1 Answer
Sorted by:
Highest score (default) Date modified (newest first) Date created (oldest first)
1
According to Readme.html included in the sp82407.exe SoftPaq archive:
Windows 10 ® Version 1607 and later
The owner authorization is no longer stored on the local system. To update the firmware you need to clear the TPM and take ownership again with modified Windows setting so that owner authorization is stored on the local system.
The following steps are needed to update the firmware:
- Set registry key 'HKLM\Software\Policies\Microsoft\TPM\OSManagedAuthLevel' to 4 [REG_DWORD].
- Start tpm.msc and click on 'Clear TPM...'. Restart the computer.
- Start tpm.msc and click on 'Prepare the TPM...'.
- Run the TPM Firmware Update tool and update the firmware. Restart the computer.
- Restore the registry key to its previous value.
- Start tpm.msc and click on 'Clear TPM...'. Restart the computer.
- Start tpm.msc and click on 'Prepare the TPM...'.
As to how exactly this works, I have used the name of the registry key to find
TPM Group Policy settings. It explains what the various values mean and how they behave:
If you enable this policy setting, the Windows operating system will store the TPM owner authorization in the registry of the local computer according to the TPM authentication setting you choose.
0 = None, 2 = Delegated, 4 = Full. Beginning with Windows 10 version 1703, the default value is 5 (dummy).
I also found a Microsoft blog post
TPM Owner Password which goes into detail about where and how the password is stored, and how to make use of it.
For never operating systems (Windows 8.1/10) TPM is auto-provisioned – that means TPM is automatically activated. Windows uses the randomly-generated Lockout Auth to provision the TPM, then destroys the Lockout Auth without ever revealing it to the user. However, depending on GPO settings, TPM Owner Password can be stored additionally in the registry.
So the trick is to set OSManagedAuthLevel to Full and reinitialize. There is still no key backup UI, but the presence of the registry key will cause the TPM key to get saved in the registry. According to the readme, the updater should then be able to fetch the key automatically. If it doesn't, the key can be extracted from the registry.
