1

I have several HP desktops running latest Windows 10 and requiring a TPM firmware upgrade (sp82407.exe) to fix last year's faulty Infineon crypto vulnerability. The updater requires the TPM to be initialized, and requires the user to input either the passphrase, or the key backup file to proceed.

Windows 10 refuses to bring up the passphrase entry / key backup dialog during TPM initialization, no matter what I try. All the guides I read are either outdated or outright wrong. On Win7 it used to be easy, the option to manually initialize was right there in tpm.msc. But Win10 at some point changed it, so that by default, for security reasons, a random key is generated and then discarded. So now upgrading the firmware is impossible.

This is made even worse by the TPM's requirement to be physically present to press F3 at boot time to confirm the TPM clearing step. I have spent literally hours on-site repeatedly restarting a slowly-booting PC and trying various commands and toggles from guides I found. It's frustrating and upsetting. Neither Microsoft nor HP acknowledge any of this behavior in their TPM documentation, and the firmware upgrade tool does not accomodate for this new Windows behavior.

So, can anyone provide working instructions for how to switch TPM initialization into manual mode on latest Windows 10?

1

According to Readme.html included in the sp82407.exe SoftPaq archive:

Windows 10 ® Version 1607 and later
The owner authorization is no longer stored on the local system. To update the firmware you need to clear the TPM and take ownership again with modified Windows setting so that owner authorization is stored on the local system.

The following steps are needed to update the firmware:

  1. Set registry key 'HKLM\Software\Policies\Microsoft\TPM\OSManagedAuthLevel' to 4 [REG_DWORD].
  2. Start tpm.msc and click on 'Clear TPM...'. Restart the computer.
  3. Start tpm.msc and click on 'Prepare the TPM...'.
  4. Run the TPM Firmware Update tool and update the firmware. Restart the computer.
  5. Restore the registry key to its previous value.
  6. Start tpm.msc and click on 'Clear TPM...'. Restart the computer.
  7. Start tpm.msc and click on 'Prepare the TPM...'.

As to how exactly this works, I have used the name of the registry key to find TPM Group Policy settings. It explains what the various values mean and how they behave:

If you enable this policy setting, the Windows operating system will store the TPM owner authorization in the registry of the local computer according to the TPM authentication setting you choose.
0 = None, 2 = Delegated, 4 = Full. Beginning with Windows 10 version 1703, the default value is 5 (dummy).

I also found a Microsoft blog post TPM Owner Password which goes into detail about where and how the password is stored, and how to make use of it.

For never operating systems (Windows 8.1/10) TPM is auto-provisioned – that means TPM is automatically activated. Windows uses the randomly-generated Lockout Auth to provision the TPM, then destroys the Lockout Auth without ever revealing it to the user. However, depending on GPO settings, TPM Owner Password can be stored additionally in the registry.

So the trick is to set OSManagedAuthLevel to Full and reinitialize. There is still no key backup UI, but the presence of the registry key will cause the TPM key to get saved in the registry. According to the readme, the updater should then be able to fetch the key automatically. If it doesn't, the key can be extracted from the registry.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.