Cannot enable credential guard on Latitude E5470

Come to think of it, when I did that I was on an older BIOS verison. 1.9.something I think? Is it possible the downgrade doesn't work on newer BIOS versions?

If so, downgrading the BIOS temporarily might allow the TPM to be downgraded, after which the BIOS can be restored to the correct version.

On this older BIOS the E5470 gets stuck on reboot if Device Guard is on, so I suspect it will need to be disabled, including removal of the UEFI lock, before you will be able to get the TPM version switch tool to work.

OK, I've got some good news.

On the Optiplex 3040. After trying to downgrade the TPM again, it has downgraded successfully and Credential Guard now starts on this device.

The only thing I did different from the last time was to add the registry Value

HKLM\System\CurrentControlSet\Services\Tpm\WMI\NoAutoProvision and set it to 1 before clearing the TPM, and removing it at the end of the process.

I suspect after the TPM is cleared windows was claiming the TPM, and the existence of an owner was causing the device to claim the operation was not supported.

The process I used to revert that device, in full, was:

1. Add the registry key to prevent windows automatically taking ownership of the TPM, and restart.

2. Go into the BIOS settings, and tick the "clear" box on the TPM page.

3. Boot back into windows, and run the TPM version changer.

4. After the install completes, go back into the BIOS and and enable the "tpm ppi provision override" option to allow windows to take ownership of the TPM.

5. Boot back into windows and remove the registry key.

6. Reboot again to allow windows to claim the TPM and activate credential guard.

In our environment we don't require any TPM 2.0 features, as we only use TPM for Bitlocker, Virtual Smart Card, TPM-Attested certificates and Credential Guard, all of which are supported on TPM 1.2, so in our case I expect we will simply leave any devices with TPM 1.2 on that version and not upgrade to avoid the issue.

(That being said, this is a sufficiently bizarre issue that it might be an interesting research problem for someone interested in the internals of Credential Guard/Virtual Secure Mode)

Good luck!

It's the same tool I've used.

I guess something went wrong when I cleared the TPM (firmware upgrade process saying that the system isn't compatible with it was weird tough) - I tried the process again with the same, and guess what? It was successful. After a reboot, prepared the TPM via tpm.msc, reboot again:

"Credential-Guard is enabled and running.

HVCI is enabled and running.

Config-CI is enabled and running. (Audit mode)

HVCI, Credential-Guard, and Config-CI are enabled and running."

I think you're right, this is all related to the firmware somehow.

Big-big thanks for your help Captain!

When you downgrade to TPM 1.2 you don´t use Windows 10 1607?

Has anyone found a fix for Windows 10 1607 with TPM2 ? I can´t find anything about what to do with an "HST validation failed"

TPM 1.2 is compatible with Credential Guard on 1607, it was only the very first version, 1507, that required TPM 2.0.

The HST validation failed result from the compatibility tool isn't fatal to running the feature. We get the same problem when we run that script, but the feature actually works perfectly well in practice. Just turn it on with Group Policy or via the Registry with the lastest BIOS already installed.

I just recieved an answer from dell to my HSTI validation error on an DELL Latitude E5270. it was escalated inhouse and there will be a Bios-Update in mid-april adressing that issue...