@dinhngtu Thank you for bringing the TPM validation profile to my attention. I see that there is yet another nuance to the firmware boot process I didn't fully understand. I'm going to dig into those TPM group policies to see what that's all about.