Protect Table Attestation For Free

TPM Key attestation support Windows implements various cryptographic providers that can be either software or hardware based. The two most important ones are: Microsoft Software Key Storage Provider: Standard provider, which stores keys software based and supports CNG (Crypto-Next Generation)

Using these two TPM capabilities, one can build powerful solutions to measure and validate a given system's software state. The measuring process is called Measured Boot, and the method of getting the measurements verified and attested through a third party is called 'Remote Attestation.

Press [Windows Key] + R or select Start > Run. Type ?tpm.msc? (do not use quotation marks) and choose OK. If you see a message saying a ?Compatible TPM cannot be found,? your PC may have a TPM that is disabled.

NOTE: To ensure TPM is turned on, you must press F2 to enter System Setup. Then go to the Security section and check that TPM is set to On under the TPM security settings. If TPM is restored, continue with normal system operation.

Secure Boot is a specific UEFI technology from Microsoft, whereas attestation is a general technique done by extending PCRs in TPM hardware to verify the state of firmware, bootloader, etc.

Verification of TPM device for attestation Use the Windows PowerShell cmdlet, Confirm-CAEndorsementKeyInfo, to verify that a specific TPM device is trusted for attestation by CAs. There are two options: one for verifying the EKCert, and the other for verifying an EKPub.

TPM-based attestation is a process to detect gateway tampering for file systems.

In the Configuration Manager console, choose Administration > Overview > Client Settings. Select the tab for Computer Agent settings. Scroll down to Enable communication with Health Attestation Service, and set to Yes. Select the Use on-premises Health Attestation Service option, and set to Yes.