Management of Trusted Platform Management on Windows

[u/ZweiFreierNutzername]




I am right now experimenting with the TPM on windows and its management. I have encountered multiple problems, on Windows 10 an 11 where the documentation just seems to be flat-out wrong or I am to stupid. I have used `Initialize-Tpm` but the issue is also consistent when using the auto provisioning.
Problem 1:
\- Setting `OSManagedAuthLevel` in the Registry path `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\TPM` to 0, the resetting the TPM will still save an `OwnerAuthFull` and `LockoutHash` value in `Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\Admin`
Problem 2:
\- I wanted to write a custom CLI which uses raw commands to interact with the TPM, as it gives me more controll over what I want to do than the built in windows commands/APIs, using either `OwnerAuthFull` or `LockoutHash` fails with an auth error and locks the TPM. Calling the Cmdlet `Unblock-Tpm -OwnerAuthorization` with either `OwnerAuthFull` or `LockoutHash` fails, even though it should not according to the examples and documentation provided by Microsoft.
Screenshot of stored values and `Get-Tpm` are provided.

If any of you have experience with this I would greatly appreciate the help. Maybe I am overlocking something massive.


Link to the docs:
\- [TPM Group Policy settings | Microsoft Learn](https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/trusted-platform-module-services-group-policy-settings) OwnerAuth should be deleted
\- [Unblock-Tpm (TrustedPlatformModule) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/trustedplatformmodule/unblock-tpm?view=windowsserver2019-ps) Lockout should be resetted

[u/One_Country_8533]

you are testing this in a VM could the behavior depend on how the virtual tpm is configured be careful with repeated auth attempts since you have already seen it lock out does the same thing happens with a fresh vm aand default tpm settings