2.4 Turning an initialized TPM on or off
Computers that have TPM might ship with TPM turned on. If you
decide not to use TPM, you should take ownership of the TPM and then
turn off the TPM. This ensures that the operating system owns the
TPM but the TPM is in an inactive state. If you want to reconfigure
or recycle a computer, you should clear the TPM. Clearing the TPM
invalidates any stored keys, and data encrypted by these keys can no
longer be accessed.
You must have administrator privileges to manage the TPM
state. Turn off TPM by opening the Trusted Platform Module
Management console and then tapping or clicking Turn TPM Off on the
Action menu.
When the full TPM owner authorization is stored in the
registry, you don’t need to provide the TPM owner password.
Otherwise, follow the prompts to provide the owner password or
select the file containing the TPM owner password.
Clearing the TPM erases information stored on the TPM and
cancels the related ownership of the TPM. You should clear the TPM
when a TPM-equipped computer is to be recycled. Clearing the TPM
invalidates any stored keys, and data encrypted by these keys can no
longer be accessed.
After clearing the TPM, you should take ownership of the TPM.
This will write new information to the TPM. You might then want to
turn off the TPM so that it isn’t available for use.
You must have administrator privileges to clear the TPM. Clear
the TPM, take ownership, and then turn off the TPM by completing the
following steps:
-
Start the Trusted Platform Module Management console. On
the Action menu, tap or click Clear TPM. This starts the
Manage The TPM Security Hardware Wizard.
Important
When you clear the TPM, the TPM is reset to factory
defaults. Because of this, you lose all keys and the data
protected by those keys. You do not need the TPM owner
password to clear the TPM.
-
Read the warning on the Clear The TPM Security Hardware page, shown in Figure 8, and then
tap or click Restart. Tap or click Cancel to exit without
clearing the TPM.
-
Typically, hardware designed for Windows 8 and Windows
Server 2012 can automatically complete the re-initialization
process. On other hardware, you need physical access to the
computer to respond to the manufacturer’s firmware confirmation
prompt. Figure 9 shows an
example. Here, you must press F12 to clear, enable, and activate
the TPM, or press Esc to cancel and continue loading the
operating system.
-
When Windows starts and you log on, the Manage The TPM Security Hardware Wizard continues
running. Windows will take ownership of the TPM. Setting
ownership on the TPM prepares it for use with the operating system.
Once ownership is set, the status should be listed as “The TPM
is ready for use.”
2.6 Changing the TPM owner password
You can change the TPM password at any time. Generally, you do this if
you suspect that the TPM owner password has been compromised. Your
company’s security policy also might require TPM owner password
changes in certain situations.
You must have administrator privileges to change the TPM owner
password. To change the TPM owner password, complete the following
steps:
-
Start the Trusted Platform Module Management console. On
the Action menu, tap or click Change Owner Password. This starts
the Manage The TPM Security Hardware Wizard.
-
When the full TPM owner authorization is stored in the
registry, you don’t need to provide the TPM owner password.
Otherwise, follow the prompts to provide the owner password or
select the file containing the TPM owner password.
-
On the Create The TPM Owner Password page, shown in Figure 10, you can elect to create the
password automatically or manually:
-
If you want the wizard to create the password for you,
select Automatically Create The Password (Recommended). The
new TPM owner password is displayed. Tap or click Change
Password.
-
If you want to create the password, select Manually
Create The Password. Type and confirm a password of at least
eight characters, and then tap or click Change
Password.
-
Before tapping or clicking Close, you might want to save
the TPM owner password. Tap or click Remember My
TPM Owner Password. In the Save As dialog box,
select a location to save the password backup file and then tap
or click Save.
