0

I've encrypted my hard drive with Windows 10 version 1803 installed on it. I used BitLocker for it, but before the encryption process I had TPM turned off in UEFI. Suddenly I found it that it can be enabled, and so I turned it off, changed the required Group Policy for using BitLocker without a proper TPM chip back to "Not Configured". Then I also opened tpm.msc and clicked "Clear TPM".

That's what PowerShell returns (expect I'm not showing you the keys):

PS C:\WINDOWS\system32> Get-TpmEndorsementKeyInfo


IsPresent                : True
PublicKey                : System.Security.Cryptography.AsnEncodedData
PublicKeyHash            :
ManufacturerCertificates : {}
AdditionalCertificates   : {[Subject]
                         TPMVersion=id:00020000, TPMModel=SPT, TPMManufacturer=id:4{cutout}

                       [Issuer]
                         CN=www.intel.com, OU=TPM EK intermediate for SPTH_EPID_PROD, O=Intel Corporation, L=Santa
                       Clara, S=CA, C=US

                       [Serial Number]
                         008B58F92C

                       [Not Before]
                         11/23/2015 7:00:00 AM

                       [Not After]
                         1/1/2050 6:59:59 AM

                       [Thumbprint]
                         55{cutout}
                       }



PS C:\WINDOWS\system32> Get-Tpm


TpmPresent                : True
TpmReady                  : True
ManufacturerId            : 12{cutout}
ManufacturerIdTxt         : INTC
ManufacturerVersion       : 11.6
ManufacturerVersionFull20 : 11.6.0.1126

ManagedAuthLevel          : Full
OwnerAuth                 : LZ{cutout}
OwnerClearDisabled        : False
AutoProvisioning          : Enabled
LockedOut                 : False
LockoutHealTime           : 2 hours
LockoutCount              : 0
LockoutMax                : 32
SelfTest                  : {}

So, should I deencrypt my hard drive in order to get the keys stored in my TPM or is it already in use?

  • 1
    If you run "manage-bde -protectors c: -get" does it return key protectors ? – pun Aug 7 '18 at 14:59
  • Yeah. I see Numerical Password here with two sections, External Key and Password in return. – Mishka Aug 7 '18 at 15:01
  • If you did not have TPM enabled during the encrypt, it is not being used now. I would strongly advice to decrypt and then reencrypt using TPM, as TPM will ensure that the data can only be accessed by this device. If someone were to take out your harddisk in an attempt to access the files and bypass any login, they would fail. If your device does not ask for a password at boot, encryption is kinda useless though.... – LPChip Aug 7 '18 at 15:57
0

I've encrypted my hard drive with Windows 10 version 1803 installed on it. I used BitLocker for it, but before the encryption process, I had TPM turned off in UEFI.

If you had TPM disabled, when you enabled BitLocker, then your key was stored in the TPM since it was disabled.

So, should I unencrypt my hard drive in order to get the keys stored in my TPM or is it already in use?

If you want your TPM to be used then you should do this. Be sure you follow all instructions to back up your recovery key. If you ever disable or clear the keys stored in your TPM your data cannot be recovered without the recovery key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.