Lenovo Carbon X1 Gen 13 TPM attestation issues

Question

Hi everyone,

I'm experiencing an issue with TPM attestation on my Lenovo X1 Carbon Gen 13 when trying to enroll the device into Windows Autopilot. The error I get is: Attestation timeout error

Observations:

• In Windows Security > Device Security, the TPM attestation status is stuck on "Loading...", whereas on another working device (different model), it correctly shows "Ready".
• I have two brand new X1 Carbon Gen 13s, both delivered this week, and both are experiencing the same attestation error.

TPM Status (tpmtool getdeviceinformation):

• Ready For Attestation: False
• Is Capable For Attestation: False
• TPM Manufacturer: ST Microelectronics (STM)
• TPM Spec Version: 1.59
• BitLocker PCR7 Binding State: Binding Not Possible

What I’ve Tried So Far:

• Updated to the latest BIOS from Lenovo's support site.
• Cleared and reset TPM in both Windows (Clear-Tpm) and BIOS.
• Switched from Discrete TPM 2.0 to Firmware TPM (if available, but couldn't find an option).
• Disabled Microsoft Pluton Processor Control and Intel TXT Feature in BIOS.
• Ensured Secure Boot is enabled.
• Restarted the Device Health Attestation Service.
• Checked network connectivity to Microsoft attestation servers (attestation.microsoft.com).

Still Facing These Issues:

• TPM remains "Ready for Attestation: False".
• Windows Security > Device Security still shows TPM attestation as "Loading...".
• Autopilot enrollment fails with an attestation timeout.

Has anyone else experienced this issue with Lenovo X1 Carbon Gen 13 and STM TPMs? Could this be a firmware issue? Is there an official Lenovo fix or a BIOS setting I might have missed? I can't find the TPM upgrade utility for the Gen 13, so I am unable to upgrade the TPM firmware.

Would appreciate any advice - thanks in advance!

Answer 1

It should output a crt file in the folder from where you launched the command... and you could open that one to find out what the ek cert looks like

Answer 2

We are still having this issue and now we bought 4 more laptops so total of 5 laptops Carbon Gen 13 are having this issue with pre-provisioning white glove autopilot attestation issue AIK Cert Enroll Failed! When we use https://www.powershellgallery.com/packages/Autopilottestattestation/1.0.0.34 powershell module to do test-autopilotattestation we get the error AIK Cert Enroll Failed!

Answer 3

I am also getting a TPM attestation issue on my Carbon Gen 13 which is causing attestation issues and not to do Autopilot pre-provisioning. Event logs shows AIK enrollment SCEP certificate failure. Lenovo says possibly a bad TPM chip and laptop is less than a month old.

The BIOS version is the latest 1.29 v_2 and all the drivers are installed including the all the chipset and Intel Management engine update.

Answer 4

Hello, Nayan Patel

Welcome to the Microsoft Community.

Thank you for your feedback on your issue here. Based on the troubleshooting steps you've already performed, the TPM validation issue you're experiencing on your Lenovo X1 Carbon Gen 13 may be related to TPM firmware or compatibility.

Since both of your problematic units are brand new and both exhibit the same behavior, this is most likely due to a known issue with the TPM firmware version, especially considering that it is manufactured by STMicroelectronics (STM) and is currently running version 1.59.

In this case, the next appropriate action is to contact Lenovo Customer Service directly for further assistance. A TPM or BIOS firmware update or patch may be required to resolve this validation issue. Additionally, make sure that you have installed the Lenovo updates related to Windows Autopilot and TPM validation.

Given that you've reset the TPM and performed other troubleshooting steps, the firmware may need to be flashed or reconfigured, which is where Lenovo Customer Service can help. They can also guide you in checking for specific configurations related to the BIOS setup to help resolve validation issues.

Support | Dell Singapore

Disclaimer: Microsoft provides no assurances and/or warranties, implied or otherwise, and is not responsible for the information you receive from the third-party linked sites or any support related to technology. 

Best regards

Bobhe | Microsoft Community Support Specialist

Answer 5

Both same errors that I am getting