Symptoms

If you require scripting or other automation from Dell regarding the update and management of your TPM devices, reference the information and steps provided in this article.

Cause

Cause information is not available.

Resolution

Frequently Asked Questions about TPM Automation Can Dell provide an automated script to update TPM firmware or activate a TPM? No. Dell can provide the steps and utilities necessary for updating the TPM firmware, but we are unable to provide a script. Scripting is something customers must do themselves as every environment is different. Can a customer completely automate the TPM firmware update using script? Latitude, Precision, and OptiPlex systems support automation using a combination of PowerShell and Dell Command Configure(DCC). This is due to an additional function called "PPI bypass Clear" that is featured on these models. It is recommended that the person scripting the TPM firmware update be familiar with the Win32_Tpm WMI class by reviewing the information at the following link: Win32_Tpm class What can be automated? NOTE: Some of these features may require BIOS updates, Dell Command Configure 4.0 or newer, and a BIOS administrator password be set. TPM enable: Automation is available using Dell Command Configure "PPI Bypass Enable" option.TPM is disabled: Automation is available using Dell Command Configure "PPI Bypass Disable" option.TPM Clear: Automation is available using Dell Command Configure "PPI Bypass Clear" option and PowerShell to request clear. Dell Command Configure has a clear listing, but this is only to reflect the option in the BIOS and will not push a clear to the system Change Hash Algorithm: Automation is available using Dell Command Configure. Is there a silent installer option for TPM firmware? Yes, the current version of TPM firmware posted at Dell's Support website supports use of the /s switch which allows silent install. How Can I find the TPM firmware Version? The TPM firmware version can be seen when running the installer. It tells you the current version and the version you are about to install. You can also get the firmware version by running the get-tpm command from a Powershell window run as administrator. While Windows 7 and above can read the TPM firmware version using PowerShell, it does not display the FULL version number. Only in Windows 10 version 1703 (RS2) and higher can you see the full version and only with a TPM that is in 2.0 Mode (Figure 1). Figure 1: Windows 10 1703 showing TPM full version number Automating TPM Ownership Dell enables TPM by default on any system that ships with Windows 10. Systems with the TPM not yet enabled can be remotely enabled using scripting on Skylake and Kaby Lake systems using Dell Command Configure using the BIOS option for PPI Bypass Enable. NOTE: Dell Technologies recommends updating the TPM firmware on any Skylake or Kaby Lake system shipping prior to November 13 of 2017 before using the TPM. If a TPM is owned, but disabled Dell Command Configure does not enable the TPM. This is working as designed and is in place as a security measure. There is no supported method for enabled a TPM in 2.0 mode with this configuration. PowerShell has to be used to send the command to enable and activate a TPM in 1.2 mode. Example, (get-wmiObject -class Win32_Tpm -namespace root\cimv2\security\microsofttpm). SetPhysicalPresenceRequest (22) Automating TPM Firmware Update These steps can be scripted or done manually using combinations of Dell Command Configure and PowerShell: Check the TPM firmware version to see if an update is needed PowerShell get-tpm command can be used to verify current version. This can be sent to a file and parsed to verify if an update is necessary. Suspend any security using the TPM- Example Suspend/Decrypt BitLocker Automation means varies by program Disable Windows Auto Provisioning if needed (Windows 8/10) PowerShell command: Disable-TpmAutoProvisioning Update BIOS - to ensure that PPI bypass options addedUse Dell Command Configure to set a BIOS password CCTK --SetupPwd= Enable the PPI bypass for clear using Dell Command Configure CCTK --TpmPpiClearOverride=Enabled --ValSetupPwd= Clear TPM Requires PowerShell commands and cannot be done using Dell Command Configure Run TPM firmware update The Dell TPM Firmware can be run using the "/s" switch to run silently Disable the PPI bypass for clear using Dell Command Configure CCTK --TpmPpiClearOverride=Disabled --ValSetupPwd= Enable Windows Auto Provisioning and if needed and reboot or take ownership of the TPM PowerShell command: Enable-TpmAutoProvisioning Enable any TPM based security such as BitLocker How do I know if a system can be flashed with a new TPM firmware? Dell offers various systems with different TPM solutions. You can verify if a system supports a TPM firmware update by visiting the Dell support site and looking under "Drivers & Downloads" for that model. TPM firmware updates are listed under the "Security" category. NOTE: Only a limited range of Skylake and Kaby Lake systems support both TPM 1.2 and 2.0 modes. To swap modes, you must flash the firmware to the correct mode. Any system that does not list both in the "Drivers and Downloads" section, does not support swapping modes. See these Dell Knowledge Base articles for related information: How to Successfully Update the TPM Firmware on your Dell ComputerTrusted Platform Module (TPM) Frequently Asked Questions for Windows 11TPM Option Is Missing in the System BIOS Setup Latitude, Precision, or XPSHow to Troubleshoot and Resolve Common Issues with Trusted Platform Module (TPM) and BitLockerHow to Enable the TPM (Trusted Platform Module)

Support Cases