--- name: "tpm_restrictpubek" section: "8" platform: "linux" package: "tpm-tools" version: "1.3.9.2-0.2" release: "Debian 13 (Trixie)" platforms: ["linux"] url: "https://new.carta.tech/tpm_restrictpubek" --- # tpm\_restrictpubek(8) restrict the ability to display the public portion of the Endorsement Key to the owner TPM Management - tpm\_restrictpubek ## NAME tpm\_restrictpubek - restrict the ability to display the public portion of the Endorsement Key to the owner ## SYNOPSIS **tpm\_restrictpubek** \[**OPTION**\] ## DESCRIPTION **tpm\_restrictpubek** reports the status of who can display the public portion of the Endorsement Key. This is the default behavior and also available with the **--status** option. This operation will be in effect until the owner is cleared and prompts for the owner passord. With the **--restrict** option, the ability to display the public portion of the Endorsement Key is resticted to the owner (via the TPM\_DisablePubekRead API). The command prompts for the owner password to complete the operation. The **--status** and **--restrict** options are mutually exclusive and the last one on the command line will be carried out. - **-h**, **--help** Display command usage info. - **-v**, **--version** Display command version info. - **-l**, **--log** \[none\|error\|info\|debug\] Set logging level. - **-u**, **--unicode** Use TSS UNICODE encoding for passwords to comply with applications using TSS popup boxes - **-s**, **--status** Display the status of who can see the public portion of the Endorsement Key - **-r**, **--restrict** Restrict seeing the public portion of the Endorsement Key to the owner - **-z**, **--well-known** Authenticate using 20 bytes of zeros as owner password (the default TSS Well Known Secret), instead of prompting for an owner password. ## SEE ALSO [**tpm\_version**(1)](/tpm_version/1.md), [**tpm\_takeownership**(8)](/tpm_takeownership/8.md), [**tpm\_getpubek**(8)](/tpm_getpubek/8.md), [**tcsd**(8)](/tcsd/8.md) ## REPORTING BUGS Report bugs to \