Understand TPM Initialization

A Trusted Platform Module (TPM) can be in one of the following states:

• Unowned and turned off
  
  
• Unowned and turned on
  
  
• Owned but turned off
  
  
• Owned and turned on
  
  

The TPM must be turned on and owned before it can be used to help secure your computer. The process of ensuring that the TPM is both turned on and owned is called initialization. During initialization, the TPM creates new root keys that are used by the TPM.

Computers manufactured to meet requirements specified for this version of Windows include preboot BIOS functionality that makes it easy to initialize a computer's TPM by using the TPM Initialization Wizard. Normally, initialization of the TPM requires physical access to the computer to turn on the TPM. This requirement helps protect against the threat of malicious software being able to initialize a TPM.

	Note
	In a business or enterprise environment, your network administrator may have initialized the TPM, or your organization may have arranged specific processes with your hardware manufacturer to support TPM initialization without user intervention.

If the TPM is not initialized, the TPM Initialization Wizard guides you through the steps required to turn on and take ownership of the TPM.

In order to be used by software such as BitLocker Drive Encryption, the TPM must be initialized. The BitLocker setup wizard starts the initialization process automatically while configuring BitLocker, if needed.

For more information on how to initialize the TPM, see Initialize the TPM.