Hardware
The models this fleet runs, and the settings that follow the machine rather than the organisation. A driver one model needs and another does not belongs here, not on every device by hand.
Third workplace model.
- Enter the firmware - F2 during boot; Secure Boot to setup mode.
- PXE-boot the installer - F12, pick the network entry.
- Confirm the target disk - nvme0n1 is wiped.
- Seal to the TPM - Driven by the console after first boot.
Configure this model · dell-latitude-5440
Written as a policy filtered on this model, so it carries a reason and shows up in the audit trail.
Eval-only virtual profile used by the example overlay.
- Boot the installer - PXE-boot the VM on the imaging network.
- Confirm the target disk - The demo profile installs to /dev/vda.
Configure this model · demo-vm
Written as a policy filtered on this model, so it carries a reason and shows up in the audit trail.
Second workplace model. Same disk layout as the Lenovo, different firmware key.
- Enter the firmware - Esc then F10. Clear the Secure Boot keys to reach setup mode.
- PXE-boot the installer - F9, pick the network entry.
- Confirm the target disk - nvme0n1 is wiped.
- Seal to the TPM - Same ceremony as every other model; the console drives it.
Configure this model · hp-elitebook-840
Written as a policy filtered on this model, so it carries a reason and shows up in the audit trail.
The workplace laptop the simulated fleet runs. Fingerprint reader needs its own driver; see the Hardware page.
- Enter the firmware - F1 during boot. Set Secure Boot to setup mode so the console can enrol its keys.
- PXE-boot the installer - F12, pick the network entry the station serves.
- Confirm the target disk - nvme0n1 is wiped. There is no second disk in this model.
- Seal to the TPM - After the first boot the console seals the LUKS key; the recovery key is escrowed and the device forgets its copy.
Configure this model · lenovo-t14-g4
Written as a policy filtered on this model, so it carries a reason and shows up in the audit trail.
Configure this model · lenovo-t495s
Written as a policy filtered on this model, so it carries a reason and shows up in the audit trail.