Maintenance and Service Guide

Table Of Contents
Table 6-2 Computer Setup—Security (continued)
Option Description
TPM State
Select to enable the TPM.
ClearTPM
Select to reset the TPM to an unowned state. After the TPM is cleared, it is also turned o. To
temporarily suspend TPM operations, turn the TPM o instead of clearing it.
IMPORTANT: Clearing the TPM resets it to factory defaults and turns it o. You will lose all created
keys and data protected by those keys.
TPM Activation Policy
F1 to boot
Allow user to reject
No prompts
BIOS SureStart
Verify Boot Block on every boot—Select to enable HP SureStart.
Dynamic Runtime Scanning of Boot Block—Veries the integrity of the BIOS boot block region
se
veral times each hour while the computer is running. Default is Enabled.
Sure Start BIOS Settings Protection—When enabled, HP Sure Start locks all critical BIOS settings and
provides enhanced protection for these settings using nonvolatile (ash) memory.
NOTE:
An administrator password must be set to activate this setting.
Enhanced HP Firmware Runtime Intrusion Prevention and Detection—Enables monitoring of HP
system rmware executing out of main memory while the operating system is running. Any
anomalies detected in HP system rmware that is active while the operating system is running
will result in a Sure Start security event being generated.
Sure Start Security Event Policy—Controls HP Sure Start behavior upon identifying a critical security
event (any modication to HP rmware) while the operating system is running.
Log Event Only—HP Sure Start will log all critical security events in the HP Sure Start audio log
within the HP Sure Start nonvolatile (ash) memory.
Log Event and notify user—In addition to logging all critical security events, HP Sure Start will
notify the user within the operating system that a critical event has occurred.
Log Event and power o system—In addition to logging all critical security events, HP Sure
Start turns of the computer upon detecting a HP Sure Start Security Event. Because of the
potential for data loss, HP recommends this setting only in situations where security integrity
of the system is a higher priority than the risk of potential data loss.
Smart Cover
Cover Removal Sensor (Disabled/Notify user/Administrator password)
Lets you disable the cover sensor or congure what action is taken if the computer cover is removed.
De
fault is Disabled.
NOTE:
Notify user alerts the user with a POST error on the rst boot after the sensor detects removal of
the cover. If the password is set, Administrator Password requires that the password be entered to boot
the computer if the sensor detects that the cover has been removed.
Intel Software Guard Extensions (SGX)
76 Chapter 6 Computer Setup (F10) Utility