1

Good morning Spiceworks…

I have a power shell question for you.

I am attempting to start looking at our systems to implement Bitlocker on some of my domain computers. I am attempting to determine what bios level they are at, and if the systems have TPM enabled, of if they have the TPM chip.

I have made this script, and everything runs great untill it tries to read the line

root\CIMV2\Security\MicrosoftTpm

I get “access denied” when i run it both as a domain admin, and a local admin, i have also "run it as administrator

all systems are windows 7.

i can run the script on my local computer just fine, but trying to do remote computers is when i get “access denied”

foreach ($computersystem in Get-Content c:\powershell\ggComputerList.csv)
{
$computerinfo = get-wmiobject -computername $computersystem Win32_ComputerSystem
$computerBIOS = get-wmiobject -computername $computerSystem Win32_BIOS
$computerOS = get-wmiobject -computername $computerSystem Win32_OperatingSystem
$tpm = Get-WmiObject -class Win32_Tpm -namespace root\CIMV2\Security\MicrosoftTpm -ComputerName $computerSystem
"System Information for: " + $computerinfo.Name
""
"Manufacturer: " + $computerinfo.Manufacturer
"Model: " + $computerinfo.Model
"Serial Number: " + $computerBIOS.SerialNumber
"Bios Version: " + $computerBIOS.Version
"TPM: " + $tpm
"Operating System: " + $computerOS.caption + ", Service Pack: " + $computerOS.ServicePackMajorVersion
"Total Memory in Gigabytes: " + $computerinfo.TotalPhysicalMemory/1gb
"User logged In: " + $computerinfo.UserName
"Last Reboot: " + $computerinfo.ConvertToDateTime($computerOS.LastBootUpTime)
""
""
}
6 Spice ups
2

Has PowerShell Remoting been enabled?

1 Spice up
3

yes, i did a check, and it came back enabled

the rest of the script runs fine, just the part to get the TPM chip info

4

I can’t get Win32_TPM to do anything for me. Just returns $null on my laptop and I get the access denied message too. Did you at least get it working locally?

5

when i run this command on my local system, it gives me good results:

Get-WmiObject -class Win32_Tpm -namespace root\CIMV2\Security\MicrosoftTpm  -computername (mysystemnumber)

__GENUS : 2

__CLASS : Win32_Tpm

__SUPERCLASS :

__DYNASTY : Win32_Tpm

__RELPATH : Win32_Tpm=@

__PROPERTY_COUNT : 8

__DERIVATION : {}

__SERVER : (mysystemnumber)

__NAMESPACE : root\CIMV2\Security\MicrosoftTpm

__PATH : \(mysystem)W3010\root\CIMV2\Security\MicrosoftTpm:Win32_Tpm=@

IsActivated_InitialValue : False

IsEnabled_InitialValue : True

IsOwned_InitialValue : False

ManufacturerId : 1398033696

ManufacturerVersion : 8.32

ManufacturerVersionInfo : Not Supported

PhysicalPresenceVersionInfo : 1.0

SpecVersion : 1.2, 2, 3

PSComputerName : (mysystemnumber)

6

run the same script on a remote system, access denied

7

http://gallery.technet.microsoft.com/scriptcenter/Script-to-list-TPM-chip-7e651c27

With what TPM is, I wouldn’t be surprised if there was some type of OS security reason you can’t get it’s status remotely. However, you should be able to run the script on the remote machine and have it report back, as in the script linked.

8

Please read the forum etiquette before posting. You neededn’t have posted so many lines. Sorry to sound grouchy, but your issue is with just one line of code:

Get-WmiObject -class Win32_Tpm -namespace root\CIMV2\Security\MicrosoftTpm -ComputerName $computerSystem

I also get this error.

To fix it, use wmimgt.msc (see http://community.spiceworks.com/education/projects/Setting_The_Default_WMI_Namespace_Security )

Open properties, and navigate to teh Root\CimV2\Security\MicrooftTPM node, and give yourself full control.

9

i set my user, and domain admin with full permission, and no joy.

10

i checked the application log on the remote computer and i get this:

The root\CIMV2\Security\MicrosoftTpm namespace is marked with the RequiresEncryption flag. Access to this namespace might be denied if the script or application does not have the appropriate authentication level. Change the authentication level to Pkt_Privacy and run the script or application again.

11

looks like i needed to add -Authentication PacketPrivacy to the command.

12 
$tpm = Get-WmiObject -class Win32_Tpm -namespace root\CIMV2\Security\MicrosoftTpm -ComputerName $computerSystem -Authentication PacketPrivacy

this fixed it thanks for your help

1 Spice up