如果在成功部署Windows 10之后，您注意到受信任的平台模块 (TPM)处于缩减功能模式，那么这篇文章旨在帮助您。在这篇文章中，我们将确定导致此行为的一些潜在已知原因，然后提供此问题的解决方法以及您可以采取的措施，以防止在Windows 10部署期间发生此问题。

根据以下场景，您可能会遇到此问题。

您使用 Microsoft部署工具包^{(Deployment Toolkit)}（可以是任何支持Windows 10的^{(Windows 10)}MDT版本）部署Windows 10，方法是使用“启用 BitLocker（离线）^{(Enable BitLocker (offline))}”^(BitLocker)步骤（ZTIBDE.wsf 脚本）^{((ZTIBDE.wsf script))}在Windows PE期间在“预安装^(Preinstall)”组，部署成功。

但是，在这种情况下，您会注意到受信任的平台模块^{(Trusted Platform Module)}( TPM ) 处于缩减功能模式。在这种情况下，TPM 管理^{(TPM Management)}控制台 ( TPM.msc ) 报告以下问题：

TPM已准备好使用，但功能已减少。信息标志：0x900 TPM
所有者授权未正确存储在注册表中。Windows 的有关 TPM 存储根密钥的注册表信息与 TPM存储^{(TPM Storage Root Key)}根密钥^{(Storage Root Key)}不匹配或丢失。

TPM 已准备好使用，但功能已减少

TPM已准备好使用，但功能已减少

如果您遇到TPM 功能减少的问题，您可以在新版本的^{(TPM reduced functionality )}MDT可用之前解决此问题以进行新部署- 将以下命令添加到ZTIBDE.wsf脚本的“ Function Main ”部分开头：

reg add hklm\system\currentcontrolset\services\tpm\wmi -v UseNullDerivedOwnerAuth -t REG_DWORD -d 0x01 -f

值得注意的是，TPM已处于缩减功能模式的设备，必须先清除 TPM^{(TPM must be cleared)} ，然后才能缓解此问题。

为防止发生此问题，您无需预先设置BitLocker，而是等待启用整个系统。请注意，使用此方法完成部署需要更长的时间。

根据 Microsoft 的说法，由于ZTIBDE.wsf脚本中的^(ZTIBDE.wsf)TpmValidate 函数不必要地从Windows PE获取了^{(Windows PE)}TPM的所有权，因此会出现TPM 减少功能^{(TPM reduced functionality )}问题。Windows 应该能够在全新体验 (OOBE)^{(Out-of-Box Experience (OOBE))}之前正确获取TPM的所有权，以便使用正确的参数对其进行预配。

当Windows PE^{(Windows PE)}的TPM所有权发生这种变化时，TPM将获得Windows无法理解的参数。因此， TPM^(TPM)中的密钥层次结构被禁用，并且对Windows永久不可用。

The TPM is ready for use, with reduced functionality

If after a successful deployment of Windows 10 and you notiсe that the Trusted Platform Modυle (TPM) is in reduced functionality mode, then this post is intended to help you. In this post, we wіll identify some potential known causes for this behаνiоr and then provide the workaround for this issue as well аѕ the measure you can take to prevent the issue from occurring during the deploуmеnt of Windows 10.

You might encounter this issue based on the following scenario.

You use Microsoft Deployment Toolkit (This can be any version of MDT that supports Windows 10) to deploy Windows 10 by using the “Enable BitLocker (offline)” step (ZTIBDE.wsf script) to pre-provision BitLocker during Windows PE in the “Preinstall” group and the deployment is successful.

However, in this scenario, you notice that the Trusted Platform Module (TPM) is in reduced functionality mode. In this situation, the TPM Management console (TPM.msc) reports the following issue:

The TPM is ready for use, with reduced functionality. Information Flags: 0x900
The TPM owner authorization is not properly stored in the registry.
Windows’s registry information about the TPM’s Storage Root Key does not match the TPM Storage Root Key or is missing.

The TPM is ready for use, with reduced functionality

If you’re faced with the TPM reduced functionality issue, you can work around this issue for new deployments until a new version of MDT is available – add the command below to the ZTIBDE.wsf script at the start of the “Function Main” section:

reg add hklm\system\currentcontrolset\services\tpm\wmi -v UseNullDerivedOwnerAuth -t REG_DWORD -d 0x01 -f

It is worth noting that devices in which the TPM is already in reduced functionality mode, the TPM must be cleared before you can mitigate this issue.

To prevent this issue from occurring, you’ll need to not pre-provision BitLocker, instead wait to enable the full system. Be aware that the deployment will take longer to complete by using this method.

According to Microsoft, the TPM reduced functionality issue occurs because the TpmValidate function in the ZTIBDE.wsf script takes ownership of the TPM from Windows PE unnecessarily. Windows should be able to correctly take ownership of the TPM before Out-of-Box Experience (OOBE) to provision it by using the correct parameters.

When this change in ownership of the TPM from Windows PE occurs, the TPM is given parameters that Windows does not understand. Therefore, the key hierarchies in the TPM are disabled and made permanently unavailable to Windows.

鑫赵

About the author

我是一名软件工程师，拥有 Xbox Explorer、Microsoft Excel 和 Windows 8.1 Explorer 方面的经验。业余时间，我喜欢玩电子游戏和看电视。我拥有犹他大学的学位，目前在一家国际公司担任软件工程师。

TPM 已准备好使用，但功能已减少

TPM已准备好使用，但功能已减少

The TPM is ready for use, with reduced functionality