that affect TPM are enabling it in the BIOS and the boot mode. Is TPM enabled in the BIOS, and what is the BIOS boot mode? Also, there should be TPM information listed in the BIOS. Does it list as 2.0. The TPM settings are in the security section.

Thanks

Pana64 · Answer

Hi Daniel,

R730 Server

I have here after BIOS Update the issue with the bitlocker key. I have the key that includes a D after some numbers 15092D55 that i can't input. He let me only digits 0123645789 ...strange ? Do u have an idea?

Thanks a lot.

PowerEdge Hardware General

Was this post helpful?