Toshiba Tecra M5 BIOS support for Bitlocker in TPM mode?

I have a Tecra M5 (PTM51E) running Vista Ultimate. I would like to
configure Bitlocker using the TPM which is on board. I am aware that
Bitlocker can be used without a TPM, but this requires the user to have
an external token e.g. on a USB drive which they have to insert at boot
time. I would rather use the TPM mode so there will be no need for this.


I have flashed the BIOS to v3.60 which is the latest. Before I was able
to flash the BIOS from within Vista (which is the only option provided
on the Toshiba European support site) I found I had to load the drivers
for the "Value Added Package", without this the BIOS updater simply says
"Computer not supported". Another way to do it is get the BIOS for the
PTM51U from the US site which allows you to write the BIOS updater onto
a bootable floppy.

I used the "Bitlocker Drive Preparation Tool" which is available as an
"Ultimate extra" from Microsoft to set up the partitions as required by
Bitlocker, i.e. my 40 GB hard drive is divided into a main partition to
be encrypted C of 35.7 GB and a separate partition S of 1.5 GB.

I have the "Trusted Platform Module" driver v3.00.1135.00 which is the
latest. Having enabled the TPM in the BIOS (hold ESC when powering on
and then hit F1, second page) I can then go into the Infineon Security
Platform Initialisation Wizard and set the "Platform Owner" and other
passwords etc.

The TPM initialisation wizard automatically opens the Bitlocker config
applet when it finishes (or you can get to it any later time via the
control panel).

The message I get from the Bitlocker applet is:

"Your system is not configured to use BitLocker Drive Encryption. The
BIOS did not correctly communicate with the Master Boot Record (MBR).
Contact the computer manufacturer for BIOS upgrade instructions".

Does anybody have this working on an M5 (i.e. Bitlocker with TPM)? How
did you do it?


--
matthewj9

I got that message when trying to set up bitlocker on my machine.
I turned off in the bios the boot sector virus protection and was good to
go.


"matthewj9" <matthewj9.344e22@no-mx.forums.net> wrote in message
news:matthewj9.344e22@no-mx.forums.net...
>
> I have a Tecra M5 (PTM51E) running Vista Ultimate. I would like to
> configure Bitlocker using the TPM which is on board. I am aware that
> Bitlocker can be used without a TPM, but this requires the user to have
> an external token e.g. on a USB drive which they have to insert at boot
> time. I would rather use the TPM mode so there will be no need for this.
>
>
> I have flashed the BIOS to v3.60 which is the latest. Before I was able
> to flash the BIOS from within Vista (which is the only option provided
> on the Toshiba European support site) I found I had to load the drivers
> for the "Value Added Package", without this the BIOS updater simply says
> "Computer not supported". Another way to do it is get the BIOS for the
> PTM51U from the US site which allows you to write the BIOS updater onto
> a bootable floppy.
>
> I used the "Bitlocker Drive Preparation Tool" which is available as an
> "Ultimate extra" from Microsoft to set up the partitions as required by
> Bitlocker, i.e. my 40 GB hard drive is divided into a main partition to
> be encrypted C of 35.7 GB and a separate partition S of 1.5 GB.
>
> I have the "Trusted Platform Module" driver v3.00.1135.00 which is the
> latest. Having enabled the TPM in the BIOS (hold ESC when powering on
> and then hit F1, second page) I can then go into the Infineon Security
> Platform Initialisation Wizard and set the "Platform Owner" and other
> passwords etc.
>
> The TPM initialisation wizard automatically opens the Bitlocker config
> applet when it finishes (or you can get to it any later time via the
> control panel).
>
> The message I get from the Bitlocker applet is:
>
> "Your system is not configured to use BitLocker Drive Encryption. The
> BIOS did not correctly communicate with the Master Boot Record (MBR).
> Contact the computer manufacturer for BIOS upgrade instructions".
>
> Does anybody have this working on an M5 (i.e. Bitlocker with TPM)? How
> did you do it?
>
>
> --
> matthewj9

The Tecra M5 doesn't have BIOS-based antivirus protection for boot
records etc. so far as I can tell.

Were you using a Tecra M5?


--
matthewj9

It isn't antivirus as such, I think this setting just prevents a virus from
writing to it. This will also prevent Bit locker from clearing it if this
feature is enabled.

"matthewj9" <matthewj9.349ciz@no-mx.forums.net> wrote in message
news:matthewj9.349ciz@no-mx.forums.net...
>
> The Tecra M5 doesn't have BIOS-based antivirus protection for boot
> records etc. so far as I can tell.
>
> Were you using a Tecra M5?
>
>
> --
> matthewj9

Yes I understand - a BIOS setting which prevents ANY program from making
changes to the hard drive's boot record - something which a virus might
want to do, but which the user won't want to do very often (perhaps only
when they install the OS).

I have looked very carefully through both screens of the v3.60 BIOS
system setup on the Tecra M5 and I cannot see such a setting.

Am I missing something or are you simply using a different PC?

Thanks M.


--
matthewj9

I am using a Asus motherboard. I had the very message that you said;

"Your system is not configured to use BitLocker Drive Encryption. The
BIOS did not correctly communicate with the Master Boot Record (MBR).
Contact the computer manufacturer for BIOS upgrade instructions"

but I have successfully gotten bit locker to work. It seems to me that the
only thing I did was to disable the virus feature in the bios.

"matthewj9" <matthewj9.349gp5@no-mx.forums.net> wrote in message
news:matthewj9.349gp5@no-mx.forums.net...
>
> Yes I understand - a BIOS setting which prevents ANY program from making
> changes to the hard drive's boot record - something which a virus might
> want to do, but which the user won't want to do very often (perhaps only
> when they install the OS).
>
> I have looked very carefully through both screens of the v3.60 BIOS
> system setup on the Tecra M5 and I cannot see such a setting.
>
> Am I missing something or are you simply using a different PC?
>
> Thanks M.
>
>
> --
> matthewj9

I had the opportunity to ask someone from the hardware team at Microsoft
about this. It is a well known problem with the M5 they have come across
internally. Here is what he said:

---
:uring Toshiba Tecra M5 there was a transition from Intel Core Duo
processors to Intel Core 2 Duo Processors. All systems coming with Intel
Core 2 Duo processors were released after the final TPM/BitLocker
specification was released, therefore their BIOS included the right
Boot-block and EC/KBC BIOS firmware (this is different from the normal
BIOS).::
::::
::In order to make systems with Core Duo procs to work with BitLocker,
you need to flash a new Boot-block and EC/KBC BIOS firmware in addition
to the normal BIOS.::
::::
::It's easy to find out if a system has Core Duo or Core 2 Duo
processor... you only need to take a look at the msinfo32 information
for each system. If the processor is a T2xxx family, it is Core Duo; if
it is T7xxx, then it is Core 2 Duo.::
---

In other words, to get an M5 with Intel Core Duo to work with
Bitlocker, you need an additional firmware update as well as the BIOS
update. Toshiba do not publish this extra firmware - it's not available
on their site for download.

I have spoken to Toshiba support about this. They suggest sending all
80 of our Tecra M5s to an authorised support provider who will carry out
the firmware update for us and return them.

This is useless from our point of view - the 80 laptops are currently
in the hands of 80 staff driving all over the UK. What we really want is
the firmware so we can apply it ourselves.


--
matthewj9