Configure the level of TPM owner authorization information available to the operating system
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows Server 2012, Windows 8 or Windows RT
Path in the GPO console
Computer Configuration\Administrative Templates\System\Trusted Platform Module Services Description
This policy setting configures how much of the TPM owner authorization information is stored in the registry of the local computer. Depending on the amount of TPM owner authorization information stored locally, the operating system and TPM-based applications can perform certain TPM actions which require TPM owner authorization without requiring the user to enter the TPM owner password. You can choose to have the operating system store either the full TPM owner authorization value, the TPM administrative delegation blob plus the TPM user delegation blob, or none. If you enable this policy setting, Windows will store the TPM owner authorization in the registry of the local computer according to the operating system managed TPM authentication setting you choose. Choose the operating system managed TPM authentication setting of "Full" to store the full TPM owner authorization, the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting allows use of the TPM without requiring remote or external storage of the TPM owner authorization value. This setting is appropriate for scenarios which do not depend on preventing reset of the TPM anti-hammering logic or changing the TPM owner authorization value. Some TPM-based applications may require this setting be changed before features which depend on the TPM anti-hammering logic can be used. Choose the operating system managed TPM authentication setting of "Delegated" to store only the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting is appropriate for use with TPM-based applications that depend on the TPM anti-hammering logic. Choose the operating system managed TPM authentication setting of "None" for compatibility with previous operating systems and applications or for use with scenarios that require TPM owner authorization not be stored locally. Using this setting might cause issues with some TPM-based applications. Note: If the operating system managed TPM authentication setting is changed from "Full" to "Delegated", the full TPM owner authorization value will be regenerated and any copies of the original TPM owner authorization value will be invalid.
Registry
Software\Policies\Microsoft\TPM MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/ADMX_TPM/OSManagedAuth_Name Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Configure the level of TPM owner authorization information available to the operating system
; State: Enabled
; Supported on: At least Windows Server 2012, Windows 8 or Windows RT
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\TPM]
"OSManagedAuthLevel"=dword:00000002More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Configure the level of TPM owner authorization information available to the operating system
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
$path = 'HKLM:\Software\Policies\Microsoft\TPM'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'OSManagedAuthLevel' -Value 2 -Type DWordIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ADMX_TPM/OSManagedAuth_Name
Data type: String
Value:
<enabled/>
<data id="SelectOSManagedAuthLevel" value="2"/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Configure the level of TPM owner authorization information available to the operating system
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\TPM' -Name 'OSManagedAuthLevel' -Expected 2 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure the level of TPM owner authorization information available to the operating system
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
$path = 'HKLM:\Software\Policies\Microsoft\TPM'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'OSManagedAuthLevel' -Value 2 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Configure the level of TPM owner authorization information available to the operating system
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Configure the level of TPM owner authorization information available to the operating system
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\TPM' -Name 'OSManagedAuthLevel' -Expected 2 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure the level of TPM owner authorization information available to the operating system
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
$path = 'HKLM:\Software\Policies\Microsoft\TPM'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'OSManagedAuthLevel' -Value 2 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.