Updated BIOS (N1WET56W (1.35)) but still no "Security Chip" option

[vonnp]

Hello.

We are installing bitlocker in PCs and for some, TPM is deactivated and it has to be enabled in the BIOS, under the option "Security Chip". 

So my question is this: how does it that in some of these PCs, the "Security Chip" option is missing?

Here are the specs:

•  Lenovo ThinkPad T470s
• BIOS version: N1WET56W (1.35)
• OS Version: Windows 10.0.14393

[richk]

TPM is an option on T470s.  Some models have it and some do not.  Are all the machine types the same?  It will be on asticker on the back or on the BIOS screen

[vonnp]

Hi Rich,

Thank you for responding. The models are all 20JTS11X00 but, just as you said, some have the "Security Chip" options, other don't.

Since all of the "problematic" PCs are from remote hosts, we can't tell if they have a sticker or not. But we've verified that all of them are of the same model.

[richk]

I don't know any more.  If they are the same model, they should be the same.  The parts lookup for 20JTS11X00 shows they should have a TPM chip.  All I can suggest is that you hit F9 in the BIOS to load defaults

[zoltanthegypsy]

Hi,

Not something I know _anything_ about but IIRC there's a security chip disable option that will make it permanently disappear from BIOS.  Any chance this has been manually/previously selected in the remote machines?

From the BIOS simulator:

[edit to correct] That "hidden" comment means hidden from Windows, not BIOS. See down-thread.

Z.

[vonnp]

I see.. I can only speculate that the TPM chips are damaged and a hardware fix is necessary.

Still, thank you very much!

[vonnp]

Hi Z,

Thanks for your reply. 

If I disabled that option, the "Security Chip" menu will still be visible in the BIOS menu. We have found remote machines that have the "Security Chip" menu and that option set to "disabled".

The thing that happens is that the computer won't find a compatible TPM in order to encrypt.

E.g.

[vonnp]

**or absent

[someotherguy · Accepted solution]

There is not any option to permanently disable the TPM.  If the BIOS setting in Security -> Security Chip is Disabled, it means the OS will not see the TPM.  So you have to enable the TPM in BIOS Setup so that the OS can use it.  If there is not any BIOS setting about Security Chip then it means the system does not have a TPM.