(M900) Random BitLocker recovery

[mb_se]

We are having som problems with ours Lenovo ThinkCentre M900 models (both, Thiny and Tower, not using the SFF).
They random goes to BitLocker Recovery on Boot or restart (no modification are done, and no USB-drives plugged in.

Windows 10 Enterprise, 64-bits, build 10586, installed with SCCM, for drivers we are using Lenovo SCCM Package in the task sequence.

Before we installs the PC's, we always updates BIOS to latest version (http://support.lenovo.com/se/sv/products/desktops-and-all-in-ones/thinkcentre-m-series-desktops/thin... and change theese settings i BIOS:

Enabling Intel (R) Virtualization Technology
Enabling VT-d
Enabling TxT
Enabling Secure Boot
(Security Chip already active by enabling TxT)

Changing the Boot order for
Primary Boot Sequence to SATA1 (the harddrive)
Automatic Boot Sequence to SATA1 (the harddrive) [This setting we are only changing after we noticed the problem]
Error Boot Sequence to SATA1 (the harddrive) [This setting we are only changing after we noticed the problem]

We have the same setup on Lenovo ThinkCentre M93p, and there we have no problems.

[Hentschke_Bau]

We have the same issue with the M900 series (Tower).

Windows 10 Enterprise build 10586 with DeviceGuard and BitLocker enabled.

BIOS FWKT45A

Security Features enabled:

VT

VT-d

SecureBoot

TPM

P310 doesn't seem to be affected.

[M900]

With a M900 tiny,  I have same setup but with NO Bitlocker recovery problems with UEFI FWTK43A.

(Sorry, edit: No SCCM is installed yet)

The only time Bitlocker recovery has requested my key is only after each of two UEFI upgrades.

Both SSD's are self-encrypting drives, Bitlocker is enabled and boot drive is M.2 drive.

Perhaps consider flashing an older UEFI.

[Hentschke_Bau]

Users with BIOS 39 do not report problems here.

Affected machines have BIOS Versions FWTK41A,FWTK43A and FWTK45A.

[Angelo]

Hello everyone,

I have a problem with the bitlocker on this Desktop model M900,
computers arrived with FWKT41A firmware, I had to replace because with this version did not back me boot from LAN, he gave PXE error.
I updated with FWTK45A version and I managed to run the Deploy the operating system via SCCM.
The operating system is Windows 7 64-bit Enterprice, now every time I turn on or restart the computer asks for the password of bitlocker.
There is talk of 39 Bios that does not have this problem, but I Bios 39 can not find it on the Lenovo site.
You can help me solve the problem with the bitlocker? I have about 160 computers to prepare.

Thank you

[M900]

There should be a UEFI option to turn off startup passwords. (I have mine turned ON)

and

There is an option in the OS bitlocker to disable it, unless you don't have the bitlocker password and cannot boot.

As for the 39 Bios, check your private Lenovo messages.

[Angelo]

Hi,

in company where I work the bitlocker must be active, I'm having this problem only with this series of desktop, I have to replace a number of desktop already had prepared the same way, type M58, M91, M92, M93p, and of these the problem of bitlocker has never occurred.
The computers are prepared in the same way:
-boot PXE
-Deploy OS Windows 7 64 Bit Enterprice with SCCM
-Computer Join in the Domain
-Start Bitloker encryption

Thanks

[Amy_PI_Lenovo]

In response to customer reports of unexpected issues with Bitlocker when booting or rebooting on ThinkCentre M700 Tiny, ThinkCentre M800, M900 and ThinkStation P310 workstations, Lenovo has provided a solution via BIOS release.

CHANGES for FWKT45A

  - Update Lenovo Diagnostics Tool to v2.09.08.

  - Update PXE ROM to v0.1.09.

  - Fix Bitlocker issue.

The most recent BIOS version, FWKT47A, which includes this change, can be downloaded here: http://support.lenovo.com/us/en/products/desktops-and-all-in-ones/thinkcentre-m-series-desktops/thin...

Thank you,

[Angelo]

Thanks,

I can now continue the computer preparation work

Thank You

[Hentschke_Bau]

When you would have read the post more carefully you should have noticed that the problem IS NOT FIXED with BIOS FWKT45A.

And no, it doesn't work with FWKT47A either.