Windows 10: TPM chip stops with Code 10 after windows patches.

We have a number of laptops Samsung series 9 and Dell Inspirion 7000 series where all TPM 2.0 have a code 10, after applying the latest patches to windows 10 1903!


This is stopping us from using Bitlocker!


I wish I knew which patch has caused this! Please fix Microsoft.

:)

 

TPM chip locked out

Something went wrong with a TPM chip on one of our laptops.

The laptop asked for the Bitlocker recovery key (which it accepted) but didn't let us into the Azure connected Windows account with the PIN we created.

We logged in under the Local Admin account and turned Bitlocker off.

Now the TPM chip is locked. We can't enable it from tpm.msc as it says;





It's been like this for 24 hours now.

I've clear the TPM chip in the BIOS

I've also flashed the BIOS

I've reset Windows using the 'Recovery' console in the settings.

I even tried enabling Bitlocker without a TPM chip from gpedit.msc and we're getting the same error message.

What can we do? How do we clear the TPM chip since we are the owners?

 

Verify Trusted Platform Module (TPM) Chip on Windows PC


Something I came across not long ago, is Firmware-based Trusted Platform Modules (fTPM). Whereas before in order to take advantage of a TPM you needed to have a physical TPM chip soldered to the motherboard, that seems to have changed at some point. You can now have either a Discrete TPM (Physical chip) or Firmware-based TPM.

As per THIS article, fTPM is acknowledged by the Trusted Computing Group (TCG) as a perfectly valid form of TPM and seems to perform much the same functions as a physical TPM. For Intel, their fTPM is called Intel Platform Trust Technology (PTT). I don't know what chips/motherboards/BIOS support PTT, however due to it being Firmware based (as the name suggests) and not requiring a separate physical chip, it means for some devices it's possible to retrospectively add a TPM to devices that didn't have one before.

Looking through the Intel NUC list, it's not just 6th gen Skylake NUC's that it's supported on, but also 5th gen Broadwell NUC's and 4th gen Haswell NUC's too. So if you have a NUC and you have the latest BIOS, then the chances are you have a TPM 2.0 module even if you didn't think you did. You just need to enable 'Intel Platform Trust Technology' in BIOS. As previously mentioned, I don't know what other manufacturers support/will support fTPM too.


The Intel Platform Trust Technology (PTT) setting in Intel VisualBIOS:





With Intel PTT on in BIOS, Device Manager and tpm.msc show a TPM 2.0 module installed.

 

Windows 10 devices now requires hardware encryption/TPM

Stolen from Sweclockers, but it's in swedish.

So from now on devices (OEM built) needs a TPM module. Relevant bit:

Pretty interesting, but there's tons of questions I guess. I don't actually now anything about how TPM works, just that it's hardware, meaning the key is stored in a physical chip and that the decryption has to run through this chip. But I have no idea how let's say biometrics is tied to this. Or what the implications will be, or what exactly is encrypted. The entire storage or just the log in details as such?