Turn on TPM backup to Active Directory Domain Services

This policy setting allows you to manage the Active Directory Domain Services (AD DS) backup of Trusted Platform Module (TPM) owner information. TPM owner information includes a cryptographic hash of the TPM owner password. Certain TPM commands can only be run by the TPM owner. This hash authorizes the TPM to run these commands. If you enable this policy setting TPM owner information will be automatically and silently backed up to AD DS when you use Windows to set or change a TPM owner password. By enabling this policy setting a TPM owner password cannot be set or changed unless the computer is connected to the domain and the AD DS backup succeeds. If you disable or do not configure this policy setting TPM owner information will not be backed up to AD DS. Note: You must first set up appropriate schema extensions and access control settings on the domain before AD DS backup can succeed. Consult online documentation for more information about setting up Active Directory Domain Services for TPM. Note: The TPM cannot be used to provide enhanced security features for BitLocker Drive Encryption and other applications without first setting an owner. To take ownership of the TPM with an owner password run “tpm. msc” and select the action to “Initialize TPM”. Note: If the TPM owner information is lost or is not available limited TPM management is possible by running “tpm. msc” on the local computer.

Additional Information

  1. Registry path is:

    HKEY_LOCAL_MACHINE -> Software -> Policies -> Microsoft -> TPM # ActiveDirectoryBackup HKEY_LOCAL_MACHINE -> Software -> Policies -> Microsoft -> TPM HKEY_LOCAL_MACHINE -> Software -> Policies -> Microsoft -> TPM # RequireActiveDirectoryBackup

  2. The Administrative Template path is:

    System -> Trusted Platform Module Services


* Making mistakes while changing registry values can affect your system adversely. We recommend you to create a System Restore point before making registry manipulation. If you're new to Registry Editor, read this beginner's guide.
** To locate the registry and administrative template path, checkout beginner's guide.
You're here :
Checkout Kapil Sparks™