TPM Management

TPM Management is a Microsoft Management Console (MMC) snap-in that allows administrators to interact with Trusted Platform Module (TPM) Services. TPM Services is used to administer the TPM security hardware in your computer. The TPM Services architecture provides the infrastructure for hardware-based security by providing access to and assuring application-level sharing of the TPM.

This help file contains topics in the following areas:

  • Overview of TPM Management

  • Using the TPM Management Snap-In

  • Managing the Trusted Platform Module

  • Setting Up the TPM for First Use

  • Understanding Keys and Passwords Used by the TPM

  • Troubleshooting TPM Management

  • Resources for TPM Management


Overview of TPM Management

TPM Management is a Microsoft Management Console (MMC) snap-in that allows administrators to interact with Trusted Platform Module (TPM) Services. TPM Services is used to administer the TPM security hardware in your computer. The TPM Services architecture provides the infrastructure for hardware-based security by providing access to and assuring application-level sharing of the TPM.

What is a Trusted Platform Module?

A TPM is a microchip designed to provide basic security-related functions, primarily involving encryption keys. The TPM is usually installed on the motherboard of a computer and communicates with the rest of the system by using a hardware bus.

Computers that incorporate a TPM can create cryptographic keys and encrypt them so that they can only be decrypted by the TPM. This process, often called "wrapping" or "binding" a key, can help protect the key from disclosure. Each TPM has a master "wrapping" key, called the storage root key, which is stored within the TPM itself. The private portion of a key created in a TPM is never exposed to any other component, software, process, or person.

Computers that incorporate a TPM can also create a key that has not only been wrapped but is also tied to certain platform measurements. This type of key can only be unwrapped when those platform measurements have the same values that they had when the key was created. This process is called "sealing" the key to the TPM. Decrypting the key is called "unsealing." The TPM can also seal and unseal data generated outside of the TPM. With this sealed key and software such as BitLocker Drive Encryption, you can lock data until specific hardware or software conditions are met.

With a TPM, private portions of key pairs are kept separate from the memory controlled by the operating system. Keys can be sealed to the TPM, and certain assurances about the state of a system—assurances that define the "trustworthiness" of a system—can be made before the keys are unsealed and released for use. Because the TPM uses its own internal firmware and logic circuits for processing instructions, it does not rely on the operating system and is not exposed to vulnerabilities that might exist in the operating system or application software.

Trusted Platform Module Services components

The following table details the individual components that comprise the TPM Services feature set.

TPM component | Purpose
TPM driver | The TPM driver is a kernel-mode device driver designed for TPM security hardware that conforms to the Trusted Computing Group (TCG) 1.2 specifications. Conforming to TCG 1.2 provides more platform stability and eliminates the need for vendor-specific device drivers.
TPM Base Services (TBS) | TBS is a service that provides sharing of the limited resources on the TPM. TBS acts as the resource controller for all applications that are using the TPM.
TPM Windows Management Instrumentation (WMI) provider | The TPM WMI provider exposes common TPM configuration tasks to administrators programmatically. Administrators can write a script that uses this provider.
TPM Management snap-in | The TPM Management snap-in exposes common TPM configuration tasks to administrators through a user interface. Administrators can use this snap-in to access the TPM Initialization Wizard.
TPM Initialization Wizard | The purpose of the TPM Initialization Wizard is to turn on and configure the TPM to work with applications or services that use the TPM, such as BitLocker Drive Encryption.

For more information, review other topics in this help file and the resources listed in Resources for TPM Management.


Using the TPM Management Snap-In

TPM Management is a Microsoft Management Console (MMC) snap-in. You can run TPM Management as a stand-alone console or add it to any MMC.

This section contains the following topics:

  • Start TPM Management

  • Add the TPM Management Snap-In to MMC


Start TPM Management

TPM Management is a Microsoft Management Console (MMC) snap-in. You can run TPM Management as a stand-alone console or add it to any MMC. To start TPM Management as a stand-alone console, you can use Windows Explorer or a command line.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To start TPM Management by using Windows Explorer

  1. Click Start, click All Programs, click Accessories, and then click Run.

  2. In the Open box, type tpm.msc, and then press ENTER.

  3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.
To start TPM Management by using a command line

  • At a command prompt, type tpm.msc, and press ENTER.

Additional considerations

  • You can configure your own MMC that includes TPM Management as part of that console. For more information, refer to "Additional references" in this topic.

  • Depending on the configuration of your computer, the User Account Control prompt may or may not appear. It will not appear if you are logged on with the built-in Administrator account (the local Administrator account is disabled by default in this version of Windows).

  • If User Account Control is enabled, it can be configured to allow non-administrators to enter the credentials of an administrator to complete administrative tasks without being a member of the Administrators group.

  • By default, members of the local Administrators group have sufficient rights and privileges to complete this task. In your environment, security may be managed such that non-administrators have additional rights.

Additional references

  • Add the TPM Management Snap-In to MMC


Add the TPM Management Snap-In to MMC

TPM Management is a Microsoft Management Console (MMC) snap-in. You can run TPM Management as a stand-alone console or add it to any MMC.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

Add the TPM Management snap-in to MMC

  1. Click Start, click All Programs, click Accessories, and then click Run.

  2. In the Open box, type mmc, and press ENTER.

  3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  4. On the File menu, click Add/Remove Snap-in.

  5. In the Available snap-ins list, click TPM Management, and then click Add.

  6. In the Select Computer dialog box, click Local computer.

    Note

    You can also use this method to manage the Trusted Platform Module (TPM) on a remote computer.

  7. Click OK, and then click OK again.

Additional considerations

  • Depending on the configuration of your computer, the User Account Control prompt may appear. It will not appear if you are logged on with the built-in Administrator account (the local Administrator account is disabled by default in this version of Windows).

  • If User Account Control is enabled, it can be configured to allow non-administrators to enter the credentials of an administrator to complete administrative tasks without being a member of the Administrators group.

  • By default, members of the local Administrators group have sufficient rights and privileges to complete this task. In your environment, security may be managed such that non-administrators have additional rights.

Additional references

  • Managing the Trusted Platform Module


Managing the Trusted Platform Module

This section contains the following topics:

  • Store TPM Recovery Information in Active Directory Domain Services

  • Clear the TPM

  • Reset the TPM Lockout

  • Turn the TPM On or Off

  • Command Management


Store TPM Recovery Information in Active Directory Domain Services

Active Directory Domain Services (AD DS) can be used to store Trusted Platform Module (TPM) recovery information.

There is only one TPM owner password per computer; therefore, the hash of the TPM owner password is stored as an attribute of the computer object in AD DS. The attribute has the common name (CN) of ms-TPM-OwnerInformation.

Active Directory requirements

To store TPM information in AD DS, all domain controllers must be running Windows Server 2003 with Service Pack 1 or later. You also need to install schema extensions if all domain controllers are running Windows Server 2003.

Step-by-step instructions

For step-by-step instructions for configuring AD DS and Group Policy to support the storage of recovery and owner information, see BitLocker Drive Encryption Configuration Guide: Backing Up BitLocker and TPM Recovery Information to Active Directory (http://go.microsoft.com/fwlink/?LinkId=140308).

Additional references

  • Windows BitLocker Drive Encryption Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkId=140225)

  • Windows Trusted Platform Module Step-by-Step Guide (http://go.microsoft.com/fwlink?linkid=139769)


Clear the TPM

Clearing the Trusted Platform Module (TPM) resets the TPM to an unowned state. After clearing the TPM, you need to complete the TPM initialization process before using software that relies on the TPM, such as BitLocker Drive Encryption.

Important

Clearing the TPM can result in the loss of data. To avoid data loss, make sure you have a backup or recovery method for any data protected or encrypted by the TPM.

After the TPM is cleared, it is also turned off.

To temporarily suspend TPM operations, turn the TPM off instead of clearing it. For more information, see Turn the TPM On or Off.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To clear the TPM

  1. Click Start, click All Programs, click Accessories, and then click Run.

  2. In the Open box, type tpm.msc, and then press ENTER.

  3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  4. Under Actions, click Clear TPM. If the TPM is off, follow the procedure Initialize the TPM to reinitialize it before clearing it.

    Caution

    Clearing the TPM resets it to factory defaults and turns it off. You will lose all created keys and data protected by those keys.

  5. In the Clear the TPM Security Hardware dialog box, select a method for entering your password and clearing the TPM:

    • If you have the removable media onto which you saved your TPM owner password, insert it, and click I have a backup file with the TPM owner password. In the Select backup file with the TPM owner password dialog box, use Browse to navigate to the .tpm file saved on your removable media. Click Open, and then click Clear TPM.

    • If you do not have the removable media onto which you saved your password, click I want to type the TPM owner password. In the Type your TPM owner password dialog box, enter your password (including hyphens), and click Clear TPM.

    • If you do not know your TPM owner password, click I don't have the TPM owner password, and follow the instructions provided to clear the TPM without entering the password.

    Note

    If you have physical access to the computer, you can clear the TPM and perform a limited number of management tasks without entering the TPM owner password.

    The status of your TPM is displayed under Status in TPM Management.


Reset the TPM Lockout

The Trusted Platform Module (TPM) will lock itself to prevent tampering or attack; this is referred to as lockout. TPM lockout often lasts for a variable amount of time or until the computer is turned off. While the TPM is in lockout mode, it generally returns an error when it receives commands that require an authorization value. One exception is that the TPM always allows the owner at least one attempt to reset the TPM lockout when it is in lockout mode. If your TPM has entered lockout mode or is responding slowly to commands, we recommend resetting the lockout value. Resetting the TPM lockout requires the TPM owner authorization. TPM owner authorization is set when the administrator initially takes ownership of the TPM. The owner authorization password is hashed to create an owner authorization value, which is stored by the TPM. The administrator is encouraged to save the owner authorization hash value to a TPM owner password file ending with a .tpm extension that contains the owner authorization hash value within an XML structure. For security, the TPM owner password file does not contain the original owner password. TPM ownership is commonly taken the first time that BitLocker Drive Encryption is turned on for the computer. In this scenario, the TPM owner authorization password is saved along with the BitLocker recovery key. When the BitLocker recovery key is saved to a file, BitLocker also saves a TPM owner password file (.tpm) with the TPM owner password hash value. When the BitLocker recovery key is printed, the TPM owner password is printed at the same time. You can also save your TPM owner password hash value to Active Directory Domain Services (AD DS) if your organization's Group Policy settings are configured to do so.

Understanding TPM protection mechanisms

In some scenarios, encryption keys are protected by a TPM by requiring a valid authorization value to access the key. (A common example is BitLocker Drive Encryption configured to use the TPM + PIN key protector, where the user must type the correct PIN during the boot process to access the volume encryption key protected by the TPM.) To prevent malicious entities from discovering authorization values, TPMs implement protection logic. The protection logic is designed to slow or stop responses from the TPM if it detects that an entity might be trying to guess authorization values.

The industry standards from the Trusted Computing Group (TCG) organization specify that TPM manufacturers must implement some form of protection logic in TPM 1.2 chips. Different TPM manufacturers implement different protection mechanisms and behavior. The general guidance is for the TPM chip to take exponentially longer to respond if incorrect authorization values are sent to the TPM. Some TPM chips may not store failed attempts over time. Other TPM chips may store every failed attempt indefinitely. Therefore, some users may experience increasingly longer delays when mistyping an authorization value sent to the TPM, essentially preventing them from using the TPM for a period of time. Users may reset the protection mechanisms in the TPM by completing the following procedure.

Note

The protection logic in the TPM also applies to the TPM owner authorization value. The industry standards specify that the user is allowed at least one attempt to reset the TPM lockout by using the owner authorization value, even when the TPM is locked out. If the wrong value is used when attempting to reset the TPM lockout, on subsequent attempts to enter the owner authorization value, the TPM may respond as if the correct value is incorrect or respond that the TPM is locked out.

To reset the TPM lockout

  1. Open the TPM Management (tpm.msc) snap-in.

  2. In the Action pane, click Reset TPM Lockout to start the Reset TPM Lockout wizard.

  3. Choose the method for entering the TPM owner password:

    • If you saved your TPM owner password to a .tpm file, click I have the owner password file, and then either type the path to the file or click Browse to navigate to the file location.

    • If you want to manually enter your TPM owner password, click I want to enter the owner password, and then type the password in the space provided. If you enabled BitLocker and your TPM at the same time and chose to print your BitLocker recovery password when you turned on BitLocker, your TPM owner password may also have been printed on the same paper.

Once the TPM owner password is authenticated, a dialog box confirming that the TPM lockout was reset is displayed.

Frequently Asked Questions (FAQ)

When should I reset the TPM lockout?

The most likely scenario is that during the boot process users will notice slow response times when using a key protector—which consists of the TPM and a PIN—and entering the incorrect PIN. The system may appear to freeze for a period of time before informing the user that the incorrect PIN was entered and that the TPM is locked out. When the TPM is locked out, it is also possible that the user will enter the correct PIN, but the TPM will respond as if the incorrect PIN was entered for a period of time. Similar behavior may occur for other applications that use the TPM with authorization values, but it is more likely only the application that is communicating with the TPM will be unresponsive if the operating system has already started. Because a TPM may indefinitely store all incorrect authorization attempts sent to it, users may want to proactively reset the TPM lockout if they often mistype authorization values such as the BitLocker PIN.

What behavior should I expect if the TPM protection logic is activated to protect authorization values?

The behavior of the hardware platform will vary depending on implementation choices made by the platform manufacturer. It is generally expected that hardware manufacturers will exponentially delay responses from the TPM chip. It is also possible that the TPM chip may be responsive but respond as if the correct authorization value is incorrect for a period of time. For more specific information about behavior, contact your platform manufacturer.

If the TPM is currently locked out when using BitLocker, there will be an opportunity during the boot process to either open the BitLocker recovery console or wait to reenter the PIN.

Once Windows has started, TPM Management will show the status of the TPM as currently locked out.

Any commands that involve authorization values or attempt to send the TPM owner password to the TPM will result in an error from the TPM while the TPM is locked out.

What should I do if I do not remember my TPM owner password?

It is possible that the TPM owner authorization hash value was saved to a file ending with a .tpm extension when the administrator originally took ownership of the TPM on your computer. Search your file system for a file ending with .tpm. If you printed your BitLocker recovery password, your TPM owner password may have been printed at the same time. If you cannot find your TPM owner password, you can clear the TPM and take ownership again. This should be done carefully because data encrypted with the TPM will be lost. If you are using BitLocker, make sure to suspend or turn off BitLocker before clearing the TPM. For more information about clearing your TPM, see Clear the TPM.

Is it important to keep my TPM owner authorization hash value secret?

Yes. If a malicious entity obtained your TPM owner authorization hash value, the entity could make several attempts to guess an encryption key authorization value (for example, the BitLocker PIN), use the TPM owner authorization hash value to reset the TPM lockout, and repeat indefinitely. Eventually it is likely that the authorization value could be discovered if the size was small.

How is the TPM owner password related to the TPM owner authorization hash value?

The TPM owner password is hashed by using SHA-1 and is base-64 encoded to create the TPM owner authorization hash value.


Turn the TPM On or Off

Normally, the Trusted Platform Module (TPM) is turned on as part of the TPM initialization process. You do not normally need to turn the TPM on or off. However, if necessary you can do so by using the TPM Management snap-in.

Turn the TPM on

If the TPM has been initialized but has never been used, or if you want to use the TPM again after you have turned it off, you should turn the TPM on.

To turn on the TPM

  1. Open the TPM Management (tpmadmin.msc) snap-in.

  2. In the Action pane, click Turn TPM On to display the Turn on the TPM Security Hardware page. Read the instructions on this page.

  3. Click Shutdown (or Restart), and then follow the BIOS screen prompts.

    After the computer restarts, but before you log on to Windows, you will be prompted to accept the reconfiguration of the TPM. This ensures that the user has physical access to the computer and that malicious software is not attempting to make changes to the TPM.

Turn the TPM off

If you want to stop using the services provided by the TPM, you can use TPM Management to turn off the TPM. If you have the TPM owner password, physical access to the computer is not required to turn off the TPM. If you do not have the TPM owner password, you must have physical access to the computer to turn off the TPM.

You can also turn off the TPM to simulate or test the BitLocker Drive Encryption recovery process.

To turn off the TPM

  1. Open the TPM Management (tpmadmin.msc) snap-in.

  2. In the Action pane, click Turn TPM Off to display the Turn off the TPM Security Hardware page.

  3. In the Turn off the TPM security hardware dialog box, select a method for entering your owner password and turning off the TPM:

    • If you have the removable media onto which you saved your TPM owner password, insert it, and then click I have a backup file with the TPM owner password. In the Select backup file with the TPM owner password dialog box, click Browse to locate the .tpm file saved on your removable media, click Open, and then click Turn TPM Off.

    • If you do not have the removable media onto which you saved your TPM owner password, click I want to type the TPM owner password. In the Type your TPM owner password dialog box, enter your password (including hyphens), and then click Turn TPM Off.

    • If you do not know your TPM owner password, click I do not have the TPM owner password, and follow the instructions provided in the dialog box and subsequent BIOS screens to turn off the TPM without entering the password.

Additional references

  • Understand TPM Initialization

  • Initialize the TPM


Command Management

After ownership of the Trusted Platform Module (TPM) has been taken, the TPM owner can limit which TPM commands can be run by using Group Policy or TPM Management.

Understanding TPM commands

The TPM hardware is a passive hardware device. It does not initiate or interrupt processes on the computer. Instead, it accepts and responds to commands from other applications, such as device drivers and operating systems. The current version of the TPM command specification defined by the Trusted Computing Group provides a set of 120 standard commands for use in directing the operation of the TPM. These commands are displayed when you select Command Management in TPM Management.

For a reference to the list of commands in TPM Management, see the Trusted Platform Module (TPM) Specifications (http://go.microsoft.com/fwlink/?LinkID=139770).

Blocking and allowing TPM commands

You can control which commands the TPM on your computer can accept and respond to by selecting the command in Command Management and then deciding whether that command is allowed to be accepted by the TPM or blocked from being accepted by the TPM. There are three possible lists of blocked commands: the default list provided with the operating system, a list maintained on the local computer and managed by local administrators, and the list of commands controlled by Group Policy objects. If a TPM command exists in any of the lists, it will be blocked from the TPM. If a service or application attempts to run a blocked command, an error will be returned to the service or application that sent the command.

For more information, see Control TPM Command Blocking by Using TPM Management.

Using Group Policy to control TPM commands

The Group Policy settings for TPM services are located in Computer Configuration\Administrative Templates\System\Trusted Platform Module Services. The following table details the policy settings that can be used to control TPM commands.

Setting name Description

Configure the list of blocked TPM commands

This policy setting allows you to manage the Group Policy list of TPM commands blocked by Windows. If you enable this policy setting, Windows will block the commands you specify in this setting from being sent to the TPM on the computer. TPM commands are referenced by a command number. For example, command number 129 is TPM_OwnerReadInternalPub, and command number 170 is TPM_FieldUpgrade. To add commands to this list, enable the setting and then click Show to open the list of blocked commands. In the Show Contents dialog box, click in the Value field and type the command number that you want to block. If you want to block multiple commands, enter each command number on a separate line of the list.

If this setting is disabled or not configured, the Group Policy block list is not used, and only those TPM commands specified through the default or local lists will be blocked by Windows.

Ignore the default list of blocked TPM commands

This policy setting allows you to enforce or ignore the computer's default list of blocked TPM commands. If you enable this policy setting, Windows will ignore the computer's default list of blocked TPM commands and will only block those TPM commands specified by Group Policy or the local list. The default list of blocked TPM commands is preconfigured by Windows. The commands on the default list have either been deprecated by the Trusted Computing Group or have privacy implications that should be considered before allowing these commands to be used with TPMs in your organization.

Ignore the local list of blocked TPM commands

This policy setting allows you to enforce or ignore the computer's local list of blocked TPM commands. If you enable this policy setting, Windows will ignore the computer's local list of blocked TPM commands and will only block those TPM commands specified by Group Policy or the default list.

For more information, see Control TPM Command Blocking by Using Group Policy.

Blocking new commands

Because some hardware vendors may have provided additional commands or the Trusted Computing Group may decide to add new commands in the future, TPM Management supports the ability to block new commands through the Block New Command item on the Action menu. If there is an additional command that you do not want your TPM to be able to accept, click Block New Command and then type the number of the command.


Control TPM Command Blocking by Using TPM Management

Trusted Platform Module (TPM) commands can be managed by using TPM Management. Administrators can explore the commands available to the TPM. They can also block or allow specific commands.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To block and allow TPM commands by using TPM Management

  1. Click Start, click All Programs, click Accessories, and then click Run.

  2. In the Open box, type tpm.msc, and then press ENTER.

  3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  4. In the console tree, click Command Management. A list of TPM commands is displayed.

  5. In the list, select a command that you want to block or allow.

  6. Under Actions, click either Block Selected Command or Allow Selected Command as needed.

    Note

    Local administrators cannot allow TPM commands that are blocked through Group Policy. Also, commands on the default block list for the TPM cannot be allowed until the Group Policy settings are changed to ignore the default block list.

Additional references

  • Control TPM Command Blocking by Using Group Policy


Control TPM Command Blocking by Using Group Policy

Administrators can use Group Policy to block or allow specific Trusted Platform Module (TPM) commands. Commands that are blocked by policy cannot be enabled by using TPM Management. However, commands that are allowed by policy can be blocked by using TPM Management.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To block and allow TPM commands by using the Local Group Policy Editor

  1. Click Start, click All Programs, click Accessories, and then click Run.

  2. In the Open box, type gpedit.msc, and then press ENTER.

  3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  4. The Local Group Policy Editor is displayed with the local computer policy open for editing.

    Note

    Administrators with appropriate privileges in a domain can configure a Group Policy object (GPO) to apply through Active Directory Domain Services (AD DS).

  5. In the console tree, under Computer Configuration, expand Administrative Templates, and then expand System.

  6. Under System, click Trusted Platform Module Services.

  7. In the details pane, double-click Configure the list of blocked TPM commands.

  8. Click Enabled, and then click Show.

  9. For each command that you want to block, click Add, enter the command number, and then click OK.

    Note

    There are currently 120 commands listed in TPM Management, organized into 27 categories of functionality. For a reference to the list of commands in TPM Management, see the Trusted Platform Module (TPM) Specifications (http://go.microsoft.com/fwlink/?LinkID=139770).

  10. After you have added numbers for each command that you want to block, click OK, and then click OK again.

  11. If desired, you can enable policies that prevent the blocking of commands based on the default block list or the local list. For more information about each of these options, read the help text displayed in the Local Group Policy Editor for the Ignore the default list of blocked TPM commands policy setting and the Ignore the local list of blocked commands policy setting.

    Note

    Local administrators cannot allow TPM commands that are blocked through Group Policy. Commands blocked by local administrators using TPM Management and commands on the default block list are also blocked unless the Group Policy settings are changed from the default settings.

  12. Close the Local Group Policy Editor.


Setting Up the TPM for First Use

An administrator must complete a series of steps before the Trusted Platform Module (TPM) can be used to protect your system or to encrypt your data.

This section includes the following topics:

  • Understand TPM Initialization

  • Initialize the TPM


Understand TPM Initialization

A Trusted Platform Module (TPM) can be in one of the following states:

  • Unowned and turned off

  • Unowned and turned on

  • Owned but turned off

  • Owned and turned on

The TPM must be turned on and owned before it can be used to help secure your computer. The process of ensuring that the TPM is both turned on and owned is called initialization. During initialization, the TPM creates new root keys that are used by the TPM.

Computers manufactured to meet requirements specified for this version of Windows include preboot BIOS functionality that makes it easy to initialize a computer's TPM by using the TPM Initialization Wizard. Normally, initialization of the TPM requires physical access to the computer to turn on the TPM. This requirement helps protect against the threat of malicious software being able to initialize a TPM.

Note

In a business or enterprise environment, your network administrator may have initialized the TPM, or your organization may have arranged specific processes with your hardware manufacturer to support TPM initialization without user intervention.

If the TPM is not initialized, the TPM Initialization Wizard guides you through the steps required to turn on and take ownership of the TPM.

In order to be used by software such as BitLocker Drive Encryption, the TPM must be initialized. The BitLocker setup wizard starts the initialization process automatically while configuring BitLocker, if needed.

For more information on how to initialize the TPM, see Initialize the TPM.


Initialize the TPM

The Trusted Platform Module (TPM) must be initialized before it can be used to help secure your computer.

Computers manufactured to meet requirements for the Windows Vista Logo Program include pre-boot BIOS functionality that makes it easy to initialize a computer's TPM through the TPM Initialization Wizard.

When you start the TPM Initialization Wizard, you can determine whether the computer's TPM has been initialized or not.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. In addition, the computer must be equipped with a compatible BIOS and TPM.

To start the TPM Initialization Wizard

  1. Click Start, click All Programs, click Accessories, and then click Run.

  2. In the Open box, type tpm.msc, and then press ENTER.

  3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  4. On the Action menu, click Initialize TPM to start the TPM Initialization Wizard.

  5. If the TPM has never been initialized or is turned off, the TPM Initialization Wizard will display the Turn on the TPM security hardware dialog box. This dialog box provides guidance for initializing or turning on the TPM. Continue with this procedure.

    Note

    If the TPM is already turned on, the TPM Initialization Wizard displays the Create the TPM owner password dialog box. Skip the remainder of this procedure and continue with the "To set ownership of the TPM" procedure later in this topic.

    Note

    If the TPM Initialization Wizard detects that you do not have a compatible BIOS, you cannot continue with the TPM Initialization Wizard, and you are alerted to consult the computer manufacturer's documentation for instructions to initialize the TPM.

  6. Click Restart.

  7. Follow the BIOS screen prompts. An acceptance prompt is displayed to ensure that a user has physical access to the computer and that no malicious software is attempting to turn on the TPM.

    Note

    BIOS screen prompts and required keystrokes vary by computer manufacturer.

  8. After the computer restarts, log on to the computer with the same administrative credentials you used to start this procedure.

  9. The TPM Initialization Wizard will automatically restart. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  10. Continue with the next procedure.

To finish initializing the TPM for use, you must set an owner for the TPM. The process of taking ownership includes creating an owner password for the TPM. To learn more about the owner password, see Understand the TPM Owner Password.

To set ownership of the TPM

  1. If you are not continuing immediately from the last procedure, start the TPM Initialization Wizard. If you need to review the steps to do so, see "To start the TPM Initialization Wizard" earlier in this topic.

  2. In the Create the TPM owner password dialog box, click Automatically create the password (recommended).

  3. In the Save your TPM owner password dialog box, click Save the password.

  4. In the Save As dialog box, select a location to save the password, and then click Save. The password file is saved as computer_name.tpm.

    Important

    We highly recommend saving the TPM owner password to removable media and storing the media in a safe location.

  5. Click Print the password if you want to print a hard copy of your password.

    Important

    We highly recommend printing a hard copy of your TPM owner password and storing it in a safe location.

  6. Click Initialize.

    Note

    The process of initializing the TPM might take a few minutes to complete.

  7. Click Close.

    Caution

    Do not lose your password. If you do, you will be unable to make administrative changes unless you clear the TPM. This could result in the loss of data.


Understanding Keys and Passwords Used by the TPM

The Trusted Platform Module (TPM) makes extensive use of asymmetric key pairs, often called "public-private key pairs." The private key is kept secret, and the corresponding public key can be widely distributed.

Topics in this section discuss some of the most important keys used by the TPM security hardware, and also discuss the owner password. This section includes the following topics:

  • Understand the TPM Owner Password

  • Change the TPM Owner Password

  • Understand the TPM Storage Root Key

  • Understand the TPM Endorsement Key


Understand the TPM Owner Password

The Trusted Platform Module (TPM) owner password defines who the owner of the TPM is. You own the TPM if you are able to set the TPM owner password. Only one owner password exists per TPM, so anyone who knows that password is effectively the TPM owner. The owner of the TPM can make full use of TPM capabilities. Once an owner is set, no other user or software can claim ownership of the TPM. Only the TPM owner can enable, disable, or clear the TPM without having physical access to the computer (for example, by using the command-line tools remotely). Taking ownership of the TPM can be done as part of the initialization process. For more information, see Setting Up the TPM for First Use.

Applications, including BitLocker Drive Encryption, can automatically start the initialization process. If you enable BitLocker without manually initializing the TPM, the TPM owner password will be automatically created and saved in the same location as the BitLocker recovery password.

The TPM owner password can be saved as a file on a USB flash drive, or in a folder in a location away from your local computer. The password can also be printed. In TPM Management, when an action can only be performed by the TPM owner, you can choose the appropriate option to type the password or use the password that has been saved.

The TPM commands available to an owner are defined by the Trusted Computing Group. For more information, consult the "Owner Permission Settings" section of the specification "Structures of the TPM" available from the Trusted Computing Group Web site (http://go.microsoft.com/fwlink/?LinkId=69584).


Change the TPM Owner Password

As with any password, you should change your Trusted Platform Module (TPM) owner password if it has become compromised (that is, if you suspect it is no longer a secret).

If you want to invalidate all of the existing keys created since you took ownership of the TPM, you can clear the TPM instead of changing your owner password.

Important

Clearing the TPM can result in the loss of data. To avoid data loss, make sure you have a backup or recovery method for any data protected or encrypted by the TPM.

If you want to keep all existing keys and data intact but want to disable the services provided by the TPM, you can turn off the TPM instead of changing your owner password.

Additional references

  • Understand the TPM Owner Password


Understand the TPM Storage Root Key

The storage root key is embedded in the Trusted Platform Module (TPM) security hardware. It is used to protect TPM keys created by applications, so that these keys cannot be used without the TPM.

Unlike the endorsement key (which is generally created when the TPM is manufactured), the storage root key is created when you take ownership of the TPM. This means that if you clear the TPM and a new user takes ownership, a new storage root key is created.

The storage root key is defined by the Trusted Computing Group (TCG). For more information, consult the "TCG Architecture overview" specification document available from the TCG Web site (http://go.microsoft.com/fwlink/?LinkId=69584).

Additional references

  • Understand the TPM Endorsement Key


Understand the TPM Endorsement Key

The endorsement key is an encryption key that is permanently embedded in the Trusted Platform Module (TPM) security hardware, generally at the time of manufacture. This private portion of the endorsement key is never released outside of the TPM. The public portion of the endorsement key helps to recognize a genuine TPM.

TPM operations that involve signing pieces of data can make use of the endorsement key to allow other components to verify that the data can be trusted. To sign a piece of data, a private key is used to encrypt a small piece of information. The signature can be verified by using the corresponding public key to decrypt that same piece of data. If it can be decrypted with the public key, then it must have been encrypted by the corresponding private key. As long as that private key has been kept secret, this digital signature can be trusted.

The endorsement key is defined by the Trusted Computing Group (TCG). For more information, consult the "TCG Architecture overview" specification document available from the TCG Web site (http://go.microsoft.com/fwlink/?LinkId=69584).

Additional references

  • Understand the TPM Storage Root Key


Troubleshooting TPM Management

This section contains the following topics:

  • Troubleshoot TPM Initialization

  • Connect to the Network

  • Manage the TPM Manually


Troubleshoot TPM Initialization

Managing the Trusted Platform Module (TPM) is usually a straightforward procedure. If are unable to complete the initialization procedure, review the following information:

  • If the TPM is not detected by Windows, verify that your computer hardware contains a compatible TPM and BIOS. Ensure that no BIOS settings have been used to hide the TPM from the operating system.

  • If you are attempting to initialize the TPM as part of the BitLocker setup, check which TPM driver is installed on the computer. We recommend always using one of the TPM drivers provided by Microsoft with BitLocker. If a non-Microsoft TPM driver is installed, it may prevent the default TPM driver from loading and cause BitLocker to report that a TPM is not present on the computer. If you have a non-Microsoft driver installed, remove it and then try to initialize the TPM again. The following table lists the three standard TPM drivers that are provided by Microsoft.

    Driver name Manufacturer

    Trusted Platform Module 1.2

    (Standard)

    Broadcom Trusted Platform Module (A1), v1.2

    Broadcom

    Broadcom Trusted Platform Module (A2), v1.2

    Broadcom
  • If the TPM has been previously initialized and you do not have the owner password, you may have to clear or reset the TPM to factory default values. For more information, see Clear the TPM.

    Caution

    Clearing the TPM can result in the loss of data. To avoid data loss, make sure you have a backup or recovery method for any data protected or encrypted by the TPM.

Because your TPM security hardware is a physical part of your computer, you may want to read the manuals or instructions that came with your computer, or search the manufacturer's Web site. Some hints to help locate TPM-related information are included in the topic Manage the TPM Manually.


Connect to the Network

You cannot complete the initialization of the Trusted Platform Module (TPM) in your computer when disconnected from your organization's network if either of the following two conditions exist:

  • An administrator has configured your computer to require that TPM recovery information be saved in Active Directory Domain Services (AD DS). This requirement can be configured through Group Policy.

  • A domain controller cannot be reached. This can occur on a computer that is currently disconnected from the network, separated from the domain by a firewall, or experiencing a network component failure (such as an unplugged cable or a faulty network interface card).

In either case, an error appears, and you will not be able to complete the initialization process.

To avoid this issue, initialize the TPM while you are connected to the corporate network and able to contact a domain controller.

For step-by-step procedures on how to set up the TPM on your computer, see the Windows Trusted Platform Module Management Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkId=139769).


Manage the TPM Manually

Microsoft works closely with hardware manufacturers and industry groups to make it possible to manage most functions of the Trusted Platform Module (TPM) from within TPM Management. However, on some occasions, it may not be possible to control all aspects of your TPM security hardware from Windows. Examples may include:

  • Hardware that does not fully support the TPM 1.2 specification

  • Hardware that does not contain a fully supported BIOS

  • Hardware that has an option to hide the TPM security hardware from the operating system

  • Hardware for which the manufacturer has decided to require that the BIOS screens be used to turn on, turn off, or clear the TPM

In such cases, you may be able to manage your TPM security hardware from the BIOS or setup screens of your computer.

Each manufacturer may use different terminology and have different menus or steps to manage the TPM. For example, rather than being called a "Trusted Platform Module," your manufacturer may refer to the TPM as an "embedded security device" or use a localized or translated name for TPM.

To learn how to enter the BIOS or setup system on your computer and how to perform TPM-related operations, please review the owner's manual, setup guide, or similar documentation provided with your computer. Most manufacturers also make troubleshooting and setup information available online.

When searching for instructions about managing the TPM, you may want to use some of the following search terms: "embedded security," "TPM," "trusted platform," "security module," "security chip," "TCG," "Trusted Computing Group," or these terms with verbs representing the specific action, such as "enable," "turn on," or "turn off." A good resource for learning about how a TPM works is the Trusted Computing Group Trusted Platform Module (TPM) Specifications (http://go.microsoft.com/fwlink/?LinkId=139770).


Resources for TPM Management

TPM Management works with Trusted Platform Module (TPM) security hardware that supports the specifications defined by the Trusted Computing Group (TCG). For more information, consult the TCG Web site (http://go.microsoft.com/fwlink/?LinkId=69593).

TPM security hardware is used to enable other components or software that protect your system or encrypt data, such as BitLocker Drive Encryption.

You may find the following resources helpful in understanding the role of TPM Management and BitLocker:

  • Microsoft Trusted Platform Module Step-by-Step Guide (http://go.microsoft.com/fwlink?linkid=139769)

  • Microsoft BitLocker Drive Encryption Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkId=140225)

  • BitLocker Drive Encryption Configuration Guide: Backing Up BitLocker and TPM Recovery Information to Active Directory (http://go.microsoft.com/fwlink/?linkid=140308)