Sager machines don't have TPM but Clevo builds do?!?

I just tried to enable BitLocker on my machine for the first time only to find out that it appears my machine doesn't have a TPM module? I know for a fact that Eurocom's P377SM-A had TPM (see Eurocom X8 - http://www.eurocom.com/ec/configure(2,253,0)ec - in fact, even their X5 had TPM 1.2 standard), never knew that it was an optional component... Seems like a stupid thing to cheap out on.

Wow, looking at Sager's site, not even the P870DM/NP9870 has TPM.

Eurocom actually made an announcement about it that I just dug up.

http://www.eurocom.com/ec/release(245)ec

HM76, HM87, and X79 machines from them all have TPM so why would Sager skip something so important? I never used Bitlocker before because I thought it would have an impact on my SSD speed - well I just found out today that my Crucial drives are both SED and suffer zero performance impact because they already natively encrypt everything, its just going to waste without Bitlocker enabled. Hooray.

I pulled the manual from Clevo and it does indeed talk about the TPM. I also checked my Sager manual and it has instructions for activating it as well so what's the deal here?

EDIT: I just checked to make sure and my 2007 Toshiba X205-S9359 had a TPM chip, my 2009 M17xR1 had a TPM chip, my Intel Bad Axe 2 motherboard had a TPM chip, and my Maximus VI Formula has a header for a TPM chip that can be picked up for less than 15 bucks online. I don't expect TPM on a budget machine like my Inspiron 17R N7110 (which I just checked and did not have it) but on a high end machine, its pretty unacceptable to not have it, especially since it makes Intel's TXT useless as well and it also takes away part of Secure Boot. Heck, Sager didn't even have the keys installed for Secure Boot, I had to manually register them!

 

TPM is one of those optional items that can be added in to a model, depending on who is selling it. Similar to how some places might be able to offer 4G wireless cards in them. Clevo offers it, is listed as a "Factory option" on their spec list, and it is up to the selling company if it is added or not.

 

That's really not a good policy in a world that is pushing for full TPM adoption. Windows 10 only gives me the option for USB authentication thanks to that oversight which means I'd have to have a few well-hidden flash drives lying around and make sure I remove the one I'm using whenever I leave my computer. It also means I'd either have to print out the recovery PIN or upload it to the cloud. What a huge inconvenience to save a few bucks. =/

 

Yeah, from what I've seen, it isn't a commonly asked for feature really. From the brands and models we sell, not a lot of other manufacturers add it, mostly it is found on "business" notebooks. I wish it was an option on more models, but I don't think the demand is there...

 

It would be nice if it was a simple module that could be plugged in and the computer told not to start without it.

 

Well that's essentially the USB key option. I wouldn't have a major issue with that if it wasn't for the fact that I would have to print out and store a recovery PIN in case I ever lost the drive or it failed or I'd have to compromise security by making multiple USB keys.

I just find it irritating that something that costs virtually nothing and offers a lot of benefits even outside of encryption (Windows uses it with Secure Boot to actually add even more layers of security for example) is considered optional when Microsoft themselves are set to start requiring it.

 

Under W10 with BitLocker, even without TPM, you may still configure any option of your choice for unlocking the system drive at boot time:
- a USB stick (containing the .bek startup key + optionally several .txt recovery keys for other drives);
- a password of your choice;
- both (...not necessarily simultaneously).

If have enabled both ways of unlocking the system, using the password on a daily basis (at home & on the go) but with the usb stick (hidden in a safe place) as a backup... in case of early Alzheimer onset.

manage-bde + gpedit.msc is your friend.

edit: and for the record, TPM was optional too on low-end Clevos W650/670SZ... mine lacks it unfortunately.

 

Yeah I have done the edits, it just would be a lot more convenient if I could use the TPM chip. Considering the AES 256-bit SED encryption standard on my SSD, trying the drive to the TPM would be the most secure way of doing it.

 

so its not possible to buy it, if it isn't included from the factory?

 

Only through the before mentioned use of a usb device.

 

Yeah but that's not a TPM chip, its a standard USB drive that has a key file on it. Much less secure than TPM.

 

It would need to be added from Clevo before shipping to the selling companies, as any models I have seen don't have spot where it could be added later.