HP EliteBook 840 G4 BitLocker key each boot

[OleJacob]

We are using Windows 10 with BitLocker as disk encryption and stores the key in AD.

Have automated the Win 10 deploy process and have successfully deployed 840 G1, G2 and G3, but now with 840 G4 it asks for the BitLocker key each boot.

Any suggestion on what has changed with 840 G4 to cause this behavior?

[FitzLibProp]

We're dealing with the same issue.

Have tried:

Setting TPM Activation Policy to "No prompts". Same result.

Setting Configure Legacy Support and Secure Boot to "Legacy Support Disable and Secure Boot Enable/Disable". Both resulted in not being able to boot.

Suspending BitLocker, rebooting, and reenabling BitLocker. Same result.

Can't deploy any of these laptops until this is working.

[Crispy-Marvel]

Having same issue.

Tried everything that FitzLibProp has tried.

Updated BIOS and tried encryption again

Cleared TPM and tried encryption again
Made sure all updates were completed and all othewr software installed before commencing encryption.

I noticed that the TPM version is 2.0 on the G4s were on the G3 and previous the verison is 1.2. Bitlocker should work on 2.0 so I don't know if this is releated to the issue or not.

Would really like to get this sorted soon

[Nerrad]

We had the exact same issues with an Elitebook 745 G4

Update to post:

We imaged two laptops out of the box changing no settings, one laptop had the issue the other did not have the issue, the only difference was one of our images contained only G3 drivers and the other contained both G3 and some Dell drivers...the image containing both G3 and Dell drivers caused the issue.

I am currently still removing drivers to determine the fault

[Crispy-Marvel · Accepted solution]

Hi all,

Got the issue resolved by doing the converting from MBR to GPT

• Plug in USB configured to Windows PE
• Boot up Laptop pressing F9 to get to Boot Menu
• Choose the UEFI –USB
• Wait until wpeinit completes
• Type mbr2gpt.exe /validate /disk:0 and check if it was successful
• Type mbr2gpt.exe /convert /disk:0 and check if it was successful
• Close to restart
• Reboot and press F10 to get into BIOS
• Advance > Secure Boot
• Disable both Legacy and Secure Boot.
• Save changes and boot.
• When logged back in Check Disk Manager to see if conversion was successful in the disk's properties (Right Click Disk > Properties > Volume (Partition Style should be GPT)

Hope this helps others

[Nerrad]

Thank you Crispy-Marvel we are now imaging using the GPT Partition and all works fine on HP EliteBook 745 G4

[B1lly]

I tried to follow your instructions Crispy-Marvel, however I was forced to suspend bitlocker first. Then I converted to GPT and rebooted the computer. Didn't disable Legacy and Secure Boot (i.e. I left Legacy enabled and Secure Boot disabled). 

Tried to activate Bitlocker, got an error saying: "An Error Occurred The System cannot find the file specified".

Renamed ReAgent.xml to ReAgent.old, the file can be found in: C:\Windows\System32\Recovery\

Was then able to reenable bitlocker and now I can reboot without the bitlocker-prompt. 

However this small workaround takes a while to perform, since I need to enter the bitlocker-code 2 times during the tasksequence and then do the above. 

[Johnboy007]

Same issue here

Worth noting this is our second shipment of the 840 G4s and in the first shipment we had no issues whatsoever.

I have exported the BIOS settings out and done comparrisons and there are no notable configuration changes, yes the BIOS revisions are 6 months apart with 1.02 vs 1.05 (the later being the failing devices). TPM activates without issue and the OS seems to bahave in its normal fashion and on every 2nd reboot the BitLocker key prompt is recieved. To me this is not an OS issue and the question is what is triggering the OS from accessing the disk outside of the normal boot process.

For the time being I will simply bypass turning on BitLocker in the Task Sequence for this model but keen to get to the bottom of it as it contradicts our security prinicpals..perhaps a problem with the M2

[B1lly]

Just an update on how we solved the problem in our environment. 

We added a conversion to UEFI/GPT before installing windows in our task sequence. The disk will be formatted and partitioned as a GPT disk, since then we haven't had any problems installing windows 10 with bitlocked on our G4's. 

[thedentist33]

elitbook 820 g4 ! downgraded the bios from 1.05 to 1.03 fixed it for me ! it seems that with bios version 1.05 the task sequence cannot recognize uefi/gpt