windows-itpro-docs/windows/client-management/mdm/tpmpolicy-csp.md

title, description, ms.author, ms.topic, ms.prod, ms.technology, author, ms.date

title	description	ms.author	ms.topic	ms.prod	ms.technology	author	ms.date
TPMPolicy CSP	TPMPolicy CSP	maricia	article	w10	windows	nickbrower	06/19/2017

TPMPolicy CSP

Warning

Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.

The TPMPolicy configuration service provider (CSP) provides a mechanism to enable zero exhaust configuration on a Windows device for TPM software components. Zero exhaust is defined as no network traffic (telemetry or otherwise, such as downloading background images, Windows Updates, etc.) from Windows and inbox applications to public IP addresses unless directly intended by the user. This allows the enterprise admin to configure devices where no network communication is initiated by the system without explicit approval.

The TPMPolicy CSP was added in Windows 10, version 1703.

The following diagram shows the TPMPolicy configuration service provider in tree format.

./Device/Vendor/MSFT/TPMPolicy

Defines the root node.

IsActiveZeroExhaust

Boolean value that indicates whether network traffic from the device to public IP addresses are not allowed unless directly intended by the user (zero exhaust). Default value is false. Some examples when zero exhaust is configured:

• There should be no traffic when machine is on idle. When the user is not interacting with the system/device, no traffic is expected.
• There should be no traffic during installation of Windows and first logon when local ID is used.
• Launching and using a local app (Notepad, Paint, etc.) should not send any traffic. Similarly, performing common tasks (clicking on start menu, browsing folders, etc.) should not send any traffic.
• Launching and using Internet enabled apps should not send any unexpected traffic (for maintenance, diagnostic, telemetry, etc.) to Microsoft.

Here is an example:

                <Replace>
                    <CmdID>101</CmdID>
                    <Item>
                        <Target>
                            <LocURI>
                                ./Vendor/MSFT/TpmPolicy/IsActiveZeroExhaust
                            </LocURI>
                        </Target>
                        <Meta>
                            <Format>bool</Format>
                                <Type>text/plain</Type>
                        </Meta>
                        <Data>true</Data>
                    </Item>
                </Replace>