Run this program as administrator. Reboot when prompted to change the firmware. Ensure that the laptop is connected to power; the firmware update will not proceed if you are on battery power. Additionally, there is a 32 Bit version of the firmware downgrade. You must use the correct version for your architecture.
After the laptop completes the firmware upgrade and reboots, verify in the Device Manager > Security devices section (or in the BIOS > Security section) that it says TPM 1.2 Security.
Turn on BitLocker.
After Bitlocker is enabled and encryption is complete, have the user suspend protection before the first reboot. Otherwise BitLocker tends to lock the first time. This is the same as we used to have to do if BitLocker tripped for any reason; not sure why it's necessary after the initial setup but having it suspended before shutting down or rebooting the first time seems to avoid a lot of BitLocker locks.