Category: Microsoft

Status 

The first step of troubleshooting Trusted Platform Module (TPM) errors is to review the status of the security processor.  

Windows 10  

• Go to Settings -> Update & Security -> Device Security -> Security Processor Details 
• Or Type “TPM” in the search box and select Security Processor Details 
• Or run Get-TPM in an administrator PowerShell console.  

Any detected issue should cause a message to a appear in the Status section. Refer to Security Processor troubleshooting (microsoft.com) for details and instructions to resolve each error message.  

Older Windows Versions 

• Go to Run, type MMC and press enter. 
• Select File -> Add Remove Snap-in 
• Choose TPM Management and click Add. Select Local Computer 

Any detected issues should be listed in the Status row. Refer to Security Processor troubleshooting (microsoft.com) for details and instructions to resolve each error message. 

Event Logs 

TPM errors are recorded in the System Event Logs on Windows computers. Search the event logs for TPM errors with PowerShell: 

Get-WinEvent -FilterHashtable @{LogName=’System’} | Where-Object -Property Message -Match ‘TPM’ | fl 

Remediation 

No one solution will correct all TPM issues, but here are some of the most common and effective fixes listed in the order you should attempt them.  

Updates 

Many times, TPM errors can be corrected by applying updates to the operating system and system BIOS.  

The operating system should be updated with the Windows Update mechanism. Windows updates should be applied before any TPM or BIOS updates from the manufacturer.  

The procedure for updating the System BIOS is different across systems, but in general the manufactures update utility should be used. 

UEFI Discrepancy 

TPM 2.0 (check status) requires the system BIOS to be in a Native UEFI mode only. Disable any legacy functions, modes, or settings.  

Clear TPM 

TPM security processors include their own sealed storage. Occasionally that storage becomes corrupted. Clearing the TPM storage is done with the Security Process Details page or, the TPM MMC (see Status section). It can also be done via PowerShell (Clear-TPM in an admin console). 

• You should backup a system before clearing the TPM. Data loss is possible in certain situations. 
• Windows Hello will not function after clearing TPM storage and needs to be reconfigured. 

Reset Power 

Often a full power loss will restore TPM functionality to systems that cannot detect their TPM security processor. TPM is missing or not detected status messages from either the BIOS or Windows Status warrant the following procedure. It is important to remove all power and fully drain any capacitors or other power supply available to the TPM chip, a reboot or shutdown is not sufficient.  

• Shutdown the system 

• Unplug the Power Cable or Power Supply 
• Remove any batteries from laptops. 
• Disconnect any UPS or USB power.  
• Hold down the Power button for a minimum of 30 seconds. 
• Re-connect power cords, power supplies, UPS, or USB power. 
• Power on the system and check the TPM status.   

Further Documentation 

• Microsoft’s TPM Documentation Trusted Platform Module (Windows 10) – Microsoft 365 Security | Microsoft Docs 

If you are unable to resolve TPM issues after completing these steps you should contact your system’s or motherboard manufacturer’s technical support. There is likely a hardware issue that may require replacement. It is possible to disable the TPM function in your system BIOS. Be sure to decrypt disks and turn off features that require it (Windows Hello) first.

Microsoft’s 365 enrollment has three states: Enabled, Enforced, and Disabled. Enabled means that a user has, or will be prompted to enroll for multi-factor authentication. However, if they do not complete the enrollment and you do not have any type of enforcement policy, the account will continue to be authenticated without MFA. Once a person has completed the enrollment their account’s status is changed to Enforced. MFA is required from that point forward. An administrator can manually set an account to Enforced, but that account may not be able to logon and complete the enrollment on their own.

Enable per-user Multi-Factor Authentication – Azure Active Directory | Microsoft Docs

The multi-factor authentication page in Microsoft 365 admin portal will list all the users and show their states, but organizations with lots of users, SharePoint or Teams external accounts, and the like may have a difficult time displaying the data they need. The script below will list all licensed Microsoft 365 users that do not have an MFA state of “Enforced”.

$UserCredential = Get-Credential
    Connect-MsolService -Credential $UserCredential

Get-MsolUser -all | Where {$_.islicensed -like "True"} | 
    Select DisplayName,UserPrincipalName,@{Name='MFAStatus'; 
        Expression= {If($_.StrongAuthenticationRequirements.Count -ne 0)
        {$_.StrongAuthenticationRequirements[0].State} 
            Else {'Disabled'}
        }
    } | Where {$_.MFASTATUS -ne 'enforced'}

By removing the last filter you get a list of all licensed users and their MFA Status. You could easily out put the results to a file or HTML report.

$UserCredential = Get-Credential
    Connect-MsolService -Credential $UserCredential

Get-MsolUser -all | Where {$_.islicensed -like "True"} | 
    Select DisplayName,UserPrincipalName,@{Name='MFAStatus'; 
        Expression= {If($_.StrongAuthenticationRequirements.Count -ne 0)
        {$_.StrongAuthenticationRequirements[0].State} 
            Else {'Disabled'}
        }
    }

If there’s one thing Outlook really likes to do, it is to make sure that you are notified. Sometimes it can be a little overbearing, especially if you are a member of very many shared mailboxes, a room delegate, or have full access to another individual’s mailbox. You will get all of those notifications too.

Often the solution is to reduce the number of Exchange objects that a person has access to, but how do you find out what those are? The easiest way is to use PowerShell. The little script below will prompt you for your Global or Exchange administrator credentials for Microsoft 365. Then it will prompt you for the email address of the user account you are working with. It will use those pieces of information to connect to Exchange online and generate a list of all the objects that person has full access to. Note: this does not include share permissions assigned by a user in Outlook.

$UserCredential = Get-Credential
$ExchangeOnline = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
        Import-PSSession $ExchangeOnline
$useraddress = Read-Host "Enter the User's Email address"
Get-Mailbox -ResultSize:Unlimited | Get-MailboxPermission |Select-Object Identity,User,AccessRights | Where-Object {​​​​​​​($_.user -like $useraddress)}​​​​​​​
pause

Once you have the list of Exchange objects you’ll want to investigate each and decide if the user really needs the level of access they have. Full access or delegation results in notifications. If the number of objects can not be reduced to a satisfactory level, there is another strategy available in Outlook itself. You will need to disable the general alerts function and then create alert rules for the specific objects that matter.

In Outlook, go to File -> Options -> Mail and then uncheck the box for “Display a Desktop Alert”. This will do what you think, disable all Outlook notification pop-ups.

Now we’ll need to build rules for the alerts that we still want to see. Use the chevron at the far right of the Outlook ribbon to expand it. Then click the drop down for rules. Click “Manage Rules and Alerts”.

In the rules wizard select “Apply a Rule on Messages I receive” then click the Next button. Now select the most appropriate condition, often I use “through the specified account”, click on the word specified and pick the account you are creating a rule for. You may find another option more useful. From people or group is a good one too. You can actually select as many conditions as you like for the rule.

On the next screen scroll down and check the box for “display a desktop alert”. Then click Next, you probably don’t need any exceptions. When you click Finish your rule is done. You can use a series of rules like this to customize all the notifications that Outlook displays.

Over time you can end up sharing lots of files with people via OneDrive. It is easy to forget who has access. Microsoft has included a report utility in OneDrive Online that will export a list of all the shared files and who has access to them.

• Find the OneDrive icon in your system tray (next to clock) right click on the icon and then select View Online from the menu. 

• OneDrive will launch in your default web browser.  

• In the OneDrive Title Bar click the settings icon (gear on the left) 

• Click OneDrive Settings in the menu.  

• Click More Settings in the menu on the left.  

• Click Run Sharing Report in the menu on the right. 

• Choose or create a folder to save the report in. 

• The report will be in a CSV format that will open in Excel.  You will receive an email notification when the report is ready to view.