Configure the system to clear the TPM if it is not in a ready state.
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows Server 2016, Windows 10 Version 1709
Path in the GPO console
Computer Configuration\Administrative Templates\System\Trusted Platform Module Services Description
This policy setting configures the system to prompt the user to clear the TPM if the TPM is detected to be in any state other than Ready. This policy will take effect only if the system’s TPM is in a state other than Ready, including if the TPM is “Ready, with reduced functionality”. The prompt to clear the TPM will start occurring after the next reboot, upon user login only if the logged in user is part of the Administrators group for the system. The prompt can be dismissed, but will reappear after every reboot and login until the policy is disabled or until the TPM is in a Ready state.
Registry
HKLM
Software\Policies\Microsoft\TPM Value name: ClearTPMIfNotReadyGP
Enabled: ClearTPMIfNotReadyGP = 1
Disabled: ClearTPMIfNotReadyGP = 0
MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/ADMX_TPM/ClearTPMIfNotReady_Name Multiple CSP matches are possible; the first one was selected.
Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Configure the system to clear the TPM if it is not in a ready state.
; State: Enabled
; Supported on: At least Windows Server 2016, Windows 10 Version 1709
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\TPM]
"ClearTPMIfNotReadyGP"=dword:00000001More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Configure the system to clear the TPM if it is not in a ready state.
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1709
$path = 'HKLM:\Software\Policies\Microsoft\TPM'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ClearTPMIfNotReadyGP' -Value 1 -Type DWordIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ADMX_TPM/ClearTPMIfNotReady_Name
Data type: String
Value:
<enabled/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Configure the system to clear the TPM if it is not in a ready state.
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1709
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\TPM' -Name 'ClearTPMIfNotReadyGP' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure the system to clear the TPM if it is not in a ready state.
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1709
$path = 'HKLM:\Software\Policies\Microsoft\TPM'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ClearTPMIfNotReadyGP' -Value 1 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Configure the system to clear the TPM if it is not in a ready state.
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1709
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Configure the system to clear the TPM if it is not in a ready state.
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1709
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\TPM' -Name 'ClearTPMIfNotReadyGP' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure the system to clear the TPM if it is not in a ready state.
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1709
$path = 'HKLM:\Software\Policies\Microsoft\TPM'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ClearTPMIfNotReadyGP' -Value 1 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.