HP Elite X2 1012 G1 Bitlocker issue

[GaryKn]

I've been working with 3rd level support. They are working on a new version of system bios and possibly TPM firmware that they hope will fix the problem.

[virtuoboy]

We faced similar issues with the second batch of x2 1012 G1 we received. but in our case I realized that in BIOS > Advanced, "Configure Legacy Support and Secure Boot" "Legacy Support Disable and Secure Boot Enable" was not selected.

After we made this change, we didn't have recovery screens

[f0rkb0mb]

My company also has issues with BitLocker, however are issues are slightly different. I did come across an issue similar to the one being described before though,

In regards to the tablet failing the BitLocker checks, I found, like virtuoboy, that SecureBoot was not enabled in BIOS. I restored the BIOS to defaults (verifying that SecureBoot is now on) and reimaged the device. I was able to get BitLocker to pass the checks and encrypt properly.This was with Bios versions 1.15 and 1.16.  

Please note: If SecureBoot was not enabled, and you go to enable it you may lock yourself out of the OS. It's best to just reimage the device.

Hope this helps. I know HP hasn't been the best with support for these devices so it's reassuring to see others are having the same issue. I thought for a second there we were doing something wrong.

[Wennze]

Hello,

yes thats right. In the BIOS is Ssecure Boot disable and Legacy boot enable.

We install our Machines with Empirum, which ist not certified.

And we have no Option to change after the Install Process to Secure Boot, because the Os ist not reconized after the Change.

[SandyWood]

We're having a similar issue with our Elite X2 1012 G1 tablets. We're deploying Windows 10 with Microsoft tools (MDT 2013) and using USB sticks to deploy with. If we deploy the image in Legacy boot mode and then BitLocker it, the system requests the recovery key at each reboot.

If we image the tablets in Secure Boot Mode (UEFI), there's an issue with the system rebooting into the deployment USB stick. Regardless of the boot order settings in BIOs, it just wants to reboot back into USB.

Would really love to be able to encrypt these tablets.

[GaryKn]

An HP rep I work with has said they will likely publish a new BIOS in November that fixes this. I can't imagine why it is taking so long since they already have a working version (I tried the beta, and before you ask, no, not generally available).

Your flash disks should be able to boot with Secure Boot enabled. If not, are you sure your MDT environment is up-to-date? 2013 update 2, I think? Also, I don't know whether it will work to add things to the flash drive after you image it. Try just making it fresh and then boot. The flash drives have to be fat32 also.

Best of luck,

Gary

[SandyWood]

Thanks for the update Gary. I would like to see it earlier as well since we're just beginning to deploy a bunch of tablets.

I can boot a FAT32 USB stick with Secure Boot enabled and kick off our MDT 2013 w/Update 2 Task Sequences. My issue is that after laying down the initial image and rebooting, the system boots right back into USB again, not the SATA drive. This doesn't occur in Legacy Boot. I've gone into the BIOS and made sure that the SATA is first in the boot order, Saved and exited but it just keeps doing the same thing. I did run the command-line BIOS configuration utility to dump the BIOS settings and it showed the USB as first. Not very encouraging.

I hope the November update fixes things.

[f0rkb0mb]

Thanks for the info Gary, I hope that the Novemeber BIOS update fixes all these BitLocker issues but I'm skeptical. Even if it doesn fix this, employing this fix to devices in the field will be a pain. 
HP is still being very vauge in regards to any known BitLocker issues to our company, it's incredibly frustrating.

[AMGonzales]

Looks Like HP released a suppose fix for the bit locker in Version 01.17 Rev.A BIOS 

Unfortuantly its still not working and its still making the nerv racking beeping sound which they said this update would get rid of.

__

Version:01.17 Rev.A (26 Aug 2016)

Fixes

- Fixes an issue where a system with Intel Active Management Technology (AMT) enabled does not power on properly (boot) from a USB drive connected to the system.

- Fixes an issue where the system prompts for the BitLocker recovery key to be input every time the system is powered on after the BIOS is updated.

- Fixes an issue where the system does not power on properly after Trusted Platform Module (TPM) 2 settings are cleared in the F10 BIOS menu.

- Fixes an issue where the battery information does not update properly in HP PC Hardware Diagnostics UEFI utility.

- Fixes an intermittent issue where the base keyboard does not function properly after the keyboard is connected to or disconnected from the system while the system is running (hot plug/unplug).

Enhancements

- Removes the feature where the BIOS emits a sound (beeps) throughout the BIOS update.

- Adds the Automatic DriveLock feature to the BIOS menu.

- Removes the BIOS lock feature in HP Advanced Wireless Docking.

[f0rkb0mb]

DONT UPDATE TO 1.17 - our HP rep said it's a bad version and should have been pulled from their website 2 days ago. It bricked one of our tablets before we got a reply from them. You can't go back either... not even flashing it with a USB.