Thinkpads Forum

I recently reinstalled Windows XP over Vista, and when I reinstalled Client Security 8, whenever I login, it says it can't enroll me.

I found some old posts that recommended opening "tpm.msc," but this command doesn't seem to work. I also disabled and re-enabled the security chip from the CSS client, to no avail.

Anybody have a solution?

cannot remember exactly, but go into bios under security and clear previous settings. might be one specifically for TPM and/or FP reader

There was only one option, which was for the FingerPrint reader, and this didn't do the trick. I still can't enroll.

I even tried deleting my Finger Print data from the manager in Windows, but it still denies me.

What's going on?

I'm also wondering if it isn't possible to simply re-image the laptop, to factory defaults.

But will this reinstall Vista? Or will it reinstall XP?

See if the following will work.

Lenovo wrote:Symptom

After the security chip is cleared (or after the system board is replaced), the password recovery questions are not accepted. In addition the following error is displayed: "The answers you provided to the recovery questions were not correct. Would you like to retry?"

When the system board is replaced or the security chip is cleared, the security keys must be associated to the security chip. If this is not done, the Client Security Solution application will not function properly.

Solution

1. Run cssplanarswap.exe from the "Client Security Solution" folder to associate the keys with the security chip.
2. Run the Client Security Solution setup wizard to reconfigure the computer.

Client Security Solution 8.0 - Considerations

Thanks for the suggestion.

I get the message, "The Client Security keys could not be restored."

I'll try doing this again in Safe Mode.

EDIT: Is it possible to clear the security chip, as the above solution was written to correct? That is, clear it and then continue from there, as if I was starting from scratch. I could not find any useful information on Lenovo's site, or in the BIOS.

EDIT: I went into the BIOS and reset the ability to "Reset Hardware Password," or something similar. Upon restarting back into XP, it came up with an error message before prompting me for my password, saying that the Security Chip had been reset. However, I still cannot enroll.

After you cleared the Security Chip, did you do the two things listed in the Solution that I posted?

Of course. I still receive the same error message...

The Client Security keys could not be restored.

One other thing, it appears you need Rescue and Recovery version 4 installed.

ThinkVantage Client Security Solution 8.0

Yep, I have it installed. It just doesn't want to let me enroll...

Everytime I startup windows now, it says that the "security chip has been cleared or replaced," and to run the CSS wizard. However, this basically does... nothing. Same message whenever I restart, same result when trying the above solution, and same error when trying to enroll.

I don't mean to downplay the time and effort you've went into getting CSS8 to work, but as a friendly suggestion, I suggest not installing CSS8.0 at all. It is ONLY a glorified password storage program, nothing more.

I used to think it would provide some level of security protection between my OS and hardware, but it does not. The fingerprint reader software works fine on its own without CSS 8.0.

I think at one time Lenovo had high hopes of CSS 8.0 providing encryption security between the hardware and OS, much like Vista's Bitlocker, however, over time those features were scrapped and all that remained of the bloated mess of CSS was the password storage capabilities.

If that is still important to you, then please ignore this post and best wishes trying to get CSS8 installed. It's just that sometimes users (myself included) think that CSS8.0 offers some more value than it actually does, and they'd be better off without it

Yeah, I reached that same conclusion about two hours ago. I realized the only thing I really wanted was the ability to login, so it wasn't worth the effort... the password management was nice, but not the greatest.

Redmumba are you still interested in getting this to work? If so I can help. You are attempting to use CSS 8 under only one OS right? If so first un-install CSS 8, and reboot. Once you are back in XP and your system completes the removal, then reboot a second time, and only now go into the BIOS. Again go to the security chip and you'll see a new (different) set of options now, clear the chip. Save your new settings and reboot, reinstall CSS 8, and you will now be able to enroll.

Note you will lose anything stored in CSS by doing this, in your case that should not matter because you can't use it, in it's current state.

Gave this another shot, and I still do not have the options to clear the chip, even with a complete reinstall/uninstall of CSS8. The options are still the same:

Enable/Disable/Inactivate Security Chip
Security Reporting Options

I can understand your urge to get to the bottom of your CSS problem, but I can only reiterate an earlier contributor's suggestion to uninstall CSS because it doesn't really do anything useful. I removed it after wasting much time trying to resolve problems and its absence has made life simpler - and booting faster.

I'm not too worried about it, because I resolved to uninstall it, but just for the sake of completeness... I wouldn't mind trying.

Once you have un-installed CSS there are two areas in the BIOS where it is controlled. One enables one to enable the chip or disable the the chip, as always. The other that normally allows one to clear the fingerprints now allows one to reset the chip. The options here change. I apologize if that was not clearly stated.

Hi Redmumba

Had exactly the same problem

i had my system board replaced under warranty

and then i kept having this message come up, uninstalled CSS

reinstalled CSS, rebooted like 2000000 times in one day changed bios, reset security chips and all sorts of other crap!


after spending hours looking for a solution this is what worked for me. I had changed the name of my PC from the standard name. and when it came up with restore client keys it kept telling me i need to log in to do so but then didnt like my password it kept failing my authentication. So i changed my pc name back to factory original rebooted tried again and it worked a treat the security chip is now unlocked again