Windows starts with EventID208 and 235...

tfwul · 3 Weeks Ago

The first thing that is logged when booting my PC is:

EventID208
Measured Boot library encountered a failure and entered insecure state. InitState: 1, StatusCode: 3221225473, Failure Address: 132964067, Reference Address: 134295520, Reason: 1.

Then EventID235
Windows boot environment failed to initialize TPM device. StatusCode: 3221225474, Position: 1.

Then again EventID208
Measured Boot library encountered a failure and entered insecure state. InitState: 1, StatusCode: 3221225473, Failure Address: 2908777298, Reference Address: 2910017248, Reason: 1.

Then again EventID235
Windows boot environment failed to initialize TPM device. StatusCode: 3221225474, Position: 1.

Does anyone out there know what this means?
Any solutions?

Thanks.

WIndows 10 x64 19045.4412

dalchina · 3 Weeks Ago

Given

Windows boot environment failed to initialize TPM device

you might consider (with due care)
https://learn.microsoft.com/en-us/wi...hip-of-the-tpm

for example.

tfwul · 3 Weeks Ago

I am very sorry to say, was a bit in a hurry, forgot to say : my PC is not equipped with a TPM chip..

dalchina · 3 Weeks Ago

Also see:
TPM support

- can be implemented in firmware.

And a particular example is in some cases applicable to Intel CPUs:

Windows TPM.msc can manage Intel PTT in the same capacity as the discrete TPM.

For computers equipped with the Intel PTT, the TPM menu option is not available in the BIOS. Instead, an option for PTT Security appears under the Security settings menu in the BIOS (Figure 2). This can cause confusion when trying to enable BitLocker on a computer where Intel PTT is disabled.

tfwul · 3 Weeks Ago

Thanks for the above.

As for TPM.msc: Windows 'says': 'Compatible TPM can not be found' (blah-blah)

I wonder whether the above warnings may havce something to do with Bitlocker - VHDx
Automount at startup (in TaskScheduler)
Also, the first EventLog error is dated 15-03-2024

Same as Bitlocker folder modified date.

Windows starts with EventID208 and 235...-snagit-27052024-111700.png

dalchina · 3 Weeks Ago

Considering your mobo:

TPM 2.0 was introduced back in 2015, and all ASUS motherboards feature version 2.0. To check, press the Windows key + R to bring up the Run box. Type in "TPM.MSC" to open the Windows TPM management tool. The TPM Management screen will pop up if the feature is enabled, allowing you to view additional TPM information

(TPM 1.2 prior to that).

It might not be enabled.

Also see the options here:
Verify Trusted Platform Module (TPM) Chip on Windows PC

This shows how to enable it on an ASUS mobo
https://www.youtube.com/watch?v=x7mf...el=ASUSSupport
Note that the Intel version mentions PTT as I suggested.

If you're using Bitlocker- note it can be used without TPM support, but it works differently:
https://learn.microsoft.com/en-us/wi...ion/bitlocker/

On devices that don't have a TPM, BitLocker can still be used to encrypt the operating system drive. This implementation requires the user to either:

use a startup key, which is a file stored on a removable drive that is used to start the device, or when resuming from hibernation
use a password. This option isn't secure since it's subject to brute force attacks as there isn't a password lockout logic. As such, the password option is discouraged and disabled by default

Both options don't provide the preboot system integrity verification offered by BitLocker with a TPM.

So... are you using bitlocker, and is it working as if you have TPM enabled- or not?

tfwul · 2 Weeks Ago

Sorry for the late reply. I was out, most of the day, yesterday.

My PC has nothing with regards to TPM, it is a pre-TPM PC...
Asus X99 Deluxe 3.1
BIOS does not show PCH_FW Configuration, only PCH.
It has some sort of 'connector' whatever and I believe can add a TPM chip or so (?)
(In the old days)

Am considering buying a new one this year, but still have to figure out the components.
Asus Mobo that's for sure.
(Just checked C drive with CrystalDiskInfo, the SSD has been running 35885 hours now, "Good: 97%", rounded off 11 hrs p/day and without hardware problems)

Anyway, that aside, yes I am using Bitlocker, VHDX. As said, they automount at start up.
Added a link to the drives on the desktop.
Just double click on the desktop button/link and a popup shows up prompting for a password.
Works flawlessly.

Are there any problems to be expected when TPM is enabled and whilst using VHDX ?

thanks again.

Best regards.

tfwul · 1 Day Ago

Matter seems to be solved...

The errors mentioned in my first post, it looks like they had something to do with an external SSD drive being plugged in into the USB port of my keyboard.
FWIW - not sure whether it matters - there is a VHD drive on that SSD. That VHD drive should be mounted and opened manually, i.e. it is just a file, like any other file on that drive.

Anyway, the SSD was plugged in, day in, day out and a drive letter was assigned to it after booting my PC.

I unplugged the drive. Errors are gone.