SCCM OSD for Windows 8.1 - TPM Owner Password not found

Question

Hello,
I have been actively using these forums and the TechNet Guidance for the MBAM 2.5 client deployment, however I am still seeing some issues and looking for appropriate steps to troubleshoot.
I have a MDT Integrated Task Sequence to deploy Windows 8.1 to various machines. The Windows 8.1 Image has been created via a MDT 2013 Build & Capture Task Sequence on a VM and then imported into SCCM 2012 R2. In the MDT Image creation I am disabling
TPM Auto Provisioning by adding the Registry Key as per link below.
http://msdn.microsoft.com/en-us/library/windows/hardware/dn260276.aspx
The MDT Task Sequence has had the built-in Pre-Provision Bitlocker and Enable Bitlocker Steps disabled. I have included a step that runs the Clear-TPM powershell command before the Setup Windows and ConfigMgr and I have to confirm the TPM clearance at the
first reboot.
To begin the MBAM encryption I have scripts as supplied from the blog, firstly prepares the drive, reboots, installs MBAM 2.0 SP1, then encrypts.
http://blogs.technet.com/b/deploymentguys/archive/2012/02/20/using-mbam-to-start-bitlocker-encryption-in-a-task-sequence.aspx
The machine encrypts every time and the Recovery Key is escrowed, however I have not been able to get the TPM Owner Password
Any troubleshooting steps for the TPM Owner Password would be greatly appreciated
Regards
LeeB
Lee Bowman MCITP MCTS

Answer 1

Hello, Hope this helps get you a bit further. And would love any updates for suggestions to more logging etc
Image
Use MDT to generate Image and apply the following registry keys. Must be done in Image via MDT or DISM
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tpm\WMI: NoAutoProvision      dword:1
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tpm\WMI: NoDisableOwnerClear    dword:1
Task Sequence Steps
Set TS Variables
IsBDE - True
OSDBitlockerMode - TPM
Pre-provision Bitlocker (Standard TS Step)
Clear TPM - Create Powershell Script and use "Run Powershell Script" with Bypass.
            $tpm=get-wmiobject -class Win32_Tpm -namespace root\cimv2\security\microsofttpm
            $tpm. SetPhysicalPresenceRequest(22)
Check TPM Endorsement Key Pair Status
http://myitforum.com/myitforumwp/2011/11/14/bitlockermbamendorsement-keys-and-tpm-ownership/
Install MBAM 2.0 SP1 Agent - Standard MSI Install
Start MBAM Encryption
cscript.exe Win8StartMBAMEncryption.wsf /MBAMServiceEndPoint:https://*****************
Many versions of this script, but I used this one.
http://blog.coretech.dk/hra/deploying-windows-8-with-mbam-used-space-only-encryption/
Follow the Steps from LanceCr to comment out the TPM Owner Password.
https://social.technet.microsoft.com/Forums/en-US/95e1a7af-d273-44e1-92de-fd9915cc0e50/tpm-password-not-found-in-mbam-database?forum=mdopmbamGood
Luck :)
Lee Bowman MCITP MCTS