Edits

windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md

@@ -16,14 +16,14 @@ ms.date: 10/18/2019
 
 # BitLocker cannot encrypt a drive: known TPM issues
 
-This article describes common issues that can involve the Trusted Platform Module (TPM) that prevent BitLocker from encrypting a drive, and provides guidance for addressing those issues.
+This article describes common issues that affect the Trusted Platform Module (TPM) and that may prevent BitLocker from encrypting a drive. This article also provides guidance to address these issues.
 
 > [!NOTE]
 > If you have determined that your BitLocker issue does not involve the TPM, see [BitLocker cannot encrypt a drive: known issues](ts-bitlocker-cannot-encrypt-issues.md).
 
-## You see the message "The TPM is defending against dictionary attacks and is in a time-out period" and the TPM is locked
+## The TPM is locked and you see "The TPM is defending against dictionary attacks and is in a time-out period"
 
-When you turn on BitLocker Drive Encryption, it does not start and instead you see a message that resembles "The TPM is defending against dictionary attacks and is in a time-out period."
+When you turn on BitLocker Drive Encryption, it does not start. Instead, you receive a message that resembles "The TPM is defending against dictionary attacks and is in a time-out period."
 
 ### Cause
 
@@ -39,12 +39,12 @@ To resolve this issue, follow these steps:
    $Tpm = Get-WmiObject -class Win32_Tpm -namespace "root\CIMv2\Security\MicrosoftTpm" $ConfirmationStatus = $Tpm.GetPhysicalPresenceConfirmationStatus(22).ConfirmationStatus if($ConfirmationStatus -ne 4) {$Tpm.SetPhysicalPresenceRequest(22)}
    ```
 
-1. Restart the computer. If you receive a prompt at the restart screen, press F12 to agree.
-1. Try to start BitLocker Drive Encryption again.
+1. Restart the computer. If you are prompted at the restart screen, press F12 to agree.
+1. Try again to start BitLocker Drive Encryption.
 
-## You cannot prepare the TPM, and you see the message "The TPM is defending against dictionary attacks and is in a time-out period"
+## You cannot prepare the TPM, and you see "The TPM is defending against dictionary attacks and is in a time-out period"
 
-You cannot turn on BitLocker Drive Encryption on a device. You use the TPM management console (tpm.msc) to prepare the TPM on a device. The operation fails and you see a message that resembles "The TPM is defending against dictionary attacks and is in a time-out period."
+You cannot turn on BitLocker Drive Encryption on a device. You use the TPM management console (tpm.msc) to prepare the TPM on a device. The operation fails and you receive a message that resembles "The TPM is defending against dictionary attacks and is in a time-out period."
 
 ### Cause
 
@@ -52,33 +52,36 @@ The TPM is locked out.
 
 ### Resolution
 
-To resolve this issue, follow these steps:
+To resolve this issue, disable and re-enable the TPM. To do this, follow these steps:
 
-1. Disable and re-enable the TPM. To do this, follow these steps:
-   1. Restart the device and change the BIOS configuration to disable the TPM. 
-   1. Restart the device again, and return to the TPM management console. You should see a message that resembles "Compatible Trusted Platform Module (TPM) cannot be found on this computer. verify that this computer has 1.2 TPM and its is turned on in the BIOS."
-   1. Restart the device and change the BIOS configuration to enable the TPM.
-   1. Restart the device and return to the TPM management console.
-1. If you still cannot prepare the TPM, clear the existing TPM keys. To do this, follow the instructions in [Troubleshoot the TPM: Clear all the keys from the TPM](https://docs.microsoft.com/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm#clear-all-the-keys-from-the-tpm).
-   > [!WARNING]
-   > Clearing the TPM can result in data loss.  
+1. Restart the device, and change the BIOS configuration to disable the TPM.
+1. Restart the device again, and return to the TPM management console. You should receive a message that resembles the following:
+   > Compatible Trusted Platform Module (TPM) cannot be found on this computer. Verify that this computer has 1.2 TPM and it is turned on in the BIOS.
 
-## "Access Denied"Failed to backup TPM Owner Authorization information to Active Directory Domain Services. Errorcode: 0x80070005
+1. Restart the device, and change the BIOS configuration to enable the TPM.
+1. Restart the device, and return to the TPM management console.
 
-You have an environment that enforces the policy **Do not enable BitLocker until recovery information is stored in AD DS**. You try to turn on BitLocker Drive Encryption on a computer that runs Windows 7 and the operation fails. You see a message that resembles "Access Denied" or "Insufficient Rights."
+If you still cannot prepare the TPM, clear the existing TPM keys. To do this, follow the instructions in [Troubleshoot the TPM: Clear all the keys from the TPM](https://docs.microsoft.com/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm#clear-all-the-keys-from-the-tpm).
+
+> [!WARNING]
+> Clearing the TPM can cause data loss.  
+
+## Access Denied: Failed to backup TPM Owner Authorization information to Active Directory Domain Services. Errorcode: 0x80070005
+
+You have an environment that enforces the **Do not enable BitLocker until recovery information is stored in AD DS** policy. You try to turn on BitLocker Drive Encryption on a computer that runs Windows 7, but the operation fails. You receive a message that resembles "Access Denied" or "Insufficient Rights."
 
 ### Cause
 
-The TPM did not have sufficient permissions on the TPM Devices container in AD DS. Therefore, the BitLocker recovery information could not be backed up to AD DS, and BitLocker Drive Encryption could not run.
+The TPM did not have sufficient permissions on the TPM Devices container in Active Directory Domain Services (AD DS). Therefore, the BitLocker recovery information could not be backed up to AD DS, and BitLocker Drive Encryption could not run.
 
-This issue appears to be limited to computers that run versions of Windows that are older than Windows 10.
+This issue appears to be limited to computers that run versions of Windows that are earlier than Windows 10.
 
 ### Resolution  
 
-To verify that you have correctly identified this issue, you can use these approaches:
+To verify that you have correctly identified this issue, use one of the following methods:
 
-- Disable the policy or remove the computer from the domain, and try to turn on BitLocker Drive Encryption again. This time the operation should succeed.
-- Use LDAP and network trace tools to examine the LDAP exchanges between the client and the AD DS domain controller and identify the cause of the Access Denied or Insufficient Rights error. In this case, you should see the error when the client tries to access its object in the CN=TPM Devices,DC=\<*domain*>,DC=com container.
+- Disable the policy or remove the computer from the domain. Then try to turn on BitLocker Drive Encryption again. The operation should now succeed.
+- Use LDAP and network trace tools to examine the LDAP exchanges between the client and the AD DS domain controller to identify the cause of the "Access Denied" or "Insufficient Rights" error. In this case, you should see the error when the client tries to access its object in the "CN=TPM Devices,DC=\<*domain*>,DC=com" container.
 
 1. To review the TPM information for the affected computer, open an elevated Windows PowerShell window and run the following command:
 
@@ -86,19 +89,19 @@ To verify that you have correctly identified this issue, you can use these appro
    Get-ADComputer -Filter {Name -like "ComputerName"} -Property * | Format-Table name,msTPM-TPMInformationForComputer
    ```
 
-   In this command, ComputerName is the name of the affected computer.
+   In this command, *ComputerName* is the name of the affected computer.
 
 1. To resolve the issue, use a tool such as dsacls.exe to make sure that the access control list of msTPM-TPMInformationForComputer grants both Read and Write permissions to NTAUTHORITY/SELF.
 
-## Cannot prepare the TPM, Error 0x80072030 "There is no such object on the server"
+## Cannot prepare the TPM, error 0x80072030: "There is no such object on the server"
 
-Your domain controllers were upgraded from Windows Server 2008 R2to Windows Server 2012 R2. A Group Policy Object (GPO) enforces the policy **Do not enable BitLocker until recovery information is stored in AD DS**.  
+Your domain controllers were upgraded from Windows Server 2008 R2to Windows Server 2012 R2. A Group Policy Object (GPO) enforces the **Do not enable BitLocker until recovery information is stored in AD DS** policy.  
 
 You cannot turn on BitLocker Drive Encryption on a device. You use the TPM management console (tpm.msc) to prepare the TPM on a device. The operation fails and you see a message that resembles the following:
 
 > 0x80072030 There is no such object on the server when a policy to back up TPM information to active directory is enabled
 
-You have confirmed that the attributes ms-TPM-OwnerInformation and msTPM-TpmInformationForComputer are present.
+You have confirmed that the **ms-TPM-OwnerInformation** and **msTPM-TpmInformationForComputer** attributes are present.
 
 ### Cause
 
@@ -117,9 +120,9 @@ To resolve this issue, follow these steps:
    cscript <Path>Add-TPMSelfWriteACE.vbs
    ```
    
-   Where \<Path> is the path to the script file.
+   In this command \<*Path*> is the path to the script file.
 
 For more information, see the following articles:
 
-- [Back up the TPM Recovery Information to AD DS](https://docs.microsoft.com/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds)
-- [Prepare your organization for BitLocker: Planning and Policies](https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies)
+- [Back up the TPM recovery information to AD DS](https://docs.microsoft.com/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds)
+- [Prepare your organization for BitLocker: Planning and policies](https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies)

windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md

@@ -11,7 +11,7 @@ manager: kaushika
 audience: ITPro
 ms.collection: Windows Security Technologies\BitLocker
 ms.topic: troubleshooting
-ms.date: 10/7/2019
+ms.date: 10/18/2019
 ---
 
 # BitLocker and TPM: other known issues