Dell PowerEdge R230 TPM Issues

[neufuse Veteran]

I am trying to enable bitlocker on one of our new Dell PowerEdge R230 servers (current generation)... In the past we were a pure HP shop, but are switching to Dell, which was going smooth until this.

 

When I try to enable the TPM chip using bit locker it goes through the normal bitlocker is verifying pc requirements, etc. then it stops and says "the BIOS did not correctly communicate with the Trusted Platform Module (TPM) Contact the computer manufacturer for BIOS upgrade instructions"

 

well, the BIOS is at the latest build, it's set to UEFI mode, the TPM chip is enabled.

 

After "clearing" the TPM BitLocker goes and works a step further and says it needs to restart to take ownership. I do this, the BIOS asks me if I want to allow it, I say yes, windows starts up bitlocker comes up and says it can not take ownership of the TPM because someone already did, when i go into bitlocker management and try to take ownership it asks me for a password from the person who took ownership last, which I thought was the BIOS, but I have no idea what the password was because it did it automatically. So I have to reboot, clear and reactivate the TPM again in bios.. get into windows skip bitlocker setup and go straight into TPM management's MMC snap in and try to take ownership of the chip which right now is not initialized because I cleared it, it says it has to reboot to do this, I do the reboot, asks me the same questions again in bios at startup if i want to allow this, say yes, go into windows and the TPM MMC and try to take ownership, boom what's the owners password again.... same issue.... bios must of set a password? i duno, the dell manual is horrible also and isn't really any help.....

 

I had this same issue with another R230 server and somehow got it to work eventually, but can't remember what I did..

 

anyone else know what is going on? I'm also confused that the system shipped with TPM1.2 but there are a bunch of references in the dell manual saying that TPM1.2 can be upgraded to TPM2.0 via a software update... which is odd.. I guess this is a TPM2.0 chip somehow running in a 1.2 legacy mode?

[neufuse Veteran]

Before someone sends me to this https://technet.microsoft.com/en-us/library/cc753140.aspx that's exactly what I've been doing....... and this is also Windows Server 2012 R2

 

this was also a brand new straight from dell system

[crispkreme]

Take a look at this http://en.community.dell.com/techcenter/b/techcenter/archive/2016/04/04/dell-poweredge-servers-with-tpm-2-0-support

 

It appears Server 2012R2 requires a hotfix for TPM2.0 to function properly.

[neufuse Veteran]

3 minutes ago, crispkreme said:

Take a look at this http://en.community.dell.com/techcenter/b/techcenter/archive/2016/04/04/dell-poweredge-servers-with-tpm-2-0-support

 

It appears Server 2012R2 requires a hotfix for TPM2.0 to function properly.

that hotfix was already applied (probably by dell, because i haven't done any yet), it's already in the list of installed patches....

I also followed this http://www.dell.com/support/article/us/en/04/SLN155219/en?c=us&l=en&s=bsd&cs=04 and when it says it will come to a tpm setup wizard on login all I get is a screen saying enter your current TPM password or select a password file...... which I dont know........

[neufuse Veteran]

My problem right now is with this document http://www.dell.com/support/article/us/en/04/SLN155219/en?c=us&l=en&s=bsd&cs=04

 

at step 7 it says "Once back at the desktop, either the TPM Setup Wizard appears for you to enter a TPM owner password or you can choose Change Owner Password." well when I get back into windows all I get is a message saying the TPM was cleared and windows has remembered my password for me........ problem once again....... what password?! I never set one? it's like it reinitialized the TPM and picked a random password at boot after the TPM clear

[Mindovermaster Global Moderator]

You read this? https://technet.microsoft.com/en-us/library/cc732542(v=ws.11).aspx

[neufuse Veteran]

12 hours ago, Mindovermaster said:

You read this? https://technet.microsoft.com/en-us/library/cc732542(v=ws.11).aspx

yeah, I've read all those trying to figure this out....... I just don't get it, I have three new R230's all with TPM's, so far somehow I got one of them to finally clear, initialize the TPM and then work with bit locker... all them are mirror settings in the EFI settings...

 

I can't even manually initialize the TPM and set a password on my own... if I clear it, then tell it to initialize as soon as I go into windows and open the TPM MMC it tells me a password was set and no idea what it was... try to run bit locker it gives me the failed to communicate with TPM message... manually clear it again try bitlocker with a deactivated and cleared TPM which should initialize it as part of the bitlocker wizard, it says it needs to reboot, ok I reboot do the EFI accept initialize and activate... get to windows boom, can't talk to the TPM again...... same error......

 

I'm getting this same thing on all the systems, even the one that now works was doing the same thing until somehow I got it to work and I can't remember the steps ugh.... I kept activating deactivating clearing initializing it on that one too until it just out of no where worked....

 

Dell is of no help, they say it's a MS issue......... I have no issues with TPM chips on HP systems, on Lenovo thinkpads....... just these new Dell servers...... seems like a dell issue to me? all these systems are using the MS TPM 1.2 driver..... all those other vendor systems are using the same driver....

[Mindovermaster Global Moderator]

@BudMan time....

[neufuse Veteran]

well spent another darn day trying to figure this out..... Dell still is not help at all and says it's a MS issue..... MS says it's the OEM's problem since it's an OEM windows server license with OEM TPM hardware *rips hair out*

[neufuse Veteran]

well Dell sent out a new TPM module, and guess what....... same issue grrrrr

 

anyone have a clue what I am doing wrong? I've never had TPM issues before!

[Circaflex]

Maybe @T3X4Scan be of help, or can ask around as he is with Dell? I know @sc302 is pretty knowledgeable in this field as well. 

[sc302 Veteran]

Yep oem Windows version=Dell issue. 

 

That being said, it sounds like bios of life cycle controller (I really hate that thing...messes up too much crap). 

 

If you are having problems speak to a manager or their manager. Stop dealing with that support desk asap. They obviously can't identify the issue.  If it persists, ask/demand for another server.  

 

[neufuse Veteran]

On 7/8/2016 at 4:46 PM, sc302 said:

Yep oem Windows version=Dell issue. 

 

That being said, it sounds like bios of life cycle controller (I really hate that thing...messes up too much crap). 

 

If you are having problems speak to a manager or their manager. Stop dealing with that support desk asap. They obviously can't identify the issue.  If it persists, ask/demand for another server.  

 

I'm not sure what is going on exactly, we purchased another R230 to be a new Domain controller, so I tried it on that one also.... same problem..... that is three servers that are doing the same thing...... even took it up to the latest BIOS firmware and no help..... dell's product manuals seem to leave a lot to be desired interms of help..... they keep referencing MS technet articles on how to do this..... but none of that works

 

haven't had much luck still getting anyone at Dell to help, even the next steps up from the primary support just giving me a run around it seems like

 

I so wanted to get off HP hardware and migrate to dell but this is really pushing me the wrong way ugh....

[Mindovermaster Global Moderator]

2 hours ago, neufuse said:

I'm not sure what is going on exactly, we purchased another R230 to be a new Domain controller, so I tried it on that one also.... same problem..... that is three servers that are doing the same thing...... even took it up to the latest BIOS firmware and no help..... dell's product manuals seem to leave a lot to be desired interms of help..... they keep referencing MS technet articles on how to do this..... but none of that works

 

haven't had much luck still getting anyone at Dell to help, even the next steps up from the primary support just giving me a run around it seems like

 

I so wanted to get off HP hardware and migrate to dell but this is really pushing me the wrong way ugh....

There are other choices out there

[neufuse Veteran]

45 minutes ago, Mindovermaster said:

There are other choices out there

we've been down the IBM and cisco route before if that's what you mean? If not what are you other choices that are enterprise quality systems?

[Mindovermaster Global Moderator]

HP and DELL aren't the only companies with enterprise grade hardware.

[sc302 Veteran]

There is stratus.com.  But no where the price of hp, dell, ibm/Lenovo, or Cisco. 

[neufuse Veteran]

On ‎7‎/‎18‎/‎2016 at 3:45 PM, Mindovermaster said:

HP and DELL aren't the only companies with enterprise grade hardware.

aware of this....... I'm just saying we've been down the IBM server, cisco server, hp server and now dell server road, what else out there is enterprise level, I'm not saying there is none, I'm asking for names to look at

[neufuse Veteran]

Oh what the heck.... I just put in a Dell R530 with TPM 1.2 (brand new system)

 

SAME DARN ISSUES! We just got this server, just set it up went to bitlocker the drives and boom...... same thing.... all firmware is up to the latest.... This can't only be happening to me, this is yet another new dell server with the same issues..... am I just doing something wrong?! I am following dell's own deployment guides for the server to set this up which are not any different then the MS procedures really minus the Dell bios stuff

[sc302 Veteran]

No, but you may be the only one using bitlocker 

 

/ducks

[neufuse Veteran]

53 minutes ago, sc302 said:

No, but you may be the only one using bitlocker 

 

/ducks

*throws shoe at you*

 

or to remember the old IRC days *slaps you with a trout*

[neufuse Veteran]

well yay I guess? Had a dell support person actually get this to work remotely... strange thing is they didn't appear to do anything differently then we were doing and it worked on their first try?...... *throws hands up and walks away*

[sc302 Veteran]

It was the more magic switch he used.

 

http://catb.org/jargon/html/magic-story.html

[Gotenks98]

I would say bad batch of motherboards. We had a few systems come in with defective TPMs that would never reset the lock out. Had to replace the motherboard. This was on a brand new system.

[neufuse Veteran]

6 hours ago, Gotenks98 said:

I would say bad batch of motherboards. We had a few systems come in with defective TPMs that would never reset the lock out. Had to replace the motherboard. This was on a brand new system.

3 server class motherboards over the span of 4 months? I must have some bad luck then

 

I have no idea what they did, they appeared to do all the same stuff I did.....

 

1) Disabled the TPM in the system bios settings

2) reenabled it with pre-boot measures

3) cleared anything on the tpm

4) went into windows went to TPM management console, took ownership

5) system rebooted told it to accept the new ownership on boot (UEFI makes you say yes we want this change before it boots to windows)

6) start bitlocker (right here is where we'd get an access denied or could not talk to TPM update your BIOS message), but when they did it mysteriously nope, it went right to where do you want to save your recovery key (which we store them in AD and as files and that worked ok) encryption started, encryption finished..... reboot and it worked fine....