Windows Hello for Business mitigation plan for vulnerability in TPM

1. Make sure that a valid local admin account exists on the device or create a local admin account.

   Note: It is a recommended practice to verify that the account is working by signing in to the device by using the new local admin account and confirm correct permissions by opening an elevated command prompt.

    

2. If you have signed in with a Microsoft account on the device, go to Settings > Accounts > Email & app accounts and remove the connected account.
   

3. Install a firmware update for the device.

   Note: Follow your OEM’s guidance for applying the TPM firmware update. See step 4: "Apply applicable firmware updates," in Microsoft Security Advisory ADV170012 for information about how to obtain the TPM update from your OEM.

    

4. Unjoin the device from Azure AD.

   Note: Make sure that your BitLocker key is securely backed up somewhere other than the local computer before you continue.

   1. Go to Settings > System > About, and then click Manage or disconnect from work or school.

   2. Click Connected to <AzureAD>and click Disconnect.

   3. Click Yes when you are prompted for acknowledgment.

   4. Click Disconnect when you are prompted to "Disconnect from the organization."
      

   5. Enter the local admin account information for the device.

   6. Click Restart Later.
      

5. Clear the TPM.

   Notes: 

   • Clearing the TPM will remove all keys and secrets that are stored on your device. Make sure that other services that are utilizing the TPM are suspended or validated prior to proceeding.

   • 
     Windows 8 or later: BitLocker is automatically suspended if you use either of the two recommended methods for clearing your TPM, below.

   • Windows 7: Manual suspension of BitLocker is needed before proceeding. (See more information about suspending BitLocker.)
      

   1. To clear the TPM, use one of the following methods:

      • Use the Microsoft Management Console.
        

        1. Press Win + R, type tpm.msc and click OK.

        2. Click Clear TPM.
           

      • Run the Clear-Tpm cmdlet.

   2. Click Restart.
      
      
      
      Note You may be prompted to clear the TPM at startup.

6. After the device restarts, sign in to the device by using the local admin account.

7. Rejoin the device to Azure AD. You may be prompted to set up a new PIN at the next sign-in.

1. If you signed in by using a Microsoft account on your device, go to Settings > Accounts > Email & app accounts and remove the connected account.
   

2. From an elevated command prompt, run the following command:
   
   dsregcmd.exe /leave /debug
   

   Note: Command output should indicate AzureADJoined: No.

    

3. Install a firmware update for the device.

   Note:  Note Follow your OEM’s guidance for applying the TPM firmware update. See step 4: "Apply applicable firmware updates," in Microsoft Security Advisory ADV170012 for information about how to obtain the TPM update from your OEM.

4. Clear the TPM.

   Notes: 

   • Clearing the TPM will remove all keys and secrets that are stored on your device. Make sure that other services that are utilizing the TPM are suspended or validated prior to proceeding.

   • 
     Windows 8 or later: BitLocker is automatically suspended if you use either of the two recommended methods for clearing your TPM, below.

   • Windows 7: Manual suspension of BitLocker is needed before proceeding. (See more information about suspending BitLocker.)

    

   1. To clear the TPM, use one of the following methods:

      • Use the Microsoft Management Console.
        

        1. Press Win + R, type tpm.msc and click OK.

        2. Click Clear TPM.
           

      • Run the Clear-Tpm cmdlet.

   2. Click Restart.
      Note You may be prompted to clear the TPM at startup.
      

When the device starts, Windows generates new keys and automatically rejoins the device to Azure AD. During this time, you may continue to use the device. However, access to resources such as Microsoft Outlook, OneDrive, and other applications that require SSO or Conditional Access policies may be limited.

Note If you use a Microsoft account, you must know the password.

1. Install a firmware update for the device.

   Note: Follow your OEM’s guidance for applying the TPM firmware update. See step 4: "Apply applicable firmware updates," in Microsoft Security Advisory ADV170012 for information about how to obtain the TPM update from your OEM.

    

2. Remove the Azure AD work account.
   

   1. Go to Settings > Accounts > Access work or school, click your work or school account, and then click Disconnect.

   2. Click Yes in the prompt to confirm the disconnection.

3. Clear the TPM.

   Notes: 

   • Clearing the TPM will remove all keys and secrets that are stored on your device. Make sure that other services that are utilizing the TPM are suspended or validated prior to proceeding.

   • 
     Windows 8 or later: BitLocker is automatically suspended if you use either of the two recommended methods for clearing your TPM, below.

   • Windows 7: Manual suspension of BitLocker is needed before proceeding. (See more information about suspending BitLocker.)

    

   1. To clear the TPM, use one of the following methods:

      • Use the Microsoft Management Console.
        

        1. Press Win + R, type tpm.msc and click OK.

        2. Click Clear TPM.

      • Run the Clear-Tpm cmdlet.

   2. Click Restart.
      
      
      Note You may be prompted to clear your TPM at startup.

   3. If you used a Microsoft account that has a PIN, you have to sign in to the device by using the password.

   4. Add the work account back to the device.
      

      1. Go to Settings > Accounts > Access work or school and click Connect.
         

      2. Enter your work account, and then click Next.
         

      3. Enter your work account and password, and then click Sign in.

      4. If your organization has configured Azure Multi-Factor Authentication for joining devices to Azure AD, provide the second factor before you continue.

      5. Validate that the information displayed is correct, and then click Join. You should see the following message:
         
         You’re all set! We’ve added your account successfully You now have access to your organizations apps and services.