– For customers in Chinese Mainland with no TPM, or customers that require to disable TPM:OneCli.exe config set imm.TpmTcmPolicy "NeitherTpmNorTcm" --override --bmc :@– For customers in Chinese Mainland that require to enable TPM:OneCli.exe config set imm.TpmTcmPolicy "NationZTPM20Only" --override --bmc :@– For customers outside Chinese Mainland that require to enable TPM:OneCli.exe config set imm.TpmTcmPolicy "TpmOnly" --override --bmc :@3. Issue reset command to reset system:OneCli.exe misc ospower reboot --bmc :@4. Read back the value to check whether the change has been accepted:OneCli.exe config show imm.TpmTcmPolicy --override --bmc :@Notes:– If the read back value is matched it means the TPM_TCM_POLICY has been set correctly.imm.TpmTcmPolicy is defined as below:– Value 0 use string “Undefined” , which means UNDEFINED policy.– Value 1 use string “NeitherTpmNorTcm”, which means TPM_PERM_DISABLED.– Value 2 use string “TpmOnly”, which means TPM_ALLOWED.– Value 4 use string “NationZTPM20Only”, which means NationZ_TPM20_ALLOWED.– Below 4 steps must also be used to ‘lock’ the TPM_TCM_POLICY when using OneCli/ASUcommands:5. Read TpmTcmPolicyLock to check whether the TPM_TCM_POLICY has been locked , command asbelow:OneCli.exe config show imm.TpmTcmPolicyLock --override --bmc :@The value must be 'Disabled', it means TPM_TCM_POLICY is NOT locked and must be set.6. Lock the TPM_TCM_POLICY:OneCli.exe config set imm.TpmTcmPolicyLock "Enabled" --override --bmc :@7. Issue reset command to reset system, command as below:OneCli.exe misc ospower reboot --bmc :@During the reset, UEFI will read the value from imm.TpmTcmPolicyLock, if the value is 'Enabled' andthe imm.TpmTcmPolicy value is invalid, UEFI will lock the TPM_TCM_POLICY setting.The valid values for imm.TpmTcmPolicy include 'NeitherTpmNorTcm', 'TpmOnly', and'NationZTPM20Only'.If the imm.TpmTcmPolicy is set as 'Enabled' but imm.TpmTcmPolicy value is invalid, UEFI will rejectthe 'lock' request and change imm.TpmTcmPolicy back to 'Disabled'.8. Read back the value to check whether the ‘Lock’ is accepted or rejected. command as below:OneCli.exe config show imm.TpmTcmPolicy --override --bmc :@Note: If the read back value is changed from 'Disabled' to 'Enabled' that means the TPM_TCM_POLICY has been locked successfully. There is no method to unlock a policy once it has been setother than replacing system board.imm.TpmTcmPolicyLock is defined as below:Value 1 uses string “Enabled" , which means lock the policy. Other values are not accepted.Enable UEFI Secure BootOptionally, you can enable UEFI Secure Boot.Chapter 4. Hardware replacement procedures 219 |
