Where can I find the mapping of Microsoft TPM 2.0 commands name to it's command number ?

Venkatesh Gopal 1 Reputation point
2022-11-25T15:17:37.247+00:00

Reposting my question from https://answers.microsoft.com/en-us/windows/forum/all/where-can-i-find-the-mapping-of-microsoft-tpm-20/d4e95d3c-8620-4c7f-9ed1-8b9718769776.

1) What's the right way to allow/block specific TPM 2.0 commands on Windows 10 and Windows 11 ?
2) Where can I find the mapping between a TPM 2.0 Command Name to a Command Number ?

If anyone wasn't able to access the above link, here's my original post

Hello Community, I'm trying to see how to go about allow-listing or blocking specific TPM commands on a machine.

I came across https://learn.microsoft.com/en-us/windows/security/information-protection/tpm/manage-tpm-commands which specifies 3 ways to do this - via group policy list, default list and ignore list. In each of these lists, the logic seems to be to specify the number of the TPM command that needs to be blocked. However, I don't see where I should go about finding that mapping.

264238-image.png

For eg) this section from the group policy editor suggests that I should be trying to find this mapping in tpm.msc's "Command Management" Section. However, I don't see such a section when I open it. I have a TPM 2.0 , so not sure if it only applies to 1.2 based on the above comment.

Looking at some further guidance for TPM2.0 Command blocking, I found this doc (https://learn.microsoft.com/en-us/windows/win32/tbs/command-blocking) which leads to manipulating these registry settings. However, I'm unclear on where we could get info on what those numbers map to.
264275-image.png

Thus, my question is : If I want to allow/blocklist TPM 2.0 commands, what is the way to do so and how do I get the mapping ?

Windows for business | Windows Client for IT Pros | Devices and deployment | Configure application groups
Windows for business | Windows Client for IT Pros | User experience | Other
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.