Configure TPM platform validation profile for native UEFI firmware configurations

Verified with Windows 11 25H2 — updated on July 10, 2026

Supported on: At least Windows Server 2012, Windows 8 or Windows RT

Path in the GPO console

Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

Description

This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection. Important: This group policy only applies to computers with a native UEFI firmware configuration. Computers with BIOS or UEFI firmware with a Compatibility Service Module (CSM) enabled store different values into the Platform Configuration Registers (PCRs). Use the "Configure TPM platform validation profile for BIOS-based firmware configurations" group policy setting to configure the TPM PCR profile for computers with BIOS configurations or computers with UEFI firmware with a CSM enabled. If you enable this policy setting before turning on BitLocker, you can configure the boot components that the TPM will validate before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM will not release the encryption key to unlock the drive and the computer will instead display the BitLocker Recovery console and require that either the recovery password or recovery key be provided to unlock the drive. If you disable or do not configure this policy setting, BitLocker uses the default platform validation profile for the available hardware or the platform validation profile specified by the setup script. A platform validation profile consists of a set of Platform Configuration Register (PCR) indices ranging from 0 to 23. On PCs that lack Secure Boot State (PCR 7) support, the default platform validation profile secures the encryption key against changes to the core system firmware executable code (PCR 0), extended or pluggable executable code (PCR 2), boot manager (PCR 4), and the BitLocker access control (PCR 11). When Secure Boot State (PCR7) support is available, the default platform validation profile secures the encryption key using Secure Boot State (PCR 7) and the BitLocker access control (PCR 11). Warning: Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending upon inclusion or exclusion (respectively) of the PCRs. Specifically, setting this policy with PCR 7 omitted, will override the "Allow Secure Boot for integrity validation" group policy, preventing BitLocker from using Secure Boot for platform or Boot Configuration Data (BCD) integrity validation. Setting this policy may result in BitLocker recovery when firmware is updated. If you set this policy to include PCR 0, suspend BitLocker prior to applying firmware updates. It is recommended to not configure this policy, to allow Windows to select the PCR profile for the best combination of security and usability based on the available hardware on each PC.

Registry

HKLM SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI

Value name: Enabled

Enabled: Enabled = 1

Disabled: Enabled = 0

More options available

Options

PCR 0: Core System Firmware executable code

0 boolean - default: 1

PCR 1: Core System Firmware data

1 boolean

PCR 2: Extended or pluggable executable code

2 boolean - default: 1

PCR 3: Extended or pluggable firmware data

3 boolean

PCR 4: Boot Manager

4 boolean - default: 1

PCR 5: GPT / Partition Table

5 boolean

PCR 6: Resume from S4 and S5 Power State Events

6 boolean

PCR 7: Secure Boot State

7 boolean

PCR 8: Initialized to 0 with no Extends (reserved for future use)

8 boolean

PCR 9: Initialized to 0 with no Extends (reserved for future use)

9 boolean

PCR 10: Initialized to 0 with no Extends (reserved for future use)

10 boolean

PCR 11: BitLocker Access Control

11 boolean - default: 1

PCR 12: Data events and highly volatile events

12 boolean

PCR 13: Boot Module Details

13 boolean

PCR 14: Boot Authorities

14 boolean

PCR 15: Reserved for Future Use

15 boolean

PCR 16: Reserved for Future Use

16 boolean

PCR 17: Reserved for Future Use

17 boolean

PCR 18: Reserved for Future Use

18 boolean

PCR 19: Reserved for Future Use

19 boolean

PCR 20: Reserved for Future Use

20 boolean

PCR 21: Reserved for Future Use

21 boolean

PCR 22: Reserved for Future Use

22 boolean

PCR 23: Reserved for Future Use

23 boolean

Export Builder

BETA

Configure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.

These exports write the registry — this is not a managed GPO. ⓘ

Not configured Enabled Disabled

.reg file

Windows Registry Editor Version 5.00

; Exported from gporais.com
; Policy: Configure TPM platform validation profile for native UEFI firmware configurations
; State: Enabled
; Supported on: At least Windows Server 2012, Windows 8 or Windows RT

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI]
"Enabled"=dword:00000001
"0"=dword:00000001
"1"=dword:00000000
"2"=dword:00000001
"3"=dword:00000000
"4"=dword:00000001
"5"=dword:00000000
"6"=dword:00000000
"7"=dword:00000000
"8"=dword:00000000
"9"=dword:00000000
"10"=dword:00000000
"11"=dword:00000001
"12"=dword:00000000
"13"=dword:00000000
"14"=dword:00000000
"15"=dword:00000000
"16"=dword:00000000
"17"=dword:00000000
"18"=dword:00000000
"19"=dword:00000000
"20"=dword:00000000
"21"=dword:00000000
"22"=dword:00000000
"23"=dword:00000000

More formats (PowerShell, Intune, SCCM)

PowerShell

# Exported from gporais.com
# Policy: Configure TPM platform validation profile for native UEFI firmware configurations
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT

$path = 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Enabled' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name '0' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name '1' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '2' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name '3' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '4' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name '5' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '6' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '7' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '8' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '9' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '10' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '11' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name '12' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '13' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '14' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '15' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '16' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '17' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '18' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '19' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '20' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '21' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '22' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '23' -Value 0 -Type DWord

Intune XML

No direct Policy CSP / OMA-URI mapping for this policy. Use the Intune Remediation tab, or ingest the ADMX in Intune.

Intune Remediation

# === Detection script ===
# Exported from gporais.com
# Policy: Configure TPM platform validation profile for native UEFI firmware configurations
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT

function Test-RegistryValue {
  param(
    [Parameter(Mandatory = $true)][string]$Path,
    [Parameter(Mandatory = $true)][string]$Name,
    [object]$Expected,
    [ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
    [switch]$Absent
  )

  try {
    $item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
  } catch {
    return $Absent.IsPresent
  }

  if ($Absent.IsPresent) { return $false }
  $actual = $item.$Name

  if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
  if ($Kind -eq 'MultiString') {
    $actualValues = @($actual)
    $expectedValues = @($Expected)
    if ($actualValues.Count -ne $expectedValues.Count) { return $false }
    for ($i = 0; $i -lt $expectedValues.Count; $i++) {
      if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
    }
    return $true
  }

  return [string]$actual -eq [string]$Expected
}

$checks = @(
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name 'Enabled' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '0' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '1' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '2' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '3' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '4' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '5' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '6' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '7' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '8' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '9' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '10' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '11' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '12' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '13' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '14' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '15' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '16' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '17' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '18' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '19' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '20' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '21' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '22' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '23' -Expected 0 -Kind DWord)
)

if ($checks -notcontains $false) {
  Write-Output 'Compliant'
  exit 0
}

Write-Output 'Non-compliant'
exit 1

# === Remediation script ===
# Exported from gporais.com
# Policy: Configure TPM platform validation profile for native UEFI firmware configurations
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT

$path = 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Enabled' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name '0' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name '1' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '2' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name '3' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '4' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name '5' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '6' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '7' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '8' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '9' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '10' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '11' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name '12' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '13' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '14' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '15' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '16' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '17' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '18' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '19' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '20' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '21' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '22' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '23' -Value 0 -Type DWord

SCCM scripts

# Exported from gporais.com
# Policy: Configure TPM platform validation profile for native UEFI firmware configurations
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.

# === Detection script ===
# Exported from gporais.com
# Policy: Configure TPM platform validation profile for native UEFI firmware configurations
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT

function Test-RegistryValue {
  param(
    [Parameter(Mandatory = $true)][string]$Path,
    [Parameter(Mandatory = $true)][string]$Name,
    [object]$Expected,
    [ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
    [switch]$Absent
  )

  try {
    $item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
  } catch {
    return $Absent.IsPresent
  }

  if ($Absent.IsPresent) { return $false }
  $actual = $item.$Name

  if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
  if ($Kind -eq 'MultiString') {
    $actualValues = @($actual)
    $expectedValues = @($Expected)
    if ($actualValues.Count -ne $expectedValues.Count) { return $false }
    for ($i = 0; $i -lt $expectedValues.Count; $i++) {
      if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
    }
    return $true
  }

  return [string]$actual -eq [string]$Expected
}

$checks = @(
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name 'Enabled' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '0' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '1' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '2' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '3' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '4' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '5' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '6' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '7' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '8' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '9' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '10' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '11' -Expected 1 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '12' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '13' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '14' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '15' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '16' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '17' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '18' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '19' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '20' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '21' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '22' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI' -Name '23' -Expected 0 -Kind DWord)
)

if ($checks -notcontains $false) {
  Write-Output 'Compliant'
  exit 0
}

Write-Output 'Non-compliant'
exit 1

# === Remediation script ===
# Exported from gporais.com
# Policy: Configure TPM platform validation profile for native UEFI firmware configurations
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT

$path = 'HKLM:\SOFTWARE\Policies\Microsoft\FVE\OSPlatformValidation_UEFI'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Enabled' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name '0' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name '1' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '2' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name '3' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '4' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name '5' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '6' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '7' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '8' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '9' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '10' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '11' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name '12' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '13' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '14' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '15' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '16' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '17' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '18' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '19' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '20' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '21' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '22' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '23' -Value 0 -Type DWord

Building a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.

Open the Builder

Search GPORais

Configure TPM platform validation profile for native UEFI firmware configurations

Path in the GPO console

Description

Registry

Options

Export Builder

.reg file

PowerShell

Intune XML

Intune Remediation

SCCM scripts

Embed this policy on your site

Configure TPM platform validation profile for native UEFI firmware configurations

Path in the GPO console

Description

Registry

Options

Export Builder

.reg file

PowerShell

Intune XML

Intune Remediation

SCCM scripts

Related settings

In the same console folder: “Operating System Drives”