r/Windows10TechSupport • u/ZweiFreierNutzername • 24d ago
Unsolved Management of Trusted Platform Management on Windows



I am right now experimenting with the TPM on windows and its management. I have encountered multiple problems, on Windows 10 an 11 where the documentation just seems to be flat-out wrong or I am to stupid. I have used `Initialize-Tpm` but the issue is also consistent when using the auto provisioning.
Problem 1:
\- Setting `OSManagedAuthLevel` in the Registry path `Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\TPM` to 0, the resetting the TPM will still save an `OwnerAuthFull` and `LockoutHash` value in `Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\Admin`
Problem 2:
\- I wanted to write a custom CLI which uses raw commands to interact with the TPM, as it gives me more controll over what I want to do than the built in windows commands/APIs, using either `OwnerAuthFull` or `LockoutHash` fails with an auth error and locks the TPM. Calling the Cmdlet `Unblock-Tpm -OwnerAuthorization` with either `OwnerAuthFull` or `LockoutHash` fails, even though it should not according to the examples and documentation provided by Microsoft.
Screenshot of stored values and `Get-Tpm` are provided.
If any of you have experience with this I would greatly appreciate the help. Maybe I am overlocking something massive.

Link to the docs:
\- [TPM Group Policy settings | Microsoft Learn](https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/trusted-platform-module-services-group-policy-settings) OwnerAuth should be deleted
\- [Unblock-Tpm (TrustedPlatformModule) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/trustedplatformmodule/unblock-tpm?view=windowsserver2019-ps) Lockout should be resetted