R730 TPM 2.0 and BitLocker Recovery Key Prompt on every boot

I have a couple of R730's that I acquired June 2017, running Server 2016 Datacenter.

I've been noticing that every time these servers reboot, BitLocker would prompt for recovery key.

I've tried suspending bitlocker, reboot, enable it. This only works for 1 restart, the next time it reboots, it asks for the key.

According to docs.microsoft.com/.../system-requirements, Server 2016 requires TPM 2.0, and according to this, https://msdn.microsoft.com/en-us/library/windows/hardware/dn375855(v=vs.85).aspx PCR7 is required for TPM 2.0

I did specify TPM2.0 when I purchased these servers, it does show on the service tag, and also show on tpm.msc as version 2.

When I run manage-bde -protectors -get c:, I see PCR 0, 2, 4, 11. PCR 7 is not listed.

I think the missing PCR 7 is the root cause of these R730 bitlocker prompt on boot. If you have a R730 with Bitlocker, what do you get if you run "manage-bde -protectors -get c:" ?

I'm showing event id 815 & 834.

"BitLocker cannot use Secure Boot for integrity because the expected TCG Log separator entry is missing or invalid."

"BitLocker determined that the TCG log is invalid for use of Secure Boot. The filtered TCG log for PCR[7] is included in this event."

How can I enable the PCR 7?