[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244411

 
 

909

 
 

193363

 
 

277

Paid content will be excluded from the download.


Download | Alert*
CCE
view XML

CCE-33282-5

Platform: cpe:/o:microsoft:windows_8.1Date: (C)2015-10-14   (M)2023-07-04



Turn on TPM backup to Active Directory Domain Services This policy setting allows you to manage the Active Directory Domain Services (AD DS) backup of Trusted Platform Module (TPM) owner information. TPM owner information includes a cryptographic hash of the TPM owner password. Certain TPM commands can only be run by the TPM owner. This hash authorizes the TPM to run these commands. If you enable this policy setting, TPM owner information will be automatically and silently backed up to AD DS when you use Windows to set or change a TPM owner password. If you select the option to 'Require TPM backup to AD DS', a TPM owner password cannot be set or changed unless the computer is connected to the domain and the AD DS backup succeeds. This option is selected by default to help ensure that TPM owner information is available. Otherwise, AD DS backup is attempted but network or other backup failures do not impact TPM management. Backup is not automatically retried and the TPM owner information may not have been stored in AD DS during BitLocker setup. If you disable or do not configure this policy setting, TPM owner information will not be backed up to AD DS. Note: You must first set up appropriate schema extensions and access control settings on the domain before AD DS backup can succeed. Consult online documentation for more information about setting up Active Directory Domain Services for TPM. Note: The TPM cannot be used to provide enhanced security features for BitLocker Drive Encryption and other applications without first setting an owner. To take ownership of the TPM with an owner password, run 'tpm.msc' and select the action to 'Initialize TPM'. Note: If the TPM owner information is lost or is not available, limited TPM management is possible by running 'tpm.msc' on the local computer.


Parameter:

[enable/disable]


Technical Mechanism:

(1) GPO: Computer ConfigurationAdministrative TemplatesSystemTrusted Platform Module Services!Turn on TPM backup to Active Directory Domain Services (2) REG: HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftTPM!ActiveDirectoryBackup

CCSS Severity:CCSS Metrics:
CCSS Score : 7.0Attack Vector: LOCAL
Exploit Score: 1.1Attack Complexity: HIGH
Impact Score: 5.3Privileges Required: LOW
Severity: HIGHUser Interaction: NONE
Vector: AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:LScope: CHANGED
 Confidentiality: HIGH
 Integrity: LOW
 Availability: LOW
  

References:
Resource IdReference
SCAP Repo OVAL Definitionoval:org.secpod.oval:def:28791


OVAL    1
oval:org.secpod.oval:def:28791
XCCDF    1
xccdf_org.secpod_benchmark_general_Windows_8_1

© SecPod Technologies