MINI

files >> C:/Windows/PolicyDefinitions/en-US/TPM.adml
 <?xml version="1.0" encoding="utf-8"?>
<!--  (c) 2006 Microsoft Corporation  -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
  <displayName>enter display name here</displayName>
  <description>enter description here</description>
  <resources>
    <stringTable>
      <string id="ActiveDirectoryBackup_Help">This policy setting allows you to manage the Active Directory Domain Services (AD DS) backup of Trusted Platform Module (TPM) owner information. 

TPM owner information includes a cryptographic hash of the TPM owner password. Certain TPM commands can only be run by the TPM owner. This hash authorizes the TPM to run these commands. 

If you enable this policy setting, TPM owner information will be automatically and silently backed up to AD DS when you use Windows to set or change a TPM owner password. 

If you select the option to "Require TPM backup to AD DS", a TPM owner password cannot be set or changed unless the computer is connected to the domain and the AD DS backup succeeds. This option is selected by default to help ensure that TPM owner information is available. Otherwise, AD DS backup is attempted but network or other backup failures do not impact TPM management. Backup is not automatically retried and the TPM owner information may not have been stored in AD DS during BitLocker setup.

If you disable or do not configure this policy setting, TPM owner information will not be backed up to AD DS. 

Note: You must first set up appropriate schema extensions and access control settings on the domain before AD DS backup can succeed. Consult online documentation for more information about setting up Active Directory Domain Services for TPM.

Note: The TPM cannot be used to provide enhanced security features for BitLocker Drive Encryption and other applications without first setting an owner. To take ownership of the TPM with an owner password, run "tpm.msc" and select the action to "Initialize TPM".

Note: If the TPM owner information is lost or is not available, limited TPM management is possible by running "tpm.msc" on the local computer.</string>
      <string id="ActiveDirectoryBackup_Name">Turn on TPM backup to Active Directory Domain Services</string>
      <string id="BlockedCommandsList_Help">This policy setting allows you to manage the Group Policy list of Trusted Platform Module (TPM) commands blocked by Windows.

If you enable this policy setting, Windows will block the specified commands from being sent to the TPM on the computer. TPM commands are referenced by a command number. For example, command number 129 is TPM_OwnerReadInternalPub, and command number 170 is TPM_FieldUpgrade. To find the command number associated with each TPM command, run "tpm.msc" and navigate to the "Command Management" section.

If you disable or do not configure this policy setting, only those TPM commands specified through the default or local lists may be blocked by Windows. The default list of blocked TPM commands is pre-configured by Windows. You can view the default list by running "tpm.msc", navigating to the "Command Management" section, and making visible the "On Default Block List" column. The local list of blocked TPM commands is configured outside of Group Policy by running "tpm.msc" or through scripting against the Win32_Tpm interface. See related policy settings to enforce or ignore the default and local lists of blocked TPM commands.</string>
      <string id="BlockedCommandsList_Name">Configure the list of blocked TPM commands</string>
      <string id="IgnoreDefaultList_Help">This policy setting allows you to enforce or ignore the computer's default list of blocked Trusted Platform Module (TPM) commands.

If you enable this policy setting, Windows will ignore the computer's default list of blocked TPM commands and will only block those TPM commands specified by Group Policy or the local list. 

The default list of blocked TPM commands is pre-configured by Windows. You can view the default list by running "tpm.msc", navigating to the "Command Management" section, and making visible the "On Default Block List" column. The local list of blocked TPM commands is configured outside of Group Policy by running "tpm.msc" or through scripting against the Win32_Tpm interface. See the related policy setting to configure the Group Policy list of blocked TPM commands.

If you disable or do not configure this policy setting, Windows will block the TPM commands in the default list, in addition to commands in the Group Policy and local lists of blocked TPM commands. </string>
      <string id="IgnoreDefaultList_Name">Ignore the default list of blocked TPM commands</string>
      <string id="IgnoreLocalList_Help">This policy setting allows you to enforce or ignore the computer's local list of blocked Trusted Platform Module (TPM) commands.

If you enable this policy setting, Windows will ignore the computer's local list of blocked TPM commands and will only block those TPM commands specified by Group Policy or the default list.

The local list of blocked TPM commands is configured outside of Group Policy by running "tpm.msc" or through scripting against the Win32_Tpm interface. The default list of blocked TPM commands is pre-configured by Windows. See the related policy setting to configure the Group Policy list of blocked TPM commands. 

If you disable or do not configure this policy setting, Windows will block the TPM commands found in the local list, in addition to commands in the Group Policy and default lists of blocked TPM commands.</string>
      <string id="IgnoreLocalList_Name">Ignore the local list of blocked TPM commands</string>
      <string id="TPMCategory">Trusted Platform Module Services</string>
    </stringTable>
    <presentationTable>
      <presentation id="ActiveDirectoryBackup_Name">
        <checkBox refId="RequireActiveDirectoryBackup_Name" defaultChecked="true">Require TPM backup to AD DS</checkBox>
        <text/>
        <text>If selected, cannot set or change TPM owner password </text>
        <text>if backup fails (recommended default).</text>
        <text/>
        <text>If not selected, can set or change TPM owner password</text>
        <text>even if backup fails. Backup is not automatically retried.</text>
      </presentation>
      <presentation id="BlockedCommandsList_Name">
        <text>Specify the commands to block by adding their numbers to the list.</text>

        <listBox refId="BlockedCommandsList_Ordinals2">The list of blocked TPM commands:</listBox>
        <text>For example, to block the commands TPM_OwnerReadInternalPub</text>
        <text>and TPM_FieldUpgrade, add items 129 and 170 to the list.</text>
      </presentation>
    </presentationTable>
  </resources>
</policyDefinitionResources>