Overview of TPM Management

Applies To: Windows Server 2008

The TPM Management console is a Microsoft Management Console (MMC) snap-in that allows administrators to interact with Trusted Platform Module (TPM) Services. TPM Services is a new feature set in this version of Windows that is used to administer the TPM security hardware in your computer. The TPM Services architecture provides the infrastructure for hardware-based security by providing access to and assuring application-level sharing of the TPM.

What is a Trusted Platform Module?

A TPM is a microchip designed to provide basic security-related functions, primarily involving encryption keys. The TPM is usually installed on the motherboard of a computer or laptop, and communicates with the rest of the system using a hardware bus.

Computers that incorporate a TPM have the ability to create cryptographic keys and encrypt them so that they can only be decrypted by the TPM. This process, often called "wrapping" or "binding" a key, can help protect the key from disclosure. Each TPM has a master "wrapping" key, called the Storage Root Key (SRK), which is stored within the TPM itself. The private portion of a key created in a TPM is never exposed to any other component, software, process, or person.

Computers that incorporate a TPM can also create a key that has not only been wrapped, but also tied to certain platform measurements. This type of key can only be unwrapped when those platform measurements have the same values that they had when the key was created. This process is called "sealing" the key to the TPM. Decrypting it is called "unsealing." The TPM can also seal and unseal data generated outside of the TPM. With this sealed key and software like Microsoft® BitLocker™ Drive Encryption, you can lock data until specific hardware or software conditions are met.

With a TPM, private portions of key pairs are kept separated from the memory controlled by the operating system. Keys can be sealed to the TPM, and certain assurances about the state of a system—assurances that define the "trustworthiness" of a system—can be made before the keys are unsealed and released for use. Because the TPM uses its own internal firmware and logic circuits for processing instructions, it does not rely on the operating system and is not exposed to vulnerabilities that might exist in the operating system or application software.

Trusted Platform Module Services components

The following table details the individual components that comprise the TPM Services feature set:

TPM Component	Purpose
TPM Driver	The TPM driver is a kernel-mode device driver designed for TPM security hardware that conforms to the Trusted Computing Group (TCG) 1.2 specifications. Conforming to TCG 1.2 provides more platform stability and eliminates the need for vendor-specific device drivers.
TPM Base Services (TBS)	TBS is a service in this version of Windows that provides sharing of the limited resources on the TPM. TBS acts as the resource controller for all applications using the TPM.
TPM Windows Management Instrumentation (WMI) provider	The TPM WMI provider exposes common TPM configuration tasks to administrators programmatically. Administrators can write a script that uses this provider.
TPM Management console	The TPM Management console is a Microsoft Management Console (MMC) snap-in that exposes common TPM configuration tasks to administrators through a user interface. Administrators can use this console to access the TPM Initialization Wizard.
TPM Initialization Wizard	The purpose of the TPM Initialization Wizard is to turn on and configure the TPM to work with applications or services that use the TPM, such as BitLocker Drive Encryption.

For more information, review other topics in this help file, and the resources listed in Resources for TPM Management.