How Enable Keyboard via Thunderbolt in BIOS for use with HDD Password when lid closed?

[pkiff]

Does anyone know how to enable an external keyboard attached via Thunderbolt in order to type in an HDD or Power-On password?

I often have my X1 Carbon Tablet (3rd ed) plugged into a Thunderbolt 3 Dock with its keyboard attached and lid closed.
I also have a BIOS-enabled HDD password that requires me to type in the HDD password before Windows will load.

When my X1 boots up in a docked state, I see the password prompt on my external monitor, but my keyboard is not enabled. So I have to open up the X1 itself and type the HDD password on the actual X1 keyboard before Windows loads. After Windows loads, then I can close the X1 up and use my external keyboard to log into Windows and do all other work as normal.

In the BIOS there are a lot of different settings related to Thunderbolt and USB and Security, and I just wonder if someone knows the right combination I need? (I don't want to disable all my security related to Thunderbolt and USB if I can help it, since that would partly defeat the purpose of having full disk encryption to begin with.)

[dr_st]

On my X1 Carbon 5th Gen I had to set Config --> Thunderbolt 3 --> Support in Pre Boot Environment --> USB Device --> Enabled.

[pkiff]

Thanks. I got it working now, though the option names in my X1 Carbon Table 3rd gen are slightly different in the current BIOS:
Config --> Thunderbolt 3 --> Support in Pre Boot Environment --> Thunderbolt Device --> "Pre-Boot ACL"

There is no "USB Device" listed in the "Support in Pre Boot Environment" menu on my BIOS - even though my user manual lists that menu item there. I think some recent X1 Tablet BIOS update must have changed the options available in that menu. I first tried setting the "Thunderbolt Device" value to "Enable," but the keyboard didn't work for entering the password in that setting, so I had to set it to "Pre-Boot ACL".

Also, I changed the Config --> Keyboard --> Enumerate setting to ON, though I'm not 100% sure if that is necessary. Changing that setting alone does not enable the keyboard, and it may or may not be necessary in conjunction with the Pre-Boot ACL setting.

Lastly, some random info I found on the Interwebs recommends changing the Thunderbolt security settings to "No Security". This was not necessary in my case. My Security setting is still set at User Authorization - which I think means that each device must be authorized prior to use. I authorized the keyboard via the Thunderbolt desktray widget in Windows 10 before getting it to work for the HDD password during boot.

Phil.