Gecko [ edgpens.lpkmn.gov.my ]

Name	Size	Permission
.mad-root	0 B	-rw-rw-rw-
AVSValidationGP.adml	1.84 KB	-rw-rw-rw-
ActiveXInstallService.adml	5.47 KB	-rw-rw-rw-
AddRemovePrograms.adml	10.48 KB	-rw-rw-rw-
AllowBuildPreview.adml	1.28 KB	-rw-rw-rw-
AppCompat.adml	9.88 KB	-rw-rw-rw-
AppPrivacy.adml	30.53 KB	-rw-rw-rw-
AppXRuntime.adml	5.06 KB	-rw-rw-rw-
AppxPackageManager.adml	4.97 KB	-rw-rw-rw-
AttachmentManager.adml	9.61 KB	-rw-rw-rw-
AuditSettings.adml	1.8 KB	-rw-rw-rw-
AutoPlay.adml	4.77 KB	-rw-rw-rw-
Biometrics.adml	4.75 KB	-rw-rw-rw-
Bits.adml	31.41 KB	-rw-rw-rw-
CEIPEnable.adml	1.9 KB	-rw-rw-rw-
COM.adml	1.63 KB	-rw-rw-rw-
Camera.adml	1.59 KB	-rw-rw-rw-
CipherSuiteOrder.adml	3.4 KB	-rw-rw-rw-
CloudContent.adml	4.83 KB	-rw-rw-rw-
Conf.adml	10.72 KB	-rw-rw-rw-
ControlPanel.adml	8.03 KB	-rw-rw-rw-
ControlPanelDisplay.adml	20.98 KB	-rw-rw-rw-
Cpls.adml	1.55 KB	-rw-rw-rw-
CredSsp.adml	20.62 KB	-rw-rw-rw-
CredUI.adml	3.05 KB	-rw-rw-rw-
CredentialProviders.adml	7.28 KB	-rw-rw-rw-
CtrlAltDel.adml	3.41 KB	-rw-rw-rw-
DCOM.adml	4.95 KB	-rw-rw-rw-
DFS.adml	1.51 KB	-rw-rw-rw-
DWM.adml	4.71 KB	-rw-rw-rw-
DataCollection.adml	4.87 KB	-rw-rw-rw-
Desktop.adml	22.12 KB	-rw-rw-rw-
DeviceCompat.adml	1012 B	-rw-rw-rw-
DeviceCredential.adml	1.36 KB	-rw-rw-rw-
DeviceGuard.adml	5.14 KB	-rw-rw-rw-
DeviceInstallation.adml	20.04 KB	-rw-rw-rw-
DeviceRedirection.adml	2.83 KB	-rw-rw-rw-
DeviceSetup.adml	8.52 KB	-rw-rw-rw-
DigitalLocker.adml	1.16 KB	-rw-rw-rw-
DiskDiagnostic.adml	3.92 KB	-rw-rw-rw-
DiskNVCache.adml	4.15 KB	-rw-rw-rw-
DiskQuota.adml	9.09 KB	-rw-rw-rw-
DistributedLinkTracking.adml	1.19 KB	-rw-rw-rw-
DnsClient.adml	30.61 KB	-rw-rw-rw-
EAIME.adml	8.47 KB	-rw-rw-rw-
EarlyLaunchAM.adml	2.48 KB	-rw-rw-rw-
EdgeUI.adml	4.73 KB	-rw-rw-rw-
EncryptFilesonMove.adml	1.23 KB	-rw-rw-rw-
EnhancedStorage.adml	5.64 KB	-rw-rw-rw-
ErrorReporting.adml	30.15 KB	-rw-rw-rw-
EventForwarding.adml	2.49 KB	-rw-rw-rw-
EventLog.adml	11.12 KB	-rw-rw-rw-
EventLogging.adml	2.49 KB	-rw-rw-rw-
EventViewer.adml	2.31 KB	-rw-rw-rw-
Explorer.adml	4.26 KB	-rw-rw-rw-
ExternalBoot.adml	2.74 KB	-rw-rw-rw-
FeedbackNotifications.adml	1.17 KB	-rw-rw-rw-
FileHistory.adml	988 B	-rw-rw-rw-
FileRecovery.adml	2.91 KB	-rw-rw-rw-
FileRevocation.adml	2.55 KB	-rw-rw-rw-
FileServerVSSProvider.adml	1.48 KB	-rw-rw-rw-
FileSys.adml	5.37 KB	-rw-rw-rw-
FolderRedirection.adml	7.76 KB	-rw-rw-rw-
FramePanes.adml	2.11 KB	-rw-rw-rw-
GameExplorer.adml	1.85 KB	-rw-rw-rw-
Globalization.adml	26.12 KB	-rw-rw-rw-
GroupPolicy-Server.adml	1.45 KB	-rw-rw-rw-
GroupPolicy.adml	64.39 KB	-rw-rw-rw-
GroupPolicyPreferences.adml	130.2 KB	-rw-rw-rw-
Help.adml	5.51 KB	-rw-rw-rw-
HelpAndSupport.adml	3.02 KB	-rw-rw-rw-
ICM.adml	18.91 KB	-rw-rw-rw-
IIS.adml	1.38 KB	-rw-rw-rw-
InetRes.adml	450.49 KB	-rw-rw-rw-
InkWatson.adml	1.39 KB	-rw-rw-rw-
KDC.adml	11.73 KB	-rw-rw-rw-
Kerberos.adml	20.13 KB	-rw-rw-rw-
LanmanServer.adml	8.68 KB	-rw-rw-rw-
LanmanWorkstation.adml	5.12 KB	-rw-rw-rw-
LeakDiagnostic.adml	1.55 KB	-rw-rw-rw-
LinkLayerTopologyDiscovery.adm...	3.56 KB	-rw-rw-rw-
LocationProviderAdm.adml	1.18 KB	-rw-rw-rw-
Logon.adml	15.75 KB	-rw-rw-rw-
MDM.adml	1.14 KB	-rw-rw-rw-
MMC.adml	4.69 KB	-rw-rw-rw-
MMCSnapIns2.adml	3.18 KB	-rw-rw-rw-
MMCSnapins.adml	9.92 KB	-rw-rw-rw-
MSDT.adml	4.71 KB	-rw-rw-rw-
MSI.adml	29.85 KB	-rw-rw-rw-
MobilePCMobilityCenter.adml	1.18 KB	-rw-rw-rw-
MobilePCPresentationSettings.a...	1.45 KB	-rw-rw-rw-
Msi-FileRecovery.adml	3.01 KB	-rw-rw-rw-
NCSI.adml	5.48 KB	-rw-rw-rw-
Netlogon.adml	46.17 KB	-rw-rw-rw-
NetworkConnections.adml	41.01 KB	-rw-rw-rw-
NetworkIsolation.adml	6.59 KB	-rw-rw-rw-
NetworkProvider.adml	2.58 KB	-rw-rw-rw-
OfflineFiles.adml	49.72 KB	-rw-rw-rw-
P2P-pnrp.adml	15.59 KB	-rw-rw-rw-
Passport.adml	10.03 KB	-rw-rw-rw-
PeerToPeerCaching.adml	24.06 KB	-rw-rw-rw-
PenTraining.adml	1.18 KB	-rw-rw-rw-
PerformanceDiagnostics.adml	7.99 KB	-rw-rw-rw-
PerformancePerftrack.adml	1.18 KB	-rw-rw-rw-
Power.adml	30.64 KB	-rw-rw-rw-
PowerShellExecutionPolicy.adml	8.4 KB	-rw-rw-rw-
PreviousVersions.adml	5.18 KB	-rw-rw-rw-
Printing.adml	34.09 KB	-rw-rw-rw-
Printing2.adml	14.26 KB	-rw-rw-rw-
Programs.adml	6.86 KB	-rw-rw-rw-
QOS.adml	21.58 KB	-rw-rw-rw-
RPC.adml	13.4 KB	-rw-rw-rw-
RacWmiProv.adml	1.36 KB	-rw-rw-rw-
Radar.adml	2.65 KB	-rw-rw-rw-
ReAgent.adml	1.77 KB	-rw-rw-rw-
Reliability.adml	5.19 KB	-rw-rw-rw-
RemoteAssistance.adml	10.13 KB	-rw-rw-rw-
RemovableStorage.adml	13.32 KB	-rw-rw-rw-
Scripts.adml	12.24 KB	-rw-rw-rw-
Search.adml	36.07 KB	-rw-rw-rw-
Securitycenter.adml	2.41 KB	-rw-rw-rw-
Sensors.adml	2.01 KB	-rw-rw-rw-
ServerManager.adml	4.84 KB	-rw-rw-rw-
Servicing.adml	2.35 KB	-rw-rw-rw-
SettingSync.adml	9.51 KB	-rw-rw-rw-
Setup.adml	2.01 KB	-rw-rw-rw-
ShapeCollector.adml	1.64 KB	-rw-rw-rw-
SharedFolders.adml	1.81 KB	-rw-rw-rw-
Sharing.adml	2.41 KB	-rw-rw-rw-
Shell-CommandPrompt-RegEditToo...	5.12 KB	-rw-rw-rw-
ShellWelcomeCenter.adml	1.01 KB	-rw-rw-rw-
Sidebar.adml	2.13 KB	-rw-rw-rw-
SkyDrive.adml	3.83 KB	-rw-rw-rw-
Smartcard.adml	13.57 KB	-rw-rw-rw-
Snmp.adml	4.92 KB	-rw-rw-rw-
SoundRec.adml	1.13 KB	-rw-rw-rw-
StartMenu.adml	53.79 KB	-rw-rw-rw-
SystemRestore.adml	2.58 KB	-rw-rw-rw-
TPM.adml	18.92 KB	-rw-rw-rw-
TabletPCInputPanel.adml	14.61 KB	-rw-rw-rw-
TabletShell.adml	6.52 KB	-rw-rw-rw-
TaskScheduler.adml	6.87 KB	-rw-rw-rw-
Taskbar.adml	12.69 KB	-rw-rw-rw-
TerminalServer-Server.adml	18.12 KB	-rw-rw-rw-
TerminalServer.adml	129.66 KB	-rw-rw-rw-
Thumbnails.adml	2.44 KB	-rw-rw-rw-
TouchInput.adml	2.01 KB	-rw-rw-rw-
UserExperienceVirtualization.a...	110.67 KB	-rw-rw-rw-
UserProfiles.adml	42.87 KB	-rw-rw-rw-
VolumeEncryption.adml	100.16 KB	-rw-rw-rw-
W32Time.adml	16.42 KB	-rw-rw-rw-
WCM.adml	5.59 KB	-rw-rw-rw-
WDI.adml	3.58 KB	-rw-rw-rw-
WPN.adml	7.83 KB	-rw-rw-rw-
WinCal.adml	1.06 KB	-rw-rw-rw-
WinInit.adml	2.42 KB	-rw-rw-rw-
WinLogon.adml	8.77 KB	-rw-rw-rw-
WinMaps.adml	1.78 KB	-rw-rw-rw-
Windows.adml	9.2 KB	-rw-rw-rw-
WindowsAnytimeUpgrade.adml	1.03 KB	-rw-rw-rw-
WindowsBackup.adml	3.4 KB	-rw-rw-rw-
WindowsColorSystem.adml	1.39 KB	-rw-rw-rw-
WindowsConnectNow.adml	3.33 KB	-rw-rw-rw-
WindowsDefender.adml	75.79 KB	-rw-rw-rw-
WindowsExplorer.adml	56.6 KB	-rw-rw-rw-
WindowsFileProtection.adml	4.16 KB	-rw-rw-rw-
WindowsFirewall.adml	42.14 KB	-rw-rw-rw-
WindowsInkWorkspace.adml	1.55 KB	-rw-rw-rw-
WindowsMail.adml	1.13 KB	-rw-rw-rw-
WindowsMediaDRM.adml	1.6 KB	-rw-rw-rw-
WindowsMediaPlayer.adml	21.55 KB	-rw-rw-rw-
WindowsMessenger.adml	2.55 KB	-rw-rw-rw-
WindowsProducts.adml	5.98 KB	-rw-rw-rw-
WindowsRemoteManagement.adml	14.21 KB	-rw-rw-rw-
WindowsRemoteShell.adml	5.37 KB	-rw-rw-rw-
WindowsServer.adml	1011 B	-rw-rw-rw-
WindowsStore.adml	3.5 KB	-rw-rw-rw-
WindowsUpdate.adml	43.45 KB	-rw-rw-rw-
Winsrv.adml	1.42 KB	-rw-rw-rw-
WirelessDisplay.adml	1.45 KB	-rw-rw-rw-
WordWheel.adml	2.56 KB	-rw-rw-rw-
WorkFolders-Client.adml	3.38 KB	-rw-rw-rw-
WorkplaceJoin.adml	1.2 KB	-rw-rw-rw-
appv.adml	25 KB	-rw-rw-rw-
fthsvc.adml	1.77 KB	-rw-rw-rw-
hotspotauth.adml	1.47 KB	-rw-rw-rw-
iSCSI.adml	5.1 KB	-rw-rw-rw-
msched.adml	3.37 KB	-rw-rw-rw-
nca.adml	8.28 KB	-rw-rw-rw-
pca.adml	6.09 KB	-rw-rw-rw-
sdiageng.adml	3.21 KB	-rw-rw-rw-
sdiagschd.adml	2.5 KB	-rw-rw-rw-
srm-fci.adml	7.49 KB	-rw-rw-rw-
tcpip.adml	13.15 KB	-rw-rw-rw-
wlansvc.adml	4.44 KB	-rw-rw-rw-
wwansvc.adml	2.9 KB	-rw-rw-rw-

Code Editor : TPM.adml

<?xml version="1.0" encoding="utf-8"?>

<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
  <displayName>enter display name here</displayName>
  <description>enter description here</description>
  <resources>
    <stringTable>
      <string id="ActiveDirectoryBackup_Help">This policy setting allows you to manage the Active Directory Domain Services (AD DS) backup of Trusted Platform Module (TPM) owner information.

TPM owner information includes a cryptographic hash of the TPM owner password. Certain TPM commands can only be run by the TPM owner. This hash authorizes the TPM to run these commands.

If you enable this policy setting, TPM owner information will be automatically and silently backed up to AD DS when you use Windows to set or change a TPM owner password.

By enabling this policy setting, a TPM owner password cannot be set or changed unless the computer is connected to the domain and the AD DS backup succeeds.

If you disable or do not configure this policy setting, TPM owner information will not be backed up to AD DS.

Note: You must first set up appropriate schema extensions and access control settings on the domain before AD DS backup can succeed. Consult online documentation for more information about setting up Active Directory Domain Services for TPM.

Note: The TPM cannot be used to provide enhanced security features for BitLocker Drive Encryption and other applications without first setting an owner. To take ownership of the TPM with an owner password, run "tpm.msc" and select the action to "Initialize TPM".

Note: If the TPM owner information is lost or is not available, limited TPM management is possible by running "tpm.msc" on the local computer.</string>
      <string id="ActiveDirectoryBackup_Name">Turn on TPM backup to Active Directory Domain Services</string>
      <string id="BlockedCommandsList_Help">This policy setting allows you to manage the Group Policy list of Trusted Platform Module (TPM) commands blocked by Windows.

If you enable this policy setting, Windows will block the specified commands from being sent to the TPM on the computer. TPM commands are referenced by a command number. For example, command number 129 is TPM_OwnerReadInternalPub, and command number 170 is TPM_FieldUpgrade. To find the command number associated with each TPM command, run "tpm.msc" and navigate to the "Command Management" section.

If you disable or do not configure this policy setting, only those TPM commands specified through the default or local lists may be blocked by Windows. The default list of blocked TPM commands is pre-configured by Windows. You can view the default list by running "tpm.msc", navigating to the "Command Management" section, and making visible the "On Default Block List" column. The local list of blocked TPM commands is configured outside of Group Policy by running "tpm.msc" or through scripting against the Win32_Tpm interface. See related policy settings to enforce or ignore the default and local lists of blocked TPM commands.</string>
      <string id="BlockedCommandsList_Name">Configure the list of blocked TPM commands</string>
      <string id="IgnoreDefaultList_Help">This policy setting allows you to enforce or ignore the computer's default list of blocked Trusted Platform Module (TPM) commands.

If you enable this policy setting, Windows will ignore the computer's default list of blocked TPM commands and will only block those TPM commands specified by Group Policy or the local list.

The default list of blocked TPM commands is pre-configured by Windows. You can view the default list by running "tpm.msc", navigating to the "Command Management" section, and making visible the "On Default Block List" column. The local list of blocked TPM commands is configured outside of Group Policy by running "tpm.msc" or through scripting against the Win32_Tpm interface. See the related policy setting to configure the Group Policy list of blocked TPM commands.

If you disable or do not configure this policy setting, Windows will block the TPM commands in the default list, in addition to commands in the Group Policy and local lists of blocked TPM commands. </string>
      <string id="IgnoreDefaultList_Name">Ignore the default list of blocked TPM commands</string>
      <string id="IgnoreLocalList_Help">This policy setting allows you to enforce or ignore the computer's local list of blocked Trusted Platform Module (TPM) commands.

If you enable this policy setting, Windows will ignore the computer's local list of blocked TPM commands and will only block those TPM commands specified by Group Policy or the default list.

The local list of blocked TPM commands is configured outside of Group Policy by running "tpm.msc" or through scripting against the Win32_Tpm interface. The default list of blocked TPM commands is pre-configured by Windows. See the related policy setting to configure the Group Policy list of blocked TPM commands.

If you disable or do not configure this policy setting, Windows will block the TPM commands found in the local list, in addition to commands in the Group Policy and default lists of blocked TPM commands.</string>
      <string id="IgnoreLocalList_Name">Ignore the local list of blocked TPM commands</string>
      <string id="TPMCategory">Trusted Platform Module Services</string>
      <string id="OSManagedAuth_Name">Configure the level of TPM owner authorization information available to the operating system</string>
      <string id="OSManagedAuth_Help">This policy setting configures how much of the TPM owner authorization information is stored in the registry of the  local computer. Depending on the amount of TPM owner authorization information stored locally, the operating  system and TPM-based applications can perform certain TPM  actions which require TPM owner authorization without  requiring the user to enter the TPM owner password.

You can choose to have the operating system store either the full TPM owner authorization value, the TPM administrative delegation blob plus the TPM user delegation  blob, or none.

If you enable this policy setting, Windows will store the  TPM owner authorization in the registry of the local  computer according to the operating system managed TPM  authentication setting you choose.

Choose the operating system managed TPM authentication setting of "Full" to store the full TPM owner authorization, the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting allows use of the TPM without  requiring remote or external storage of the TPM owner  authorization value. This setting is appropriate for  scenarios which do not depend on preventing reset of the  TPManti-hammering logic or changing the TPM owner authorization value. Some TPM-based applications may require this setting be changed before features which depend on the TPManti-hammering logic can be used.

Choose the operating system managed TPM authentication  setting of "Delegated" to store only  the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting is  appropriate for use with TPM-based applications that depend  on the TPM anti-hammering logic. External or remote storage of the full TPM owner authorization value, for example by  backing up the value to Active Directory Domain Services  (AD DS), is recommended when using this setting.

Choose the operating system managed TPM authentication setting of "None" for compatibility with  previous operating systems and applications or for use with scenarios that require TPM owner authorization not be stored locally.  Using this setting might cause issues with some TPM-based  applications.

If this policy setting is disabled or not configured and  the "Turn on TPM backup to Active Directory Domain  Services" policy setting is also disabled or not  configured, the default setting is to store the full TPM  authorization value in the local registry. If this policy  is disabled or not configured and the "Turn on TPM backup  to Active Directory Domain Services" group policy setting  is enabled, then only the administrative delegation and the  user delegation blobs are stored in the local registry.

Note: If the operating system managed TPM authentication  setting is changed from "Full" to  "Delegated" the full TPM owner authorization  value will be regenerated and any copies of the original TPM owner authorization value will be invalid. If you are  backing up the TPM owner authorization value to AD DS, the new owner authorization value will be automatically backed  up to AD DS when it is changed.
</string>
      <string id="OSManagedAuth-TpmAuthFull">Full</string>
      <string id="OSManagedAuth-TpmAuthAdminPlusUser">Delegated</string>
      <string id="OSManagedAuth-TpmAuthNone">None</string>
      <string id="StandardUserAuthorizationFailureDuration_Name">Standard User Lockout Duration</string>
      <string id="StandardUserAuthorizationFailureDuration_Name_Help">This policy setting allows you to manage the duration in minutes for counting standard user authorization failures for Trusted Platform Module (TPM) commands requiring authorization.  If the number of TPM commands with an authorization failure within the duration equals a threshold, a standard user is prevented from sending commands requiring authorization to the TPM.

This setting helps administrators prevent the TPM hardware from entering a lockout mode because it slows the speed standard users can send commands requiring authorization to the TPM.

An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred.  Authorization failures older than this duration are ignored.

For each standard user two thresholds apply.  Exceeding either threshold will prevent the standard user from sending a command to the TPM that requires authorization.

The Standard User Lockout Threshold Individual value is the maximum number of authorization failures each standard user may have before the user is not allowed to send commands requiring authorization to the TPM.

The Standard User Lockout Total Threshold value is the maximum total number of authorization failures all standard users may have before all standard users are not allowed to send commands requiring authorization to the TPM. 
      
The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value.   When the TPM enters a lockout mode it is global for all users including administrators and Windows features like BitLocker Drive Encryption.  The number of authorization failures a TPM allows and how long it stays locked out vary by TPM manufacturer.  Some TPMs may enter lockout mode for successively longer periods of time with fewer authorization failures depending on past failures.  Some TPMs may require a system restart to exit the lockout mode.    Other TPMs may require the system to be on so enough clock cycles elapse before the TPM exits the lockout mode.

An administrator with the TPM owner password may fully reset the TPM's hardware lockout logic using the TPM Management Console (tpm.msc).  Each time an administrator resets the TPM's hardware lockout logic all prior standard user TPM authorization failures are ignored; allowing standard users to use the TPM normally again immediately.

If this value is not configured, a default value of 480 minutes (8 hours) is used.  
      </string>
      <string id="StandardUserAuthorizationFailureIndividualThreshold_Name">Standard User Individual Lockout Threshold</string>
      <string id="StandardUserAuthorizationFailureIndividualThreshold_Name_Help">This policy setting allows you to manage the maximum number of authorization failures for each standard user for the Trusted Platform Module (TPM).  If the number of authorization failures for the user within the duration for Standard User Lockout Duration equals this value, the standard user is prevented from sending commands to the Trusted Platform Module (TPM) that require authorization.

This setting helps administrators prevent the TPM hardware from entering a lockout mode because it slows the speed standard users can send commands requiring authorization to the TPM.

For each standard user two thresholds apply.  Exceeding either threshold will prevent the standard user from sending a command to the TPM that requires authorization.

This value is the maximum number of authorization failures each standard user may have before the user is not allowed to send commands requiring authorization to the TPM.

If this value is not configured, a default value of 4 is used.

A value of zero means the OS will not allow standard users to send commands to the TPM which may cause an authorization failure.
      </string>

<string id="StandardUserAuthorizationFailureTotalThreshold_Name">Standard User Total Lockout Threshold</string>
      <string id="StandardUserAuthorizationFailureTotalThreshold_Name_Help">This policy setting allows you to manage the maximum number of authorization failures for all standard users for the Trusted Platform Module (TPM).  If the total number of authorization failures for all standard users within the duration for Standard User Lockout Duration equals this value, all standard users are prevented from sending commands to the Trusted Platform Module (TPM) that require authorization.

This setting helps administrators prevent the TPM hardware from entering a lockout mode because it slows the speed standard users can send commands requiring authorization to the TPM.

For each standard user two thresholds apply.  Exceeding either threshold will prevent the standard user from sending a command to the TPM that requires authorization.

The Standard User Individual Lockout value is the maximum number of authorization failures each standard user may have before the user is not allowed to send commands requiring authorization to the TPM.

This value is the maximum total number of authorization failures all standard users may have before all standard users are not allowed to send commands requiring authorization to the TPM. 
      
The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value.   When the TPM enters a lockout mode it is global for all users including administrators and Windows features like BitLocker Drive Encryption.  The number of authorization failures a TPM allows and how long it stays locked out vary by TPM manufacturer.  Some TPMs may enter lockout mode for successively longer periods of time with fewer authorization failures depending on past failures.  Some TPMs may require a system restart to exit the lockout mode.    Other TPMs may require the system to be on so enough clock cycles elapse before the TPM exits the lockout mode.

If this value is not configured, a default value of 9 is used.

A value of zero means the OS will not allow standard users to send commands to the TPM which may cause an authorization failure.

</string>

</stringTable>
    <presentationTable>
      <presentation id="BlockedCommandsList_Name">
        <text>Specify the commands to block by adding their numbers to the list.</text>
        <listBox refId="BlockedCommandsList_Ordinals2">The list of blocked TPM commands:</listBox>
        <text>For example, to block the commands TPM_OwnerReadInternalPub</text>
        <text>and TPM_FieldUpgrade, add items 129 and 170 to the list.</text>
      </presentation>
      <presentation id="OSManagedAuth_Name">
        <dropdownList refId="SelectOSManagedAuthLevel" noSort="true" defaultItem="1">Operating system managed TPM authentication level:</dropdownList>
      </presentation>
      <presentation id="StandardUserAuthorizationFailureDuration_Name">
        <decimalTextBox refId="DXT_StandardUserAuthorizationFailureDuration_Name" defaultValue="480">Duration for counting TPM authorization failures (minutes):</decimalTextBox>        
      </presentation>
      <presentation id="StandardUserAuthorizationFailureIndividualThreshold_Name">
        <decimalTextBox refId="DXT_StandardUserAuthorizationFailureIndividualThreshold_Name" defaultValue="4">Maximum number of authorization failures per duration:</decimalTextBox>
      </presentation>
      <presentation id="StandardUserAuthorizationFailureTotalThreshold_Name">
        <decimalTextBox refId="DXT_StandardUserAuthorizationFailureTotalThreshold_Name" defaultValue="9">Maximum number of authorization failures per duration:</decimalTextBox>
      </presentation>
    </presentationTable>
  </resources>
</policyDefinitionResources>

${this.title}

Code Editor : TPM.adml