4 ms·
Why? You're not booting Windows again, and restoring the secure boot state and boot order to the original values will result in the PCR values being what they w
by mjg59 2y ago
Why? You're not booting Windows again, and restoring the secure boot state and boot order to the original values will result in the PCR values being what they were before, so what's changing that would force recovery mode?
- dogma1138 2y agoThe TPM tracks the state of the secure boot and the bios, that log is stored in the TPM itself the next time you’ll try to boot into windows it will see that something happened and bitlocker will lock itself out. Do this experiment. Boot into any Linux live CD on a machine with bitlocker enabled. Reboot and see what happens.
- mjg59 2y agoNo, the TPM doesn't retain PCR measurements over reboots, and the log (rather than the composite PCR value) is handled by the firmware and the OS and the TPM has no idea it exists.
- aspenmayer 2y agoIt seems that this is a property of TPM 1.2. > On devices with TPM 1.2, changing the BIOS or firmware boot device order https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview https://learn.microsoft.com/en-us/windows/security/operating...
- vel0city 2y agoI did that last night. It didn't have any issues booting back into Windows after booting to a live USB. I didn't change any parameters of the Windows boot option or the rest of the system.
- aspenmayer 2y agoIt seems that this is a property of TPM 1.2. > On devices with TPM 1.2, changing the BIOS or firmware boot device order https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview https://learn.microsoft.com/en-us/windows/security/operating...
- vel0city 2y agoYeah I seem to recall every time I've done that it seems to auto boot fine when I change it back to what it was before. And as mentioned it's never had issues if I did a one off choice from the boot menu.
- mjg59 2y agoChanging it will trigger recovery, changing it back to the original won't
- MoreMoore 2y agoIt doesn't matter if you change the settings back. I don't know how it works, but something non-user configurable is changed that prompts Windows to require a reset of the TPM keys.