Article Number: 000129290
If you require scripting or other automation from Dell regarding the update and management of your TPM devices, reference the information and steps provided in this article.
Can Dell provide an automated script to update TPM firmware or activate a TPM?
No. Dell can provide the steps and utilities necessary for updating the TPM firmware, but we are unable to provide a script. Scripting is something customers need to do themselves as every environment is different.
Can a customer completely automate the TPM firmware update via script?
Latitude/Precision/OptiPlex systems support automation via a combination of PowerShell and Dell Command Configure(DCC). This is due to an additional function called "PPI bypass Clear" that is featured on these models.
It is recommended that the person scripting the TPM firmware update be familiar with the Win32_Tpm WMI class by reviewing the information at the following link: Win32_Tpm class.
What can be automated?
Is there a silent installer option for TPM firmware?
Yes. The current version of TPM firmware posted at Dell's Support website supports use of the /s switch which will allow silent install.
How Can I find the TPM firmware Version?
The TPM firmware version can be seen when running the installer. It will tell you the current version and the version you are about to install. You can also get the firmware version by running get-tpm command from a Powershell window run as administrator.
While Windows 7 and above can read the TPM firmware version using PowerShell, it does not display the FULL version number. Only in Windows 10 version 1703 (RS2) and higher can you see the full version and only with a TPM that is in 2.0 Mode (Figure 1).
Figure 1: Windows 10 1703 showing TPM full version number
Dell enables TPM by default on any system that ships with Windows 10. Systems with the TPM not yet enabled can be remotely enabled via scripting on Skylake and Kaby Lake systems via Dell Command Configure using the BIOS option for PPI Bypass Enable.
If a TPM is owned, but disabled Dell Command Configure will not enable the TPM. This is working as designed and is in place as a security measure. There is no supported method for enabled a TPM in 2.0 mode with this configuration. PowerShell will have to be used to send the command to enable and activate a TPM in 1.2 mode. Example:
(get-wmiObject -class Win32_Tpm -namespace root\cimv2\security\microsofttpm). SetPhysicalPresenceRequest (22)
These steps can be scripted or done manually using combinations of Dell Command Configure and PowerShell:
Dell offers a variety of systems with different TPM solutions. You can verify if a system supports a TPM firmware update by visiting the Dell support site and looking under "Drivers & Downloads" for that model. TPM firmware updates will be listed under the "Security" category.
21 Feb 2021