I recently cleared my TPM (Dell e7240, Windows 10). During the process, at no point did Bios or Windows ask for a new TPM password. (And at no point since I bought this laptop did I ever set a TPM password, to the best of my knowledge.) I have tried clearing both via Windows (with TPM.MSC) and via Bios, and with neither method was I asked for a new password.
TPM.MSC reports that the TPM is "ready for use", but if I click "change owner password", it asks for the old password, despite me having just cleared the TPM.
Is it possible to clear the TPM password?
Answer
I had the same problem. This is what I found after a lot of searching: Later versions of Windows 10 do not allow you to set, save or change the TPM owner password by default. The password is generated by windows, used by windows to configure the TPM then discarded. That way nobody can tamper with the TPM after it has been activated. In effect, the owner password no longer exists. You can disable this security feature by changing a registry value, clearing the TPM and rebooting. After that, you will be able to set and change the TPM owner password. See this article: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/change-the-tpm-owner-password?f=255&MSPPError=-2147217396
After reading the article, I decided to leave things as they are, with the new Windows default (i.e. no way to access or change TPM owner password). You only need the TPM owner password if the PC security is being centrally managed in an enterprise setup with the need for a security admin to access the TPM remotely. In a stand-alone application, remote access to the TPM is not needed or desirable. You can do everything you need without the TPM password if you have physical access to the PC.
No comments:
Post a Comment