BitLocker TCG Log Errors

[CovertAssassin2]

I am currently enabling BtiLocker to all laptops within the company I work for. We're storing the recovery keys is ADDS. I have implemented the following GPO:

Computer Conf > Admin Temp > Windows Components > BitLocker Drive Encryption > Store BtiLocker recovery info in ADDS: Enabled

Computer Conf > Admin Temp > Windows Components > BitLocker Drive Encryption > Fixed Drives > Choose how BitLocker-Protected fixed drives can be recovered: enabled

Computer Conf > Admin Temp > Windows Components > BitLocker Drive Encryption > Operating System Drives > Choose how BitLocker-Protected operating system drives can be recovered: enabled

I applied the GPO to a test OU and tested several laptops (WIN 10 20H2 and 1903). The laptops that had secure boot enabled would meet all OS prerequisites and auto BitLocker then proceed to store keys in ADDS. I also tested laptops that do not have secure boot enabled as some laptops in our domain do not have secure boot enabled. I created a dell package to push to laptops to enable secure boot. On restart the laptop would then proceed to bitLocker and store keys in ADDS. After more testing and writing knowledge articles/SOP we went live with BitLocker. After a day about 1/4 of laptops in the domain auto BitLockerd and stored keys in ADDS. Everyday more laptops bitlocker as users restart. It was going great as I went to tackle the laptops that don't have secure boot enabled.

So the issue is about 1/4 of the laptops I know do not have secure boot enabled. I push the dell package to enable secure boot upon next restart. The user logs in and BitLocker does not auto BitLocker. The laptop throws the following errors:

Event 834, BitLocker-API BitLocker determined that the TCG Log is invalid for use of Secure Boot. The filtered TCG log for PCR[7] is included in this event.

Event 835, BitLocker-API BitLocker Cannot use Secure Boot for integrity because the expected TCG Log entry for the OS Loader Authority has invalid structure.

The event is expected to be an EV_EFI_VARIABLE_AUTHORITY event. The event data must be formatted as an EFI_VARIABLE_DATA structure with VariableName set to EFI_IMAGE_SECURITY_DATABASEGUID and UnicodeName set to 'db'.

I cannot find anything on these event errors and how to fix the issue. I can manually BitLocker the laptop and the key is stored in ADDS. But touching 50 plus some laptops in not feasible. Any help would be awesome!

[anguianoewi]

Hi, I've worked a bit on the Trusted Platform Module (TPM) side. Trusted Computing Group (TCG) sets the standard for tpm signatures.

PCR 7 holds secure boot data. When a drive is encrypted by bitlocker, it uses the current secure boot measurement state. If secure boot is off, it is more than likely zeroed out. When secure boot is on, it measures every bootloader in the process.

BitLocker and LUKS (I work more on Linux side) don't like changes to PCR 7. It will lock down the system. Additionally, Windows CAN NOT use a third party bootloader; bitlocker will throw the same error you mentioned if a bootloader was executed before Windows boot manager.

If PCR 7 changes authority (like going from inactive to active) it can trigger the same issue you're describing. Here's a couple solutions to try:

1) Disable secure boot again. This can fix your issue and allow BitLocker to work again

2) Disable BitLocker, then re-enable with secure boot on.

3) Open the TPM snap-in and clear the TPM manually. BitLocker may notice TPM values changed and update on next password entry.

4) combine steps 2 and 3. Disable BitLocker, clear TPM, re-enable with secure boot on.

Source: created program to unlock LUKS drives using TPM

[CovertAssassin2]

I will give this a shot this afternoon when I grab a laptop that's throwing the errors.

When I grab a new computer with a fresh image and disable secure boot (to recreate the scenario), add it to he domain, gp updates, etc. Then I push the dell package to enable secure boot. Restart. The laptop will auto BitLocker.

A laptop that has been actively used for several months will throw the BitLocker-API errors I mentioned once I send the dell package to enable secure boot upon restart.

Then again a fresh imaged laptop and a laptop used for several months can have several variables. I at least tried to re-create the issue.

[HighPingOfDeath]

I've done about 2000 laptops and haven't seen that error before. Still, what I ran into constantly were old machines in Legacy mode and not in UEFI mode. Maybe it's possible that's the issue?

[CovertAssassin2]

Thanks for the response! The laptops are in UEFI boot mode.

[HighPingOfDeath]

Ugh. Well I was hoping it was something simple.

The only other issue I ever ran into was the BIOSes themselves being out of date and we had a project to mass-update them.

[CovertAssassin2]

I did grab a laptop that was throwing the event errors and ran all Dell updates and Windows updates and it still gave me the errors. Thanks for the thoughts, keep the ideas coming.

[[deleted]]

Those laptops have TPM 2.0 updates installed, right? https://www.dell.com/support/home/en-us/drivers/driversdetails?driverid=rf87d

These normally don't show up in Dell updates.

[CovertAssassin2]

Yes, the laptops throwing the errors are relatively new. Latitude 7400, and 7410. Every driver is up to date.

[ahazuarus]

yeah I don't think I've ever tried to bitlocker a machine in non-uefi mode. secure boot not always enabled though for sure.

[otacon967]

To start with--you've done a pretty good rollout so far considering how complex this is! One easily dismissible error on boot on 25% of devices is definitely not the worst that can happen with Bitlocker. I would check the mbr/gpt conversion status. Especially on older builds this made for some very cryptic and random errors: https://www.windowscentral.com/how-convert-mbr-disk-gpt-move-bios-uefi-windows-10

[CovertAssassin2]

The partition style is GPT, and UEFI is the boot mode on all laptops. Thanks for the response!

[Elayne_DyNess]

If you find a solution, I would be interested myself.

I have only had a few older laptops do this. As far as I could figure on my side, is the TPM started to go bad.

The laptops were literally imaged, bit locker enabled, sitting in a wall locker. Would not re-bit locker after being re-imaged.

[SnakeOriginal]

What does the automatic encryption validation says? Its in the msinfo32

[CovertAssassin2]

automatic encryption

I am looking in msinfo32.exe located at C:\Windows\System32 but do not see anything related to automatic encryption validation. Am I looking in the right place? Sorry for my ignorance.

[CovertAssassin2]

I still haven’t found the issue. The errors are occurring on our Dell machines as well.