URGENT: T420s BIOS v1.29 and PGP Whole Disk Encryption

[rxleon912]

ATTENTION!!!

I have multiple T420s laptops (4174-2AU). I recently upgraded 2 of those laptop to the latest BIOS (v1.29). Those two laptops were no longer able to access the encrypted drive.

-----------------------------------------------------------

bootguard stage2...

PGPWDE disk data are corrupted...

system halted..

----------------------------------------------------------

My corporation does not use recovery disks, for what reason I don't know. All I DO know is that I had to reimage the drives. I attempted to encrypt again and rebooted and received the same error again. So I re-imaged again and didn't encrypt the drive. Other posts say it has to do with the PGP and the Sandy Bridge architecture, but I disagree. I was able to downstep the BIOS using Lenovo's FLASH tools. I went down to v1.25 (Download) and THEN encrypted the drive again. After reboot there was no issue.

I hope no one else encounters this problem. If you do, here's your solution.

To Lenovo Support:

PLEASE ADDRESS THIS ISSUE BEFORE IT AFFECTS TOO MANY PEOPLE!!!!

Regard,

Rick

[JameZ]

@rxleon912,

Appreciate if you can drop me a private message with the following so I can get a case going with engineering on this issue.

Name:
Mobile:
Email:
Company:

MTM:
S/N:

BIOS: 1.29 downgrade to 1.25 (works fine?)
Encryption software: PGP Whole Disk?

Windows 7: Ulti/Pro/Enterprise:
64bit/32bit:
ACHI?

//JameZ

[JameZ]

@rxleon912,

Engineering are aware of this issue and they are looking into it. They have advice that you can downgrade to 1.26 instead of 1.25.

Please scroll down this page to find version 1.26.

http://support.lenovo.com/en_US/downloads/detail.page?DocID=DS018884

//JameZ

[wditters]

I have no experience with that product but what I do know is that with Bitlocker, any configuration change *including* a BIOS upgrade should in every case be preceded by temporary disabling Bitlocker for the purpose of this configuration change. It says so in all the manuals and it offers the possibility in the settings panel. After the upgrade one can enable Bitlocker again to accept the new configuration.

Could this by any chance also be the case with this particular product?

[someotherguy]

---

wditters wrote:

I have no experience with that product but what I do know is that with Bitlocker, any configuration change *including* a BIOS upgrade should in every case be preceded by temporary disabling Bitlocker for the purpose of this configuration change. It says so in all the manuals and it offers the possibility in the settings panel. After the upgrade one can enable Bitlocker again to accept the new configuration.

Could this by any chance also be the case with this particular product?

---

No, bitlocker is unique because it uses the TPM and a measurement of the system which includes a hash of the BIOS area.  When the BIOS changes, then so does the bitlocker measurement and this causes the bitlocker key not to load anymore (and a recovery method is needed).  The software encryption tools, such as PGP, Sophos, WinMagic, etc do not use the TPM and therefore are not affected by BIOS changes the way that bitlocker is.

This problem with PGP is something completely different.

[wditters]

Good to know but a shame for RXLeon

[rxleon912]

---

JameZ wrote:
@rxleon912,

Engineering are aware of this issue and they are looking into it. They have advice that you can downgrade to 1.26 instead of 1.25.

Please scroll down this page to find version 1.26.

http://support.lenovo.com/en_US/downloads/detail.page?DocID=DS018884

//JameZ

---

JameZ...

The link points to BIOS files for a W520 not a T420 like these laptops are.

Please advise.

Thanks...

[wditters]

See bottom of the following page for all past BIOS versions:

http://support.lenovo.com/en_US/downloads/detail.page?LegacyDocID=MIGR-77010

Cheers Willem

[stephen_renaud]

I have run into the same problem on a Lenovo X220. Can you please provide the link to downgrade the Bios. Thanks.

[Steve_Renaud]

Sorry, I just upgraded to UEFI BIOS Version 8DET51WW (1.21) on a Lenovo X220 tablet (4298-B49). Please provide the link to the previous version as soon as possible. Thank you.