Disabled: The Trusted Platform Module is not prepared to be enabled automatically.

Disabled: Using platform keys remotely is not allowed. For privacy issues, the access to these keys is restricted as discussed within the Trusted Computing Group (TCG). This way all keys which would allow an identification of your Security Platform are hidden for remote access. This policy requires that all involved computers are members of trusted domains. It is only relevant for operating systems that support domain membership.

Note that the Security Platform administration and operation is not restricted by this policy.

Enabled: Specify whether only local administrators, local and remote administrators, all local users or all users may read unprotected NV data.

Disabled: No user may read unprotected NV data.

This policy is only relevant for Security Platforms with a Trusted Platform Module 1.2.

Note that the Security Platform administration and operation is not restricted by this setting.

Enabled: Specify how many authentication attempts should be allowed for keys (e.g. used for Security Platform User authentication), owner, and for the access of sealed data (e.g. used by Windows BitLocker in combination with PIN), before dictionary attack defending measures are taken.

Disabled: The dictionary attack threshold cannot be configured. The default values are in effect.

This policy is only relevant for Security Platforms with an Infineon Trusted Platform Module 1.2. It needs to be set before Security Platform Initialization. Subsequent changes of this policy will only be effective after the next defense level reset.
If this policy is not configured, then the same settings can be set individually for each platform in stand-alone mode via Initialization Wizard (see Configure Dictionary Attack Defense Settings). In this case no defense level reset is needed for the settings to be effective.
Note that all Security Platform users share the number of allowed user authentication attempts. Consider this if there are multiple parallel users on a system (e.g. using Fast User Switching).

Details on dictionary attack

Enabled: The ability to cut, copy, paste and see secret data (e.g. passwords or secrets) in clear text is not available.

Disabled: The ability to paste is available. Additionally cut and copy operation is available when secret data (e.g. passwords or secrets) is visible in clear text.

Enabled: Security Platform keys are purged, before the computer enters one of the energy-saving states standby (S3) or hibernation (S4). Thus the security level during energy-saving state will be raised. After coming back from the energy-saving state, Security Platform Features will require a user authentication again.

Disabled: Security Platform keys are not purged.

Enabled: Enter an Enhanced Authentication provider class ID (CLSID), or multiple CLSIDs separated by semicolons.
Only the providers specified here will be accepted to utilize Enhanced Authentication on client systems which are not yet set-up.
If you do not know an Enhanced Authentication provider's class ID, then please contact the Enhanced Authentication provider manufacturer.
ClassID Example: {76D8D888-B5AC-49FC-9408-8A45D37F3AC6}.

Disabled: No Enhanced Authentication providers can be specified. Enhanced Authentication cannot be utilized on client systems which are not yet set-up.

Disabled: Taking ownership remotely is not allowed.

This policy requires that all involved computers are members of trusted domains. It is only relevant for operating systems that support domain membership.

Determines who may read the Storage Root Key's (SRK) public key stored in a Trusted Platform Module. The SRK public key requires particular protection, since the Security Platform can be identified by it.

Enabled: An administrator can retrieve the SRK public key not only locally but also remotely.

Disabled: Retrieving the SRK public key remotely is not allowed.

The migration step Automatic export and authorization requires that this setting is enabled on the migration destination computer.
This policy requires that all involved computers are members of trusted domains.
This setting is only relevant for Operating Systems that support domain membership.

Disabled: The minimum password length is 6 characters.

This setting applies only for Owner Passwords set on a stand-alone Security Platform. The minimum password length for Owner Passwords set via Trusted Computing Management Server is set by the Trusted Computing Management Server policy with the same name.

Disabled: No password complexity requirements are enforced.

Enabled/Allow Management Provider only: Platforms can be initialized only via Management Provider interface.

Disabled: Platforms cannot be initialized.

Disabled: There is no enforcement to configure automatic backups. Backup can be configured after Security Platform Initialization via Settings Tool - Backup - Configure....

Be sure to enter a valid path which will be accessible to all Security Platform PC's. Otherwise the Backup configuration will fail.

Disabled: The backup target path can be freely specified when the feature Backup is configured.

Preconditions: Automatic backups must be configured. Also writing access to the System Backup Archive must be allowed.  

Disabled: The System Backup Archive will not be immediately updated after significant changes of Security Platform data. If automatic backups are configured and writing access to the System Backup Archive is allowed, the archive will be updated with the next scheduled System Backup.

Be sure to enter a valid path which will be accessible to all Security Platform PC's. Otherwise the Emergency Recovery configuration will fail.

Disabled: The Emergency Recovery Token can be created or selected when Emergency Recovery is configured.

Disabled: There is no enforcement to configure Password Reset. Password Reset can be configured after Security Platform Initialization via Settings Tool - Password Reset - Configure....

Be sure to enter a valid path which will be accessible to all Security Platform PC's. Otherwise the Password Reset configuration will fail.

Disabled: The Password Reset Token can be created or selected when Password Reset is configured.

In older versions, the file location for the Emergency Recovery Archive could be set explicitly during Security Platform Initialization. With this policy, the file location could be enforced.

In the current version, the file location is set automatically.