I am attempting to use GP to store TPM information in AD. I have verified that the schema contains the proper object property, and verified that the property and the ACE is present on the given computer object.
I did notice that with the latest ADMX, it appears that
Require TPM back to AD DS is missing in the GP
Turn on TPM backup to Active Directory Domain Services, replaced with the statement:
If you enable this policy setting, TPM owner information will be automatically and silently backed up to AD DS when you use Windows to set or change a TPM owner password.
I use both
dsa.msc's Attribute Editor,
adsiedit.msc and the script
Get-TPMOwnerInfo.vbs to check the presence of the data, after resetting the TPM password, without luck.
Why can't I store TPM info in AD?
[Updates re: comments]
Could you maybe add some details about precisely how you're trying to get the TPM recovery info into AD, and precisely how it's failing?
As stated in documentation, after having a GP (
Turn on TPM backup to Active Directory Domain Services) applied to a client computer:
TPM recovery information is backed up when you: - Set the TPM owner password during TPM initialization. - Change the TPM owner password.
I am not sure, at this point, where to see errors related... other than I do not see the updated TPM info stored in the
msTPM-OwnerInformation attribute of the computer object. To be clear, the issue is that the TPM information isn't being stored in AD, and I would like to have it stored in AD.
What operating system(s) are running on the machine(s) with the TPM(s)?
I am running Windows 8.1, but will be targeting both Windows 8.1 and Windows 7.
Note that in the Group Policy Settings Reference, the following registry keys reflect the GP application:
HKLM\Software\Policies\Microsoft\TPM REG_DWORD: ActiveDirectoryBackup = 0x1 HKLM\Software\Policies\Microsoft\TPM REG_DWORD: RequireActiveDirectoryBackup = 0x1
I performed the following:
- verify that there is an ACE for
Write msTPM-OwnerInformationpermission set on the computer object in AD.
- these registry values are set as expected on the client
- I then use tpm.msc to reset the password
- There is no value is set for the