TPM Management

The TPM Management console is a Microsoft Management Console (MMC) snap-in that allows administrators to interact with Trusted Platform Module (TPM) Services.

TPM Services is a new feature set in this version of Windows that is used to administer the TPM security hardware in your computer.

The TPM Services architecture provides the infrastructure for hardware-based security by providing access to and assuring application-level sharing of the TPM.

This help file contains topics in the following areas:

  • Overview of TPM Management

  • Use and Manage the TPM Management snap-in

  • Manage the Trusted Platform Module

  • Set up the TPM for first use

  • Understand keys and passwords used by the TPM

  • Troubleshooting TPM Management

  • Resources for TPM Management


Overview of TPM Management

The TPM Management console is a Microsoft Management Console (MMC) snap-in that allows administrators to interact with Trusted Platform Module (TPM) Services. TPM Services is a new feature set in this version of Windows that is used to administer the TPM security hardware in your computer. The TPM Services architecture provides the infrastructure for hardware-based security by providing access to and assuring application-level sharing of the TPM.

What is a Trusted Platform Module?

A TPM is a microchip designed to provide basic security-related functions, primarily involving encryption keys. The TPM is usually installed on the motherboard of a computer or laptop, and communicates with the rest of the system using a hardware bus.

Computers that incorporate a TPM have the ability to create cryptographic keys and encrypt them so that they can only be decrypted by the TPM. This process, often called "wrapping" or "binding" a key, can help protect the key from disclosure. Each TPM has a master "wrapping" key, called the Storage Root Key (SRK), which is stored within the TPM itself. The private portion of a key created in a TPM is never exposed to any other component, software, process, or person.

Computers that incorporate a TPM can also create a key that has not only been wrapped, but also tied to certain platform measurements. This type of key can only be unwrapped when those platform measurements have the same values that they had when the key was created. This process is called "sealing" the key to the TPM. Decrypting it is called "unsealing." The TPM can also seal and unseal data generated outside of the TPM. With this sealed key and software like Microsoft® BitLocker™ Drive Encryption, you can lock data until specific hardware or software conditions are met.

With a TPM, private portions of key pairs are kept separated from the memory controlled by the operating system. Keys can be sealed to the TPM, and certain assurances about the state of a system—assurances that define the "trustworthiness" of a system—can be made before the keys are unsealed and released for use. Because the TPM uses its own internal firmware and logic circuits for processing instructions, it does not rely on the operating system and is not exposed to vulnerabilities that might exist in the operating system or application software.

Trusted Platform Module Services components

The following table details the individual components that comprise the TPM Services feature set:

TPM Component | Purpose
TPM Driver | The TPM driver is a kernel-mode device driver designed for TPM security hardware that conforms to the Trusted Computing Group (TCG) 1.2 specifications. Conforming to TCG 1.2 provides more platform stability and eliminates the need for vendor-specific device drivers.
TPM Base Services (TBS) | TBS is a service in this version of Windows that provides sharing of the limited resources on the TPM. TBS acts as the resource controller for all applications using the TPM.
TPM Windows Management Instrumentation (WMI) provider | The TPM WMI provider exposes common TPM configuration tasks to administrators programmatically. Administrators can write a script that uses this provider.
TPM Management console | The TPM Management console is a Microsoft Management Console (MMC) snap-in that exposes common TPM configuration tasks to administrators through a user interface. Administrators can use this console to access the TPM Initialization Wizard.
TPM Initialization Wizard | The purpose of the TPM Initialization Wizard is to turn on and configure the TPM to work with applications or services that use the TPM, such as BitLocker Drive Encryption.

For more information, review other topics in this help file, and the resources listed in Resources for TPM Management.


Use and Manage the TPM Management snap-in

The TPM Management console is a Microsoft Management Console (MMC) snap-in. You can run the TPM Management console as a stand-alone console, or add it to any MMC.

This section contains the following topics:

  • Add the TPM Management snap-in to MMC

  • Start TPM Management


Start TPM Management

The TPM Management console is a Microsoft Management Console (MMC) snap-in. You can run the TPM Management console as a stand-alone console, or add it to any MMC. To start TPM Management as a stand-alone console, you can use Windows Explorer or a command line.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To start the TPM Management console by using Windows Explorer

  1. Click Start, click All Programs, then click Accessories, then click Run.

  2. In the Open text box, type tpm.msc, and then press Enter.

  3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

To start the TPM Management console by using a command line:

  • At a command prompt, type tpm.msc and press Enter.

Additional considerations

  • You can configure your own Microsoft Management Console (MMC) that includes TPM Management as part of that console. For more information, refer to "Additional references" in this topic.

  • Depending on the configuration of your computer, the User Account Control prompt may or may not appear. It will not appear if you are logged on with the built-in Administrator account (the local Administrator account is disabled by default in this version of Windows).

  • If User Account Control is enabled, it can be configured to allow non-administrators to enter the credentials of an administrator to complete administrative tasks without being a member of the Administrators group.

  • By default, members of the local group Administrators have sufficient rights and privileges to complete this task. In your environment, security may be managed such that non-administrators have additional rights.

Additional references

  • Add the TPM Management snap-in to MMC.


Add the TPM Management snap-in to MMC

The TPM Management console is a Microsoft Management Console (MMC) snap-in. You can run the TPM Management console as a stand-alone console, or add it to any MMC.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

Add the TPM Management snap-in to MMC

  1. Click Start, click All Programs, click Accessories, then click Run.

  2. In the Open text box, type mmc and press Enter.

  3. If a User Account Control prompt appears, verify the information presented, and then provide the requested permission or credentials.

  4. On the File menu, click Add/Remove Snap-in.

  5. In the Available snap-ins list box, click TPM Management, then click Add.

  6. In the Select Computer dialog box, click Local computer.

    Note

    You can also use this method to manage the TPM on a remote computer.

  7. Click OK, and then click OK again.

Additional considerations

  • Depending on the configuration of your computer, the User Account Control prompt may appear. It will not appear if you are logged on with the built-in Administrator account (the local Administrator account is disabled by default in this version of Windows).

  • If User Account Control is enabled it can be configured to allow non-administrators to enter the credentials of an administrator to complete administrative tasks without being a member of the Administrators group.

  • By default, members of the local group Administrators have sufficient rights and privileges to complete this task. In your environment, security may be managed such that non-administrators have additional rights.


Manage the Trusted Platform Module

This section contains the following topics:

  • Control TPM Command Blocking with the TPM Management console

  • Control TPM Command Blocking with Group Policy

  • Store TPM recovery information in Active Directory Domain Services

  • Clear the TPM

  • Turning the TPM on or off

  • Learn more about TPM commands


Control TPM Command Blocking with the TPM Management console

TPM commands can be managed through the TPM Management console. Administrators can explore the commands available to the TPM. They can also block or allow specific commands.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To block and allow TPM commands using the TPM Management console

  1. Click Start, click All Programs, click Accessories, and then click Run.

  2. Type tpm.msc in the Open box, and then click Enter.

  3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

  4. The TPM Management console is displayed.

  5. In the console tree, click Command Management. A list of TPM commands is displayed.

  6. Select a command from the list that you want to block or allow.

  7. Under Actions, click either Block Selected Command or Allow Selected Command as needed.

    Note

    Local administrators cannot allow TPM commands that are blocked through Group Policy. Also, commands on the default block list for the TPM console cannot be allowed until the Group Policy settings are changed to ignore the default block list.

Additional references

  • Control TPM Command Blocking with Group Policy


Control TPM Command Blocking with Group Policy

Administrators can use Group Policy to block or allow specific TPM commands.

Commands that are blocked by policy cannot be enabled using the TPM Management console. However, commands that are allowed by policy can be blocked using the TPM Management console.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To block and allow TPM command using the Local Group Policy Editor

  1. Click Start, click All Programs, click Accessories, and then click Run.

  2. Type gpedit.msc in the Open box, and then click OK.

  3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

  4. The Local Group Policy Editor is displayed with the Local Computer Policy open for editing.

    Note

    Administrators with appropriate privileges in a domain can configure a Group Policy object (GPO) to apply through Active Directory Domain Services (AD DS).

  5. In the console tree, under Local Computer Policy, under Computer Configuration, expand Administrative Templates, then expand System.

  6. Under System, click Trusted Platform Module Services.

  7. In the details pane (the right-hand pane), double-click Configure the list of blocked TPM commands.

  8. In the Configure the list of blocked TPM commands Properties window, click Enabled, then click Show.

  9. For each command you wish to block, click Add, then enter the command number, and click OK.

    Note

    Refer to the list of commands in the TPM Management console, or the TCG specification for a list of command numbers.

  10. After you have added numbers for each command you wish to block, click OK, then click OK again.

  11. If desired, you can enable policies that prevent the blocking of commands based on the default block list or the local list. For more information about each of these options, read the help text displayed in the Local Group Policy Editor for the Ignore the default list of blocked TPM commands setting and the Ignore the local list of blocked commands setting.

    Note

    Local administrators cannot allow TPM commands blocked through Group Policy. Commands blocked by local administrators using the TPM Management console and commands on the default block list are also blocked unless the Group Policy settings are changed from the default settings.

  12. Close the Local Group Policy Editor window.


Store TPM recovery information in Active Directory Domain Services

Active Directory Domain Services (AD DS) can be used to store Trusted Platform Module (TPM) recovery information.

There is only one TPM owner password per computer; therefore, the hash of the TPM owner password is stored as an attribute of the computer object in AD DS. The attribute has the common name (cn) of ms-TPM-OwnerInformation.

Active Directory Requirements

In order to store TPM information in Active Directory Domain Services, all domain controllers must run Windows Server 2003 (with Service Pack 1) or later. You also need to install schema extensions, if all domain controllers are running Windows Server 2003.

Step-by-Step Instructions

For step-by-step instructions for configuring Active Directory Domain Services and Group Policy to support the storage of recovery and owner information, see Guide to Using Active Directory Domain Services with Windows BitLocker™Drive Encryption and TPM Services on the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=67438).

Additional references

  • Windows BitLocker™ Drive Encryption Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkId=53779)

  • Windows Trusted Platform Module Services Step-by-Step Guide (http://go.microsoft.com/fwlink?linkid=67232)


Clear the TPM

Clearing the TPM resets the TPM to an unowned state. After clearing the TPM, you need to complete the TPM initialization process before using software that relies on the TPM, such as Windows BitLocker™ Drive Encryption.

Important

Clearing the TPM could result in the loss of data. To avoid data loss, make sure you have a backup or recovery method for any data protected or encrypted by the TPM.

After the TPM is cleared, it is also turned off.

To temporarily suspend TPM operations, turn the TPM off instead of clearing it. For more information, see Turning the TPM on or off.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To clear the TPM

  1. Click Start, click All Programs, click Accessories, and then click Run.

  2. Type tpm.msc in the Open box, and then click Enter.

  3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

  4. The TPM Management console is displayed.

  5. Under Actions, click Clear TPM. If the TPM is off, follow the procedure in Step 1: Initialize the TPM to reinitialize it before clearing it.

    Caution

    Clearing the TPM resets it to factory defaults and turns it off. You will lose all created keys and data protected by those keys.

  6. From the Clear the TPM Security Hardware dialog box, select a method for entering your password and clearing the TPM:

    • If you have the removable media onto which you saved your TPM owner password, insert it and click I have a backup file with the TPM owner password. From the Select backup file with the TPM owner password dialog box, use Browse to point to the .tpm file saved on your removable media. Click Open, and then click Clear TPM.

    • If you do not have the removable media onto which you saved your password, click I want to type the TPM owner password. From the Type your TPM owner password dialog box, enter your password (including dashes) and click Clear TPM.

    • If you do not know your TPM owner password, click I don't have the TPM owner password, and follow the instructions provided to clear the TPM without entering the password.

    Note

    You can clear the TPM and perform a limited number of management tasks without entering the TPM owner password by just being present at the computer.

    The status of your TPM is displayed under Status on the TPM Management console.


Turning the TPM on or off

Normally, the Trusted Platform Module (TPM) is turned on as part of the TPM initialization process. You do not normally need to turn the TPM on or off. However, you may do so using the TPM Management console.

Turn the TPM on

If the TPM has never been used, or if you wish to use the TPM again after you have turned it off, you should turn the TPM on.

This is normally done as part of the TPM initialization process.

Turn the TPM off

If you want to stop using the services provided by the TPM, you can use the TPM Management console to turn off the TPM.

You can also turn off the TPM to simulate or test the Windows BitLocker™ Drive Encryption recovery process.

Additional references

  • Understanding TPM initialization

  • Initialize the TPM


Learn more about TPM commands

Once ownership of the TPM has been taken, the TPM owner can limit which TPM commands can be executed by using Group Policy or the TPM Management console.

For more information, see the topic Control TPM Command Blocking with the TPM Management console and Control TPM Command Blocking with Group Policy.


Set up the TPM for first use

An administrator must complete a series of steps before the TPM can be used to protect your system or to encrypt your data.

This section includes the following topics:

  • Understanding TPM initialization

  • Initialize the TPM


Understanding TPM initialization

A TPM can be in a number of different states:

  • Unowned and turned off

  • Unowned and turned on

  • Owned but turned off

  • Owned and turned on

The TPM must be turned on and owned before it can be used to help secure your computer. The process of ensuring that the TPM is both turned on and owned is called initialization. During initialization, the TPM creates new root keys that are used by the TPM.

Computers manufactured to meet requirements specified for this version of Windows include preboot BIOS functionality that makes it easy to initialize a computer's TPM by using the TPM Initialization Wizard. Normally, initialization of the TPM requires the physical presence of a user or administrator at the computer to turn on the TPM. This requirement helps protect against the threat of malicious software being able to initialize a TPM.

Note

In a business or enterprise environment, your network administrator may have initialized the TPM, or your organization may have arranged specific processes with your hardware manufacturer to support TPM initialization without user intervention.

If the TPM is not initialized, the TPM Initialization Wizard guides you through the steps required to turn on and take ownership of the TPM.

In order to be used by software such as Windows BitLocker Drive Encryption, the TPM must be initialized. The BitLocker setup wizard starts the initialization process automatically while configuring BitLocker, if needed.

For more information on how to initialize the TPM, see Initialize the TPM.


Initialize the TPM

The TPM must be initialized before it can be used to help secure your computer.

Computers manufactured to meet requirements for the Windows Vista™ Logo Program include pre-boot BIOS functionality that makes it easy to initialize a computer's TPM through the TPM Initialization Wizard.

When you start the TPM Initialization Wizard, you can determine whether the computer's TPM has been initialized or not.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. In addition, the computer must be equipped with a compatible BIOS and TPM.

To start the TPM Initialization Wizard

  1. Click Start, click All Programs, click Accessories, and then click Run.

  2. In the Open text box, type tpm.msc, and then press Enter.

  3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

    The Trusted Platform Module (TPM) Management console opens.

  4. In the Trusted Platform Module (TPM) Management on Local Computer window, on the Action menu, click Initialize TPM to start the TPM Initialization Wizard.

  5. If the TPM has never been initialized, or is turned off, the TPM Initialization Wizard will display the Turn on the TPM security hardware dialog box. This dialog box provides guidance for initializing or turning on the TPM. Continue with this procedure.

    Note

    If the TPM is already turned on, the TPM Initialization Wizard displays the Create the TPM owner password dialog box. Skip the remainder of this procedure and continue with Set ownership of the TPM, later in this topic.

    Note

    If the TPM Initialization Wizard detects that you do not have a compatible BIOS, you cannot continue with the TPM Initialization Wizard, and you are alerted to consult the computer manufacturer's documentation for instructions for initializing the TPM.

  6. Click Restart.

  7. Follow the BIOS screen prompts. An acceptance prompt is displayed to ensure that a user is a physically present user, and that no malicious software is attempting to turn on the TPM.

    Note

    BIOS screen prompts and required keystrokes vary by computer manufacturer.

  8. The computer restarts again.

  9. Log on to this version of Windows with the same administrative credentials you used to start this procedure.

  10. The TPM Initialization Wizard will automatically restart. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

  11. Continue with the next procedure, Set ownership of the TPM

To finish initializing the TPM for use, you must set an owner for the TPM. The process of taking ownership includes creating an owner password for the TPM.

To set ownership of the TPM

  1. If you are not continuing immediately from the last procedure, start the TPM Initialization Wizard. If you need to review the steps to do so, see To start the TPM Initialization Wizard earlier in this topic.

  2. From the Create the TPM owner password dialog box, select Automatically create the password (recommended).

  3. From the Save your TPM owner password dialog box, click Save the password.

  4. In the Save As dialog box, select a location to save the password, then click Save. The password file is saved as computer_name.tpm.

    Important

    We highly recommend saving the TPM owner password to removable media and storing the media in a safe location.

  5. Click Print the password if you want to print a hard copy of your password.

    Important

    We highly recommend printing a hard copy of your TPM owner password and storing it in a safe location.

  6. Click Initialize.

    Note

    The process of initializing the TPM might take a few minutes to complete.

  7. Click Close.

    Caution

    Do not lose your password. If you do, you will be unable to make administrative changes unless you clear the TPM. This could result in the loss of data.


Understand keys and passwords used by the TPM

The TPM makes extensive use of asymmetric key pairs, often called "public-private key pairs". One key, the private key, is kept secret, and the corresponding public key can be widely distributed.

Topics in this section discuss some of the most important keys used by the TPM security hardware, and also discuss the owner password. This section includes the following topics:

  • Learn more about the TPM owner password

  • Changing the TPM owner password

  • Learn more about the TPM storage root key

  • Understanding the TPM endorsement key


Learn more about the TPM owner password

The TPM owner password defines who the owner of the TPM is. You own the TPM if you are able to set the TPM owner password. Only one owner password exists per TPM, so anyone who knows that password is effectively the TPM owner.

The owner of the TPM can make full use of TPM capabilities. Once an owner is set, no other user or software can claim ownership of the TPM.

Only the TPM owner can enable, disable, or clear the TPM without being physically present at the machine, by for example, using the command-line tools remotely.

In this version of Windows, taking ownership of the TPM can be done as part of the initialization process. For more information, see Set up the TPM for first use.

Applications, including Windows BitLocker Drive Encryption, can automatically start the initialization process. If you enable BitLocker™ Drive Encryption without manually initializing the TPM, the TPM owner password will be automatically created and saved in the same location as the BitLocker recovery password.

The TPM owner password can be saved as a file on a USB flash drive, or in a folder in a location away from your local computer. The password can also be printed. In the TPM Management console, when an action can only be performed by the TPM owner, you can choose the appropriate option to type the password or use the password that has been saved.

The TPM commands available to an owner are defined by the Trusted Computing Group. For more information, consult the “Owner Permission Settings” section of the specification "Structures of the TPM" available from the Trusted Computing Group Web site (http://go.microsoft.com/fwlink/?LinkId=69584).


Changing the TPM owner password

As with any password, you should change your TPM owner password if it has become compromised (that is, if you suspect it is no longer a secret).

If you want to invalidate all of the existing keys created since you took ownership of the TPM, you can clear the TPM instead of changing your owner password.

Important

Clearing the TPM could result in the loss of data. To avoid data loss, make sure you have a backup or recovery method for any data protected or encrypted by the TPM.

If you want to keep all existing keys and data intact, but wish to disable the services provided by the TPM, you can turn off the TPM instead of changing your owner password.

Additional references

  • Learn more about the TPM owner password


Learn more about the TPM storage root key

The storage root key is embedded in the TPM security hardware. It is used to protect TPM keys created by applications, so that these keys cannot be used without the TPM.

Unlike the endorsement key (which is generally created when the TPM is manufactured), the storage root key is created when you take ownership of the TPM. This means that if you clear the TPM and a new user takes ownership, a new storage root key is created.

The storage root key is defined by the Trusted Computing Group. For more information, consult the “TCG Architecture overview” specification document available from the Trusted Computing Group Web site (http://go.microsoft.com/fwlink/?LinkId=69584).

Additional references

  • Understanding the TPM endorsement key


Understanding the TPM endorsement key

The endorsement key is an encryption key that is permanently embedded in the TPM security hardware, generally at the time of manufacture. This private portion of the endorsement key is never released outside of the TPM. The public portion of the endorsement key helps to recognize a genuine TPM.

TPM operations that involve signing pieces of data can make use of the endorsement key to allow other components to verify that the data can be trusted. To sign a piece of data, a private key is used to encrypt a small piece of information. The signature can be verified by using the corresponding public key to decrypt that same piece of data. If it can be decrypted with the public key, then it must have been encrypted by the corresponding private key. As long as that private key has been kept secret, this digital signature can be trusted.

The endorsement key is defined by the Trusted Computing group. For more information, consult the “TCG Architecture overview” specification document available from the Trusted Computing Group Web site (http://go.microsoft.com/fwlink/?LinkId=69584).

Additional references

  • Learn more about the TPM storage root key


Troubleshooting TPM Management

This section contains the following topics:

  • Troubleshooting TPM initialization

  • Connect to the network

  • Managing the TPM manually


Troubleshooting TPM initialization

Managing the Trusted Platform Module (TPM) is usually a straightforward procedure. If are unable to complete the initialization procedure, review the following information:

  • If the TPM is not detected by this version of Windows, verify that your computer hardware contains a compatible TPM and BIOS. Ensure that no BIOS settings have been used to make the TPM hidden from the operating system.

  • If the TPM has been previously initialized, and you do not have the owner password, you may have to clear or reset the TPM to factory default values. For more information, see Clear the TPM.

    Caution

    Clearing the TPM could result in the loss of data. To avoid data loss, make sure you have a backup or recovery method for any data protected or encrypted by the TPM.

Since your TPM security hardware is a physical part of your computer, you may wish to read any manuals or instructions that came with your computer, or search the manufacturer's Web site. Some hints to help locate TPM-related information are included in the topic Managing the TPM manually.


Connect to the network

You cannot complete the initialization of the TPM in your computer if both of the following two conditions exist:

  • An administrator has configured your computer to require that TPM recovery information be saved in Active Directory Domain Services. This requirement can be configured through Group Policy.

  • A domain controller cannot be reached. This could occur on a computer that is not currently connected to the network, or is separated from the domain by a firewall, or because of a network component failure (such as an unplugged cable or a faulty network interface card).

In this case, an error appears, and you will not be able to complete the initialization process.

To avoid this issue, initialize the TPM while connected to the corporate network and able to contact a domain controller.


Managing the TPM manually

Microsoft works closely with hardware manufacturers and industry groups to make it possible to manage most functions of the TPM from within the TPM Management console. However, on some occasions, it may not be possible to control all aspects of your TPM security hardware from inside this version of Windows. Examples may include:

  • Hardware that does not fully support the TPM 1.2 specification

  • Hardware that does not contain a fully supported BIOS

  • Hardware that has an option to hide the TPM security hardware from the operating system

  • Hardware for which the manufacturer has decided to require that the BIOS screens be used to turn on, turn off, or clear the TPM

In such cases, you may be able to manage your TPM security hardware from the BIOS or setup screens of your computer.

Each manufacturer may use different terminology and have different menus or steps to manage the TPM. For example, rather than being called a "Trusted Platform Module", your manufacturer may refer to the TPM as an "embedded security device" or use a localized or translated name for TPM.

In order to learn how to enter the BIOS or setup system on your computer and how to perform TPM-related operations, please review the owner's manual, setup guide, or similar documentation provided with your computer. Most manufacturers also make troubleshooting and set-up information available online.

When searching for instructions about managing the TPM, you may wish to use some of the following search terms: "embedded security", "TPM", "trusted platform", "security module", "security chip", "TCG", "Trusted Computing Group", or these terms with verbs representing the specific action, such as "enable", "turn on" or "turn off".


Resources for TPM Management

TPM Management in this version of Windows works with TPM security hardware that supports the specifications defined by the Trusted Computing group. For more information, consult the Trusted Computing Group Web site (http://go.microsoft.com/fwlink/?LinkId=69593).

Trusted Platform Module security hardware is used to enable other components or software that protect your system, or encrypt data, such as Windows BitLocker™ Drive Encryption.

You may find the following resources helpful in understanding the role of TPM Management and Windows BitLocker™Drive Encryption:

  • Microsoft Trusted Platform Module Services Step-by-Step Guide (http://go.microsoft.com/fwlink?linkid=53780)

  • Microsoft BitLocker Drive Encryption Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkId=53779)

  • Windows BitLocker™ Drive Encryption technology page on the Microsoft Web site

    (http://go.microsoft.com/fwlink/?linkid=67438)