Using scripting or automation for TPM firmware updates from Dell

If you require scripting or other automation from Dell regarding the update and management of your TPM devices, reference the information and steps provided in this article.

Cause information is not available.

Frequently Asked Questions about TPM Automation

Can Dell provide an automated script to update TPM firmware or activate a TPM?

No. Dell can provide the steps and utilities necessary for updating the TPM firmware, but we are unable to provide a script. Scripting is something customers need to do themselves as every environment is different.

Can a customer completely automate the TPM firmware update via script?

Latitude, Precision, and OptiPlex systems support automation via a combination of PowerShell and Dell Command Configure(DCC). This is due to an additional function called "PPI bypass Clear" that is featured on these models.

It is recommended that the person scripting the TPM firmware update be familiar with the Win32_Tpm WMI class by reviewing the information at the following link: Win32_Tpm class .

What can be automated?

• TPM enable: Automation available using Dell Command Configure "PPI Bypass Enable" option.
• TPM is disabled: Automation available using Dell Command Configure "PPI Bypass Disable" option.
• TPM Clear: Automation available using Dell Command Configure "PPI Bypass Clear" option and PowerShell to request clear.
  • Dell Command Configure has a clear listing, but this is only to reflect the option in BIOS and will not push a clear to the system
• Change Hash Algorithm: Automation available via Dell Command Configure.

Is there a silent installer option for TPM firmware?

Yes. The current version of TPM firmware posted at Dell's Support website supports use of the /s switch which will allow silent install.

How Can I find the TPM firmware Version?

The TPM firmware version can be seen when running the installer. It will tell you the current version and the version you are about to install. You can also get the firmware version by running get-tpm command from a Powershell window run as administrator.

While Windows 7 and above can read the TPM firmware version using PowerShell, it does not display the FULL version number. Only in Windows 10 version 1703 (RS2) and higher can you see the full version and only with a TPM that is in 2.0 Mode (Figure 1).

Figure 1: Windows 10 1703 showing TPM full version number

Automating TPM Ownership

Dell enables TPM by default on any system that ships with Windows 10. Systems with the TPM not yet enabled can be remotely enabled via scripting on Skylake and Kaby Lake systems via Dell Command Configure using the BIOS option for PPI Bypass Enable.

If a TPM is owned, but disabled Dell Command Configure will not enable the TPM. This is working as designed and is in place as a security measure. There is no supported method for enabled a TPM in 2.0 mode with this configuration. PowerShell will have to be used to send the command to enable and activate a TPM in 1.2 mode.

Example, (get-wmiObject -class Win32_Tpm -namespace root\cimv2\security\microsofttpm). SetPhysicalPresenceRequest (22)

Automating TPM Firmware Update

These steps can be scripted or done manually using combinations of Dell Command Configure and PowerShell:

1. Check TPM firmware version to see if update is needed
   • PowerShell get-tpm command can be used to verify current version. This can be sent to file and parsed to verify if an update is necessary.
2. Suspend any security using the TPM- Example Suspend/Decrypt Bitlocker
   • Automation means varies by program
3. Disable Windows Auto Provisioning if needed (Windows 8/10)
   • PowerShell command: Disable-TpmAutoProvisioning
4. Update BIOS - to ensure PPI bypass options added
5. Use Dell Command Configure to set a BIOS password
   • CCTK --SetupPwd=<BIOS Password>
6. Enable the PPI bypass for clear using Dell Command Configure
   • CCTK --TpmPpiClearOverride=Enabled --ValSetupPwd=<BIOS Password>
7. Clear TPM
   • Requires PowerShell commands and cannot be done via Dell Command Configure
8. Run TPM firmware update
   • The Dell TPM Firmware can be run using the "/s" switch to run silently
9. Disable the PPI bypass for clear using Dell Command Configure
   • CCTK --TpmPpiClearOverride=Disabled --ValSetupPwd=<BIOS Password>
10. Enable Windows Auto Provisioning and if needed and reboot or take ownership of the TPM
    • PowerShell command: Enable-TpmAutoProvisioning
11. Enable any TPM based security such as Bitlocker

How do I know if a system can be flashed with a new TPM firmware?

Dell offers a variety of systems with different TPM solutions. You can verify if a system supports a TPM firmware update by visiting the Dell support site and looking under "Drivers & Downloads" for that model. TPM firmware updates will be listed under the "Security" category.

Recommended Articles

Here are some recommended articles related to this topic that might be of interest to you.

• How to Successfully Update the TPM Firmware on your Dell Computer
• Trusted Platform Module (TPM) Frequently Asked Questions for Windows 11
• TPM Option Is Missing in the System BIOS Setup Latitude, Precision, or XPS
• How to Troubleshoot and Resolve Common Issues with Trusted Platform Module (TPM) and BitLocker
• How to Enable the TPM (Trusted Platform Module)