PCR7 ISSUES

[zollqqqq]

My HP Omen is from 2020. The BIOS is fully up to date, Secure Boot is enabled, and TPM 2.0 is on. However, PCR7 still shows as “not in use.” Not sure why this is happening — any ideas?

To be exact this is what it says 

[BeemerBiker]

"Elevation required to view" means you need to run the app in administrator mode.

enter "msinfo32.exe" in the windows find box and select administrator mode

mine shows:  PCR7 Configuration Binding Possible

l.et me know if it does anything useful.

[zollqqqq]

i just did that and it shows this i am  wondering how can i change it to binding is possible,my bios is up to date and turned on and my tpm 2.0 is working,i do not know why the pcr7 is not possible

[BeemerBiker]

---

@zollqqqq wrote:

i just did that and it shows this i am  wondering how can i change it to binding is possible,my bios is up to date and turned on and my tpm 2.0 is working,i do not know why the pcr7 is not possible

---

I am not sure what you have done

Did your run that application as administrator?

The report "Elevation required to view" means you were in "user" mode and not in administrator or "elevated" mode.

[zollqqqq]

 i ran it as a  administrator and it said binding is not possible

[BeemerBiker]

This is what our friendly AI stays about PCR7

PCR7 binding is a crucial security feature in Windows Secure Boot where the Trusted Platform Module (TPM) locks the BitLocker encryption key to a very specific, trusted boot state, using Microsoft's own certificates; if the boot chain loads anything extra signed by a third-party certificate (like from a graphics card), PCR7 binding fails, triggering a "Binding Not Possible" warning, though BitLocker still works securely with standard PCRs (0, 2, 4, 11).

[zollqqqq]

Is there any ways to fix it and make the binding possible?

[BeemerBiker]

You have an expired or revoked certificate somewhere.

You might want to read this discussion.

There might not be anything you can do about it other than uninstalling the application or device causing the problem.

An Area51 system I had at one time failed to update the BIOS generating an error the certificate had expired.  

Indeed, it had expired, like 10 years earlier.  The certificate was referenced in the .exe that D.ell used to install the BIOS.  I booted into the BIOS setup of the Area51 and had the BIOS do the install.  That was a lot simpler than reverting back to windows 10 which didn't care about the certifcate.

Hope this helps you.

I assume you are trying to use bitlocker on the C drive.  I don't do that as too many things can go wrong.  I do use secure boot however.