TPM Embedded Security sub-menu missing on ZBook 17 G5 BIOS

[Joe_Y_SAT]

How do I enable TPM 2.0 in commercial UEFI BIOS on Zbook 17 G5? 

Zbook 17 G5 with updated BIOS Q70 01.28.00 shows no option for TPM in BIOS Security tab. "As delivered" specifications for this specific model and serial number state TPM 2.0 when delivered. HP white paper 919946-009 (thru 2024) and earlier versions -003 and -004 for the 2018/2019 BIOS manuals state there should be a TPM Embedded Security menu within the commercial UEFI BIOS.

The TPM sub-menu is completely missing.

Win 11 support page states Zbook 17 G5 tested Win 11 compatibility for Win 11 21H2 and 22H2 with compatible driver support.

But Win11 will not install because it states there is no TPM 2.0 on this machine.

If TPM 2.0 is supposed to be there according to specs, and it's supposed to be there according to the documentation, then how do I make it visible and enable it?

[resistencia]

Hi @Joe_Y_SAT 

Enter the BIOS and verify that it is not hidden.

BIOS document (hp.com)

[Joe_Y_SAT]

That image appears to be from the "BIOS Simulator" document available in support. Except the BIOS that it appears to simulate is listed as of 2018. In my current 2024 BIOS the section where those options would be available simply does not exist. 

There is no pull-down option to choose "Available" or "Hidden." 

If there's no TPM sub-menu, does this mean that the chipset (and/or BIOS) simply does not detect any TPM module?  Or has HP modified the BIOS to eliminate the option and not documented it? 

Can I potentially revert back to a 2018 version of BIOS for the purposes of "un-hiding" TPM and turning it on? If HP deleted the option, shouldn't that be documented somewhere in the release notes? 

I suppose the next min-risk option would be to reset all security options to factory default and see if the menu appears?

[resistencia]

even if you updated the BIOS it does not change your BIOS access or menus, it depends on the date when the model was manufactured. If you do not have that option in the BIOS I recommend you to load the default BIOS values or update your BIOS again.

[Joe_Y_SAT]

Reset security options to default and no change.

It appears that there is conflict within the system board that inhibits TPM. If no TPM, then also no TPM sub-menu.

I base this on two things:

1) I attempted a clean install of Win 11 on a brand new m.2 drive with no other drives present and Win 11 said no, due to no TPM. Therefore it's not a Windows driver or conflict issue since Windows didn't exist on the laptop.

2) In Windows System Information it states "TPM is not usable. PCR7 binding is not supported, UN-allowed DMA capable bus/device(s) detected, TPM is not usable."

So what "Un-allowed DMA capable bus/device(s)" might be present that are making TPM not usable - and possibly inhibiting the display of the TPM sub-menu, since it's not there?

[resistencia]

This error usually happens when you have disabled TPM and you have an encrypted drive, if you have BitLocker disabled

Download the following application that indicates the BIOS configuration, and in the browser you can type TPM to see the activation path.

HP Image Assistant | HP Client Management Solutions

[Joe_Y_SAT]

Thank you for diligently trying to help.

There's no TPM mentioned at all in the BIOS.

The only place any mention of TPM shows up is in software that is not installed on the target (my laptop) but is present on the reference. 

Of interest is that despite having used the HP auto-detect tool and having downloaded all the drivers is that the Image Assistant showed the Chipset driver was missing and a few other drivers were out of date. Device manager said the Chipset driver that was allegedly missing was actually installed and the best available. Intel Driver Asst also said it was current. Regardless, I used Image Assistant and installed a new version. It's happy with the Chipset now. 3 green dots. 

I tried to deprecate one BIOS version backwards to see if that would resolve the problem, but BIOS said the admin (me) had locked the BIOS, except that block was unchecked, so maybe there's some other policy that now blocks BIOS updates that wasn't present yesterday - when I updated the BIOS. Bitlocker is turned off. I set an admin password, then tried again, then deleted the password and tried again to re-install the current BIOS just in case. Nope. 

I'm about ready to give up. What should be present in the BIOS simply isn't there.

There is, apparently, no TPM at all on this machine. And for god only knows what reason, the BIOS "accurately" reflects that in an undocumented state where there is simply no TPM sub-menu to possibly turn it on or manage it. 

[resistencia]

That software indicates that someone tried to update the TPM, because that software is not installed. Have you done that?

question you are not the administrator of the laptop, if it is blocked by the administrator is that you are part of a group, in that case you should contact the administrator of your company.

[Joe_Y_SAT]

I'm 100% the laptop admin. 

However, I think I've ultimately determined the cause: there is no TPM chip on this model because it was sold to a non-US company that then sold it back to the US as part of a larger suite.

If I were really motivated, then perhaps I'd buy a new US board and transplant it in, because the reason for all the fuss is that the RJ-45 port is damaged, and when I tried to use a Thunderbolt port, the vendor provided Win10E 1607 got corrupted and wouldn't start. I figured I'd start fresh with Win11 - since HP says these laptops can handle. Maybe, but not this one. Win10P 22H2 seems about the best it gets.

I ran a PowerShell query based on info from a different thread. Solved: HP z840 no TPM BIOS options - HP Support Community - 8103194