Secure Boot + FDE fails on Dell OptiPlex 7020 (2024, 13th Gen Intel) – TPM stays empty, "Operating system has no signature" error

Product support balenaOS
1

Hardware:

  • Dell OptiPlex 7020 (2024 refresh, Intel 13th Gen Core CPU, Intel UHD Graphics 770/Intel PTT fTPM)
  • Device type: generic-amd64
  • balenaOS 7.7.0+rev1 (also tried latest via dashboard download)

Setup steps performed (per official docs):

  1. Enabled Custom Mode under Secure Boot → Expert Key Management → deleted all keys (PK/KEK/db/dbx) to enter Setup Mode
  2. Verified TPM 2.0 Security enabled, SHA-256 selected
  3. Downloaded SB&FDE-enabled flasher image via balenaCloud dashboard (“Enable Secure Boot and Full Disk Encryption” toggle)
  4. Flashed to USB via balenaEtcher, booted with monitor attached (per forum advice re: PCR1 instability)

Symptoms observed:

  • Installation/flashing completes normally (LEDs off, device powers down as expected)
  • On subsequent boot: boot loop, brief Dell logo then restart
  • BIOS Event Log shows nothing except repeated restarts
  • After installation, TPM shows as empty/Clear in BIOS – suggests key sealing never completed
  • Tried switching “Secure Boot Mode” from Deployed Mode to Audit Mode – resulted in a different error: “Operating system has no signature”
  • Also tried manually enrolling the .auth key files found on the USB stick via BIOS “Replace from file” (db → KEK → PK order) – same result
  • TPM “Clear” setting appears to not persist/reset properly across reboots in some tests (possible separate firmware quirk)
  • “Enable Microsoft UEFI CA” was also disabled in one attempt, no change

Question for the team:

  • Is Dell OptiPlex 7020 (2024) a known-incompatible or untested device for SB&FDE?
  • Given the TPM never gets sealed at all (not just PCR1 instability across boots, but literally empty after full flash+install), could this indicate the key enrollment step itself is failing/being interrupted on this firmware, rather than the previously-documented PCR1-drift issue?
  • Any diagnostic tooling available (referenced in an earlier thread) to check PCR stability/enrollment success on this hardware?
2

@rainern,

Thank you for the good detail. Which specific Intel 13th gen processor are you using? In particular, it would be good to know if that processor has vPro Enterprise. I’m guessing it does because you mentioned Deployed Mode, but would like to confirm.