Ignore the default list of blocked TPM commandsID: oval:org.secpod.oval:def:28386 | Date: (C)2015-10-08 (M)2023-07-04 |
Class: COMPLIANCE | Family: windows |
This policy setting allows you to enforce or ignore the computer's default list of blocked Trusted Platform Module (TPM) commands.
If you enable this policy setting, Windows will ignore the computer's default list of blocked TPM commands and will only block those TPM commands specified by Group Policy or the local list.
The default list of blocked TPM commands is pre-configured by Windows. You can view the default list by running tpm.msc, navigating to the Command Management section, and making visible the On Default Block List column. The local list of blocked TPM commands is configured outside of Group Policy by running tpm.msc or through scripting against the Win32_Tpm interface. See the related policy setting to configure the Group Policy list of blocked TPM commands.
If you disable or do not configure this policy setting, Windows will block the TPM commands in the default list, in addition to commands in the Group Policy and local lists of blocked TPM commands.
Fix:
(1) GPO: Computer Configuration\Administrative Templates\System\Trusted Platform Module Services!Ignore the default list of blocked TPM commands
(2) REG: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\TPM\BlockedCommands!IgnoreDefaultList
Platform: |
Microsoft Windows Server 2012 R2 |