Managing Windows Server 2012 Storage and File Systems : TPM and BitLocker Drive Encryption (part 2) - Preparing and initializing a TPM for first use

Windows 8 and Windows Server 2012 include important fundamental changes in the way TPM is used. One of these changes is the ability to set the level of authorization information stored in the registry as any of the following:

You set the level of authorization information stored in the registry using the Configure The Level Of TPM Owner Authorization Information Available To The Operating System policy. This policy is found in the Administrative Templates policies for Computer Configuration under System\Trusted Platform Module Services. Keep in mind that if you change the policy setting from Full to Delegated or vice versa, the full TPM owner authorization value is regenerated and any copies of the original TPM value will be invalid. Note also that when this policy is set to Delegated or None, you’ll be prompted for the TPM owner password before you are able to perform most TPM administration tasks. Figure 4 shows an example.

Figure 4. Supply the TPM owner password, if prompted for one.

With earlier releases of Windows, Microsoft recommended remotely storing the TPM owner authorization in Active Directory for domain-joined computers, which could be accomplished by enabling the Turn On TPM Backup To Active Directory Domain Services policy, extending the schema for the directory, and setting the appropriate access controls.

Enabling backup to Active Directory changes the default way TPM owner information is stored. Specifically, when Turn On TPM Backup To Active Directory Domain Services is enabled and Configure The Level Of TPM Owner Authorization Information Available To The Operating System is disabled or not configured, only the TPM administrative delegation blob and the TPM user delegation blob are stored in the registry. Here, to store the full TPM owner information, you must use the Enabled setting of Full (or disable the Active Directory backup of the TPM owner authorization).

Under System\Trusted Platform Module Services, you’ll find the following related policies:

These policies control the way command block lists are used and when lockout is triggered after multiple failed authorization attempts. An administrator can fully reset all lockout-related parameters in the Trusted Platform Module Management console. On the Action menu, tap or click Reset TPM Lockout. When the full TPM owner authorization is stored in the registry, you don’t need to provide the TPM owner password. Otherwise, follow the prompts to provide the owner password or select the file containing the TPM owner password.

Initializing a TPM prepares it for use on a computer so that you can use the TPM to secure volumes on the computer’s hard drives. The initialization process involves turning on the TPM and then setting ownership of the TPM. By setting ownership of the TPM, you are assigning a password that helps ensure only the authorized TPM owner can access and manage the TPM. The TPM password is required to turn off the TPM if you no longer want to use it and to clear the TPM if the computer is to be recycled. In an Active Directory domain, you can configure Group Policy to save TPM passwords.

To initialize the TPM and create the owner password, complete the following steps:

Figure 7. With ownership set, the TPM is ready for use.

<?xml version="1.0" encoding="UTF-8"?>
<tpmOwnerData version="1.0" softwareAuthor="Microsoft Windows
[Version 6.2.9200]" creationDate="2015-02-12T12:23:32-07:32"
creationUser="CORPSERVER15\Administrator" machineName="CORPSERVER15">
      <tpmInfo manufacturerId="1335342671"/>
      <ownerAuth>cEBACDgNV8Z2EBJbERTSD87KICB=
</ownerAuth>
</tpmOwnerData>