Hvis du efter en vellykket implementering af Windows 10 bemærker, at Trusted Platform Module (TPM) er i reduceret funktionalitetstilstand, så er dette indlæg beregnet til at hjælpe dig. I dette indlæg vil vi identificere nogle potentielle kendte årsager til denne adfærd og derefter give en løsning på dette problem samt den foranstaltning, du kan tage for at forhindre, at problemet opstår under installationen af Windows 10 .

Du kan støde på dette problem baseret på følgende scenarie.

Du bruger Microsoft Deployment Toolkit (dette kan være en hvilken som helst version af MDT , der understøtter Windows 10 ) til at implementere Windows 10 ved at bruge trinnet " Aktiver BitLocker (offline)^{(Enable BitLocker (offline))} " (ZTIBDE.wsf-script) til at forudklarere BitLocker under Windows PE i " Forinstaller^(Preinstall) gruppen ”, og implementeringen er vellykket.

Men i dette scenarie bemærker du, at Trusted Platform Module ( TPM ) er i reduceret funktionalitetstilstand. I denne situation rapporterer TPM Management -konsollen ( TPM.msc ) følgende problem:

TPM'en er^(TPM) klar til brug med reduceret funktionalitet. Informationsflag: 0x900 TPM
-ejerautorisationen er ikke gemt korrekt i registreringsdatabasen. Windowss registreringsoplysninger om TPM's Storage Root Key stemmer ikke overens med TPM Storage Root Key eller mangler.

TPM'en er klar til brug med reduceret funktionalitet

TPM'en er^(TPM) klar til brug med reduceret funktionalitet

Hvis du står over for problemet med TPM-reduceret funktionalitet^{(TPM reduced functionality )} , kan du omgå dette problem for nye implementeringer, indtil en ny version af MDT er tilgængelig – tilføj kommandoen nedenfor til ZTIBDE.wsf- scriptet i starten af afsnittet " Hovedfunktion^{(Function Main)} ". :

reg add hklm\system\currentcontrolset\services\tpm\wmi -v UseNullDerivedOwnerAuth -t REG_DWORD -d 0x01 -f

Det er værd at bemærke, at enheder, hvor TPM'en^(TPM) allerede er i reduceret funktionstilstand, skal TPM'en ryddes^{(TPM must be cleared)} , før du kan afhjælpe dette problem.

For at forhindre dette problem i at opstå, skal du ikke forudprovisionere BitLocker , i stedet vente med at aktivere hele systemet. Vær opmærksom på, at implementeringen vil tage længere tid at fuldføre ved at bruge denne metode.

Ifølge Microsoft opstår problemet med reduceret TPM-funktionalitet^{(TPM reduced functionality )} , fordi TpmValidate- funktionen i ZTIBDE.wsf- scriptet overtager ejerskabet af TPM'en^(TPM) fra Windows PE unødigt. Windows bør være i stand til korrekt at tage ejerskab af TPM'en^(TPM) før Out-of-Box Experience (OOBE) for at klargøre den ved at bruge de korrekte parametre.

Når denne ændring i ejerskab af TPM'en^(TPM) fra Windows PE sker, får TPM'en^(TPM) parametre, som Windows ikke forstår. Derfor er nøglehierarkierne i TPM deaktiveret og gjort permanent utilgængelige for Windows .

The TPM is ready for use, with reduced functionality

If aftеr а successful deployment of Windоws 10 and you notice that the Trusted Platform Module (TPM) is in reduced functiоnality mode, then thiѕ post is intended to help you. In this post, we will identify ѕome potential known causes for this behavior and then provide the workaroυnd for this isѕue as well as the measυre you can take to prevent the issue from occurring during the deployment of Windows 10.

You might encounter this issue based on the following scenario.

You use Microsoft Deployment Toolkit (This can be any version of MDT that supports Windows 10) to deploy Windows 10 by using the “Enable BitLocker (offline)” step (ZTIBDE.wsf script) to pre-provision BitLocker during Windows PE in the “Preinstall” group and the deployment is successful.

However, in this scenario, you notice that the Trusted Platform Module (TPM) is in reduced functionality mode. In this situation, the TPM Management console (TPM.msc) reports the following issue:

The TPM is ready for use, with reduced functionality. Information Flags: 0x900
The TPM owner authorization is not properly stored in the registry.
Windows’s registry information about the TPM’s Storage Root Key does not match the TPM Storage Root Key or is missing.

The TPM is ready for use, with reduced functionality

If you’re faced with the TPM reduced functionality issue, you can work around this issue for new deployments until a new version of MDT is available – add the command below to the ZTIBDE.wsf script at the start of the “Function Main” section:

reg add hklm\system\currentcontrolset\services\tpm\wmi -v UseNullDerivedOwnerAuth -t REG_DWORD -d 0x01 -f

It is worth noting that devices in which the TPM is already in reduced functionality mode, the TPM must be cleared before you can mitigate this issue.

To prevent this issue from occurring, you’ll need to not pre-provision BitLocker, instead wait to enable the full system. Be aware that the deployment will take longer to complete by using this method.

According to Microsoft, the TPM reduced functionality issue occurs because the TpmValidate function in the ZTIBDE.wsf script takes ownership of the TPM from Windows PE unnecessarily. Windows should be able to correctly take ownership of the TPM before Out-of-Box Experience (OOBE) to provision it by using the correct parameters.

When this change in ownership of the TPM from Windows PE occurs, the TPM is given parameters that Windows does not understand. Therefore, the key hierarchies in the TPM are disabled and made permanently unavailable to Windows.

Saga Fransson

About the author

Jeg er softwareingeniør med erfaring i Xbox Explorer, Microsoft Excel og Windows 8.1 Explorer. I min fritid kan jeg godt lide at spille videospil og se tv. Jeg har en grad fra University of Utah og arbejder i øjeblikket som softwareingeniør for en international virksomhed.

TPM'en er klar til brug med reduceret funktionalitet

TPM'en er^(TPM) klar til brug med reduceret funktionalitet

The TPM is ready for use, with reduced functionality