Challenging Issue - Windows Updates, TPM, OS Drive Wiped
Challenging Issue - Windows Updates, TPM, OS Drive Wiped
Hi, I work with system integrators to do tech support. Since Mid-March I have had an influx of tickets with the following issue and I am hoping that I can find other people who have experienced this. Customer states that after a shutdown or restart their PC now only boots to BIOS (otherwise no known issues and PC was performing just fine). Upon inspection ALL drives are recognized by the bios, including documented OS drive, but no bootable device is found. At first I wasn't sure what was going on and couldn't really find anything around forums of similar issue, so I just had folks re-install Windows, drivers, etc. and then they've gone about their lives just fine. I've been digging around the internet though and have found other people with the same problem. One of my customers is also a high level IT professional (works with combatting ransomware and high level data recovery). After this happened to him the first time, he took his M.2 drive and attempted data recovery but could not find ANY! The second time around he hypothesized that it could be related to Windows Security Updates and TPM. However since it appears all data is lost on the drive, and since changing TPM settings from firmware to discrete can wipe the drive anyways, I have not been able to access any logs, events, etc. etc. So no way for me to pinpoint anything or provide any additional details outside of hardware related things. OS: Both Windows 10 and Windows 11 OS Drive Type: Gen 3 M.2 nVME, both nVME 1.3 and 1.4 Chipset: z590, z690, b550 and x570 (thus far) Various different processors, both 11th and 12th gen intel and Ryzen 5000 series. Both Radeon and nVidia GPU's. My latest customer had a TUF Gaming B550m-plus wifi board with bios version 2423 (from 8-17-2021). He says he had not made any changes to the bios himself. Speaking with the system integrator, they only enable XMP, but otherwise leave the bios settings alone. Seeing that this was a similar problem to all the others I asked the customer to first try resetting the BIOS to default settings. He did. The only thing that changed was TPM Firmware -----> Discrete. The default settings on that BIOS version have TPM on discrete. If neither him, nor the SI, changed the TPM setting to FIRMWARE, how did it change? After seeing that it was setting TPM back to discrete from firmware I told customer to stop (because doing so could wipe the data). Instead we went ahead an updated the bios to latest version, 2803 from 4-29-2022. After BIOS update, attempted to have him restart the machine, but same problem - it went back to BIOS and NO BOOT DEVICE found. So, I had him check TPM setting and it was indeed on FIRMWARE. Customer stated they were ok with possibly losing data so I said full send buddy, change it to discrete (maybe by some miracle we'll get a boot device). F10, save and exit, boots back to bios, no boot device and TPM IS BACK ON FIRMWARE DESPITE BEING CHANGED TO DISCRETE. I had him repeat this process 3 times and each time the TPM setting would go back to FIRMWARE. I am not an expert on TPM by any means, so I could be missing something or my train of thought could be erroneous. I would chalk it up to bad hardware but the amount of folks it has happened to, the time frame that it happens in, the criss-cross of hardware, that after a new install of Windows 10/11 everything works fine; I just can't imagine it isn't somehow related to TPM and Windows Updates. That's really the only pattern I've been able to discern. Yesterday I had a customer with the same issue (this is the third time it's happened to him) - he lives near me so I had him bring the PC by. I immediately took the drive out and attempted data recovery. There was literally NO DATA or even EVIDENCE that any data had EVER been on the drive. I know enterprise level drives have security chips/features that would allow for this type of security but I am not aware of such an ability with consumer grade SSD's. What is going on? Has anyone else experienced this problem? Any insight is appreciated. The "body count" on this issue is approaching 50 customers.
Others note that disabling TPM on certain devices is being done to avoid Windows 11 updates.
TPM modifications by themselves won<|pad|>,don't erase anything. The only scenario that might impact data is when BitLocker was active, then you'd still reach the bootloader asking for a recovery key. If the system doesn't start, it might mean CSM was turned on and Windows was installed in Legacy mode, after which it was disabled—this shouldn't occur naturally. Updates sometimes trigger BIOS changes, including silently updating BIOS settings to disable CSM and enable firmware TPM for newer Windows versions. This behavior is more common on prebuilt systems from major brands like Dell, HP, and Lenovo. It's possible that if you switched to a discrete BIOS module, the system might revert back to Firmware, though no discrete chip was found on the board.
I considered the CSM problem, but turning it on or off didn't make a difference. No boot file was detected yet.
This update affected many users at once. In October, the system wouldn't start properly and required a backup to another drive. After some research, it seemed the issue was limited to a small number of people. Once the Microsoft disk was wiped, the cables were switched back, and everything worked fine afterward. The situation improved, and she continued using Linux for work without issues. It appears updates were thoroughly tested by a community, unlike the testing process for Windows updates. The Microsoft reports suggest similar problems occurred with other users.
The disk that was wiped still retained a functional Windows 7 setup, sufficient for operating a somewhat finicky printer. A spare machine received the disk, Dukto was applied for file transfers, and documents destined for the color printer were routed there. It admits it doesn’t feel authentic, but we just instructed it to print. In the workshop, we’re prepared to enforce consequences for such issues—big hammers are on hand. If the entire system was erased, it would be a complete reset. It only makes me more satisfied that I switched to Linux over ten years ago and have continued guiding others there (even last night). For my needs, Linux Mint offers a supportive discussion board with helpful users.
Perhaps someday Windows will become an endless nightmare we attempt to ignore.
Another local user faced the same problem, drove the machine through recovery, but found nothing—no data left, no evidence, not even a partition or file table. The PC was functioning normally except for some pending Windows updates and a restart that went straight to BIOS without booting from any device. The OS drive was recognized by the BIOS. It was the same board, an ASUS TUF Gaming B550m Plus WiFi with BIOS version 2423. Really strange situation.