Boot Device Not Found When Switching Off Legacy Mode

[IT_WinSec]

---

@halexmay wrote:

I am not an advanced user and I have no idea how to reinstall Windows. I think Windows came pre-installed on this machine. It has a Windows Pro sticker on it but no product key code. In any case, even if I could work out how to reinstall, I have no idea how I could reinstall and not end up with a system identical to what I have now that does not work.

I followed the advice in the link that you sent about how to set up the group policy to allow BitLocker without a compatible TPM. This changed nothing on the BitLocker setup despite what the instructions say. It didn't prompt for a password and it didn't succeed. The error message was identical. All of this can be seen in the two attached screenshots.

As for your other questions:

- The computer is owned by a business. My wife, whose computer this is, is a senior manager in the business and has full authority to make any changes that she wants.

- I am not sure who installed Windows and neither is my wife. We think it came pre-installed, but we are not sure.

- My wife is quite happy to enter a password when she boots up the computer if that is necessary.

---

Hello again,

Please, check these out first:

• Here is more info what a TPM is >> https://en.wikipedia.org/wiki/Trusted_Platform_Module
• Difference between Legacy mode (CSM mode) and Secure boot >> https://www.intel.com/content/www/us/en/support/articles/000006942/boards-and-kits/desktop-boards.ht...
• What is BIOS and what is UEFI >> https://www.howtogeek.com/56958/htg-explains-how-uefi-will-replace-the-bios/

Based on what I see now, I assume your PC model has TPM 2.0 . Actually, since July 28, 2016, all new device models, lines or series must implement and enable by default TPM 2.0

TPM 1.2 (legacy version) is fine with legacy boot mode on, but TPM 2.0 requires UEFI mode / security boot / to be enabled (legacy mode off), along with secure boot for TPM to fully function. That is why you now see "reduced" message for the TPM.

Enabling Secure boot now may not be possible directly because your Windows 10 has been installed in MBR mode (BIOS mode). Now enabling UEFI mode fails to recognise the drive and you cannot boot. This is all because WIndows now has been installed in Legacy mode with different partition table , most likely with MBR (master boot record), as opposed to the non-legacy requirement of GPT (GUID partition table).

You should reinstall Windows with GUID/GTP partition table to enable Secure boot now and Windows must not be installed in Legacy mode.

Alternative way (slightly more risky) - the latest Windows 10 build now includes a relatively new tool, which allows a MBR install to be converted to GPT with one line from CMD…

The following command run from an elevated (administrator) command prompt will allow you to convert the current disk to GPT.

C:\WINDOWS\system32\mbr2gpt.exe /convert /allowFullOS

Here are details >> https://docs.microsoft.com/en-us/windows/deployment/mbr-to-gpt

After conversion is completed, you need to restart your device and change your BIOS settings to re-enable/enable UEFI along with secure boot [Secure Boot ON, Legacy mode OFF]. Here is additional advice >> https://support.hp.com/nz-en/document/c04784866

If you decide to reinstall Windows , though:

Instructions how to reinstall Windows in general >> https://www.youtube.com/watch?v=QAvFm52IjI4

You should use Rufus and install the installation media in UEFI mode / GTP partition table >> here are details >> https://www.windowscentral.com/how-create-windows-10-usb-bootable-media-uefi-support

Once ready with the USB installation device, load the BIOS (F9), enable Secure Boot, disable Legacy mode and save the changes. Eventually, boot from the device (F10)

Choose the option to "Repair your computer" and open Command Prompt (CMD)

Open DiskPart and follow these steps to convert the drive to GTP partition table (be careful to select the proper primary HDD number)

Video reference >> https://www.youtube.com/watch?v=f81qKAJUdKc

When ready, exit CMD and install Windows as normal.

Finally, Secure Boot should be enabled and Windows will be in UEFI mode. Therefore TPM 2.0 should be fine with this and Bitlocker can be installed.

Problem is that your current Windows version is Enterprise LTSB edition. This edition is not publically available. I am not sure where you will find the installation ISO image for it and the license key / license methods.

[IT_WinSec]

The steps provided above are just for your information and details.

Because this is a business owned computer and since we talk about security related things, I strongly recommend you DO NOT perform them on your own. I would recommend you leave this to the user of the PC (e.g. your wife) and then she contacts her internal helpdesk or IT support team. They should be able to provide more information about Bitlocker, enable or disable it based in the corporate policies...

If additional information is needed, they may reach to Microsoft support for business users or may also reach to HP Support for business.

Additionally, the license for Enterprise LTSB is more special and the image is not publically available.

[halexmay]

mbr2gpt.exe does not exist on this version of Windows and I have found no help in trying to add it.

I am not prepared to start using a third-party product (Rufus) just to reinstall Windows. This should not be necessary.

[halexmay]

This organisation does not have an IT department.

[IT_WinSec]

Could you provide me with the product number (p/n) of this HP device - here is how to find it :

>> http://support.hp.com/us-en/document/c00033108

Please, do not post the serial number (s/n)

Find the product information on the System Information screen in the BIOS.

1. Shut down the computer.
2. Press the Power button, and then immediately press the Esc key repeatedly until a startup menu displays.
3. Press the F1 key or select System Information from the Startup Menu.
   The product information displays.
   

Please, elaborate who installed Windows initially on this device ?

---

@halexmay wrote:

This organisation does not have an IT department.

---

[IT_WinSec]

---

@halexmay wrote:

mbr2gpt.exe does not exist on this version of Windows and I have found no help in trying to add it.

I am not prepared to start using a third-party product (Rufus) just to reinstall Windows. This should not be necessary.

---

Rufus is a free small utility  and does not require any preparation. It's just one time run and it adds convenience.

The Windows installation media [not considered 3rd party] can create original installation media but only for Home and Pro editions, Enterprise (LTSB) is not supported.

[halexmay]

The product number is: W4Q06EA#ABU

We believe Windows came pre-installed on this machine.

[halexmay]

I am not prepared to start using a third-party product (Rufus) just to reinstall Windows. This should not be necessary.

[IT_WinSec]

---

@halexmay wrote:

The product number is: W4Q06EA#ABU

We believe Windows came pre-installed on this machine.

---

Ok,

Thank you for the provided information.

You can see the official product specs document >> http://h20195.www2.hp.com/v2/GetDocument.aspx?docname=4AA6-5199EEE&doctype=data%20sheet&doclang=EN_G...

This PC comes with either no OS preinstalled (a.k.a. FreeDOS), or it comes with Windows 10 Home and Pro preinstalled.

The Windows Pro sticker may be an indication that it has a key/license for Windows 10 Pro, embedded into BIOS >> http://www.cnet.com/news/windows-8-moves-to-bios-based-product-keys/

You might check if a key is present in the BIOS by using a free tool like this (ProduKey) >>

Download ProduKey from Nirsoft >> http://www.nirsoft.net/utils/product_cd_key_viewer.html

x86 Windows >> http://www.nirsoft.net/utils/produkey.zip

x64 Windows >> http://www.nirsoft.net/utils/produkey-x64.zip

Extract the archive and run the program.

It will open and show you the available keys it detects. Does it detect your BIOS key(s) ? If it does, you may write it down. If such a key is present, the PC will have an original Windows 10 Pro license key.

Windows 10 Enterprise LTSB is a special edition of Windows which costs a lot and is meant to be "special purpose" edition. It does not come preinstalled on any device and is available only for big organizations and corporations using Volume Licensing agreement with Microsoft and Microsoft partners. If it "came preinstalled" or if you are not sure who installed it, it might be illegal/pirated version of Windows.  HP does not preinstall Enterprise editions of Windows.

• If the computer comes with Windows preinstalled, it's recommended that this proper version gets installed. It's free to install it now - you just need to use the appopriate tools from Microsoft
  
  
• If the computer has no BIOS key embedded and no licence - such may need to be purchased from Microsoft.

Also, if this a business owned device, it's the authorized users or business owner of the device who needs to perform these changes

[halexmay]

There is a BIOS OEM Key. There is no indication as to which version of Windows this key applies to. Is there any way to check that?

Have you considered whether this version of Windows might be an Education version? That would be appropriate as the organisation is a school. Presumably, contrary to what you say, it would have been a cheaper rather than a more expensive version.

Of course, we already tried reinstalling Windows using the Microsoft tool and got an error message saying that Windows would not run on this PC (see above).

As stated previously, my wife has full authority to work on this PC and to make changes to it. I am only trying to help her to get the information that she needs.