Hey Big Vern,
Lots of questions in this post.
You mention you're under a serious time crunch. I've read your post, but what is the end goal? Is it to enable TXT? I just want to make sure your issue gets resolved and documentation issues can be cleared up after.
I will try to address a few questions here:
"In the BIOS, I can highlight settings like the above and others (e.g., Intel Virtualization Technology), but I can’t change them. Neither the remote interface nor the on-screen keyboard lets me toggle anything. We’ve tried rebooting, resetting the KVM, etc., but no dice. Any idea why these settings seem locked?"
BIOS settings are managed by the BIOS policy, and changing BIOS settings is why we have the BIOS policy. Even if you're able to make changes, further changes down the road could overwrite your one-off BIOS configuration changes. You seem to already know since you acknowledged this detail and the fact that will be overwritten on reboot. Rather than "Why can't we change it manually in the BIOS when I shouldn't really be changing it manually anyways?" the question should be "How can I toggle this setting in the BIOS policy?" as you're not really supposed to making changes manually.
"In vCenter, we see that the hosts have passed attestation, but the TXT column shows false. My understanding was that enabling TPM should also explicitly enable Intel TXT."
TXT depends on TPM, but TPM does not depend on TXT.
I would not assume that enabling the base feature of TPM would also enable TXT. However, if you wanted to use TXT, you'd need to enable TPM. Your output would make sense if TPM is enabled, and TXT is theoretically disabled.
"Enable Intel TXT [Disable] Does this mean that TXT is currently disabled, and the displayed option is what I can switch it to (i.e., Enable it)? Or does it mean TXT is enabled and I’m looking at the option to disable it?"
My understanding is this would mean its disabled.
"Intel Virtualization Technology [Enable] Does this mean VT is actually enabled? Again, same confusion as the TXT question above. And just like before, this setting can’t be changed. Any ideas why?"
My understanding is this would mean its enabled. I definitely wouldn't turn this off if its an ESXi host. Regarding why you can't change it, I defer to my original response of "Make changes in a BIOS policy and not manually in a BIOS".
My question to you is - If your goal is to enable TXT, have you tried creating a test BIOS policy with that BIOS token specifically enabled, and applying it to a test host? I have checked my X210 M7 and its in nearly the exact same boat. I suspect if I made that change I would see txt change to "true".
I would agree that the documentation is a bit unclear if if TXT is enabled by default and I'll take a look and see if this is something I can ask another team to look into.
Disclaimer - as always, test changes on a test box and not prod
